#!/bin/sh
#
# Startup script to implement /etc/sysconfig/iptables pre-defined rules.
#
# chkconfig: 2345 08 92
#
# description: Automates a packet filtering firewall with iptables.
#
# by bero@redhat.com, based on the ipchains script:
# Script Author: Joshua Jensen <joshua@redhat.com>
#   -- hacked up by gafton with help from notting
# modified by Anton Altaparmakov <aia21@cam.ac.uk>:
# modified by Nils Philippsen <nils@redhat.de>
# modificado by Antonio Luiz <antoniol.ds@darte.com.br>
#
# config: /etc/sysconfig/iptables

# Source 'em up
. /etc/init.d/functions

IPTABLES_CONFIG=/etc/sysconfig/iptables
IPTABLES_BIN=/usr/sbin/iptables

if [ ! -x $IPTABLES_BIN ]; then
        exit 0
fi

KERNELMAJ=`uname -r | sed                   -e 's,\..*,,'`
KERNELMIN=`uname -r | sed -e 's,[^\.]*\.,,' -e 's,\..*,,'`

if [ "$KERNELMAJ" -lt 2 ] ; then
        exit 0
fi
if [ "$KERNELMAJ" -eq 2 -a "$KERNELMIN" -lt 3 ] ; then
        exit 0
fi

if  /sbin/lsmod 2>/dev/null |grep -q ipchains ; then
        # Don't do both
        exit 0
fi
iftable() {
        if fgrep -qsx $1 /proc/net/ip_tables_names; then
                $IPTABLES_BIN -t "$@"
        fi
}


start() {
        # don't do squat if we don't have the config file
        if [ -f $IPTABLES_CONFIG ]; then
            # If we don't clear these first, we might be adding to
            #  pre-existing rules.
            action $"Nivelando todas as regras do usuários - definido chains:" iptables -F
            action $"Cancelando todas as regras do usuários - definido chains:" iptables -X
            chains=`cat /proc/net/ip_tables_names 2>/dev/null`
            for i in $chains; do $IPTABLES_BIN -t $i -F; done && \
              success $"Nivelando todas as regras do usuários - definido chains:" || \
              failure $"Nivelando todas as regras do usuários - defined chains:"
            for i in $chains; do $IPTABLES_BIN -t $i -X; done && \
              success $"Cancelando todas as regras do usuários - defined chains:" || \
              failure $"Cancelando todas as regras do usuários - defined chains:"

            for i in $chains; do $IPTABLES_BIN -t $i -Z; done

            echo $"Aplicando regras do firewall dos iptables: "
                grep -v "^[[:space:]]*#" $IPTABLES_CONFIG | grep -v '^[[:space:]]*$' | /usr/sbin/iptables-restore -c && \
                    success $"Aplicando regras do firewall dos iptables:" || \
                    failure $"Aplicando regras do firewall dos iptables:"
            echo
            # Para permitir NAT e FTP através de NAT
            echo 1 > /proc/sys/net/ipv4/ip_forward 2>/dev/null
            insmod ip_nat_ftp > /dev/null 2>&1
            insmod ip_conntrack_ftp > /dev/null 2>&1
            touch /var/lock/subsys/iptables
        fi
}
stop() {
        chains=`cat /proc/net/ip_tables_names 2>/dev/null`
        for i in $chains; do $IPTABLES_BIN -t $i -F; done && \
                success $"Flushing all chains:" || \
                failure $"Flushing all chains:"
        for i in $chains; do $IPTABLES_BIN -t $i -X; done && \
                success $"Removing user defined chains:" || \
                failure $"Removing user defined chains:"
        echo -n $"Resetting built-in chains to the default ACCEPT policy:"
        iftable filter -P INPUT ACCEPT && \
           iftable filter -P OUTPUT ACCEPT && \
           iftable filter -P FORWARD ACCEPT && \
           iftable nat -P PREROUTING ACCEPT && \
           iftable nat -P POSTROUTING ACCEPT && \
           iftable nat -P OUTPUT ACCEPT && \
           iftable mangle -P PREROUTING ACCEPT && \
           iftable mangle -P OUTPUT ACCEPT && \
           success $"Resetting built-in chains to the default ACCEPT policy" || \
           failure $"Resetting built-in chains to the default ACCEPT policy"
        echo
        rm -f /var/lock/subsys/iptables
}

case "$1" in
  start)
        start
        ;;

  stop)
        stop
        ;;

  restart)
        # "restart" is really just "start" as this isn't a daemon,
        #  and "start" clears any pre-defined rules anyway.
        #  This is really only here to make those who expect it happy
        start
        ;;

  condrestart)
        [ -e /var/lock/subsys/iptables ] && start
        ;;

  status)
        tables=`cat /proc/net/ip_tables_names 2>/dev/null`
        for table in $tables; do
                echo $"Table: $table"
                $IPTABLES_BIN -t $table --list
        done
        ;;

  panic)
        echo -n $"Changing target policies to DROP: "
        iftable filter -P INPUT DROP && \
            iftable filter -P FORWARD DROP && \
            iftable filter -P OUTPUT DROP && \
            iftable nat -P PREROUTING DROP && \
            iftable nat -P POSTROUTING DROP && \
            iftable nat -P OUTPUT DROP && \
            iftable mangle -P PREROUTING DROP && \
            iftable mangle -P OUTPUT DROP && \
            success $"Changing target policies to DROP" || \
            failure $"Changing target policies to DROP"
        echo
        iftable filter -F INPUT && \
                iftable filter -F FORWARD && \
                iftable filter -F OUTPUT && \
                iftable nat -F PREROUTING && \
                iftable nat -F POSTROUTING && \
                iftable nat -F OUTPUT && \
                iftable mangle -F PREROUTING && \
                iftable mangle -F OUTPUT && \
                success $"Flushing all chains:" || \
                failure $"Flushing all chains:"
        iftable filter -X INPUT && \
                iftable filter -X FORWARD && \
                iftable filter -X OUTPUT && \
                iftable nat -X PREROUTING && \
                iftable nat -X POSTROUTING && \
                iftable nat -X OUTPUT && \
                iftable mangle -X PREROUTING && \
                iftable mangle -X OUTPUT && \
                success $"Removing user defined chains:" || \
   failure $"Removing user defined chains:"
        ;;

  save)
        echo -n $"Saving current rules to $IPTABLES_CONFIG: "
        touch $IPTABLES_CONFIG
        chmod 600 $IPTABLES_CONFIG
        /usr/sbin/iptables-save -c > $IPTABLES_CONFIG  2>/dev/null && \
          success $"Saving current rules to $IPTABLES_CONFIG" || \
          failure $"Saving current rules to $IPTABLES_CONFIG"
        echo
        ;;

  *)
        echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save}"
        exit 1
esac

exit 0