#!/bin/sh # # Startup script to implement /etc/sysconfig/iptables pre-defined rules. # Source 'em up . /etc/init.d/functions IPTABLES_CONFIG=/etc/sysconfig/iptables IPTABLES=/sbin/iptables EXTIP= #External IP PANTHER=192.168.100.10 #Internal Machine JAGUAR=192.168.100.5 #Internal Machine if [ ! -x /sbin/iptables ]; then exit 0 fi KERNELMAJ=`uname -r | sed -e 's,\..*,,'` KERNELMIN=`uname -r | sed -e 's,[^\.]*\.,,' -e 's,\..*,,'` if [ "$KERNELMAJ" -lt 2 ] ; then exit 0 fi if [ "$KERNELMAJ" -eq 2 -a "$KERNELMIN" -lt 3 ] ; then exit 0 fi if /sbin/lsmod 2>/dev/null |grep -q ipchains ; then # Don't do both exit 0 fi iftable() { if fgrep -qsx $1 /proc/net/ip_tables_names; then iptables -t "$@" fi } start() { action $"Flushing all current rules and user defined chains:" iptables -F action $"Clearing all current rules and user defined chains:" iptables -X chains=`cat /proc/net/ip_tables_names 2>/dev/null` for i in $chains; do iptables -t $i -F; done && \ success $"Flushing all current rules and user defined chains:" || \ failure $"Flushing all current rules and user defined chains:" for i in $chains; do iptables -t $i -X; done && \ success $"Clearing all current rules and user defined chains:" || \ failure $"Clearing all current rules and user defined chains:" for i in $chains; do iptables -t $i -Z; done echo "1" > /proc/sys/net/ipv4/ip_forward echo $"Applying iptables firewall rules: " ##ONLY NEEDED FOR Special PORT FORWARDING### #$IPTABLES -t nat -A PREROUTING -p tcp -d $EXTIP --dport 3300 -j DNAT --to $JAGUAR:80 #$IPTABLES -t nat -A PREROUTING -p tcp -d $EXTIP --dport 5631 -j DNAT --to $PANTHER #$IPTABLES -t nat -A PREROUTING -p udp -d $EXTIP --dport 5632 -j DNAT --to $PANTHER #$IPTABLES -t nat -A PREROUTING -p tcp -d $EXTIP --dport 3389 -j DNAT --to $PANTHER #$IPTABLES -t nat -A PREROUTING -p tcp -d $EXTIP --dport 5222 -j DNAT --to $JAGUAR #$IPTABLES -t nat -A PREROUTING -p tcp -d $EXTIP --dport 5269 -j DNAT --to $JAGUAR #$IPTABLES -t nat -A PREROUTING -p tcp -d $EXTIP --dport 5555 -j DNAT --to $JAGUAR ## END ONLY NEEDED FOR Special PORT FORWARDING### $IPTABLES -t nat -A POSTROUTING -s 192.168.100.0/24 -d 0/0 -j MASQUERADE $IPTABLES -N drop-and-log-it $IPTABLES -A drop-and-log-it -j LOG --log-level info $IPTABLES -A drop-and-log-it -j DROP $IPTABLES -A FORWARD -i eth1 -o eth0 -j ACCEPT ##ONLY NEEDED FOR Special PORT FORWARDING### #$IPTABLES -A FORWARD -i eth0 -o eth1 -p tcp --dport 3300 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT #$IPTABLES -A FORWARD -i eth0 -o eth1 -p tcp --dport 5631 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT #$IPTABLES -A FORWARD -i eth0 -o eth1 -p udp --dport 5632 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT #$IPTABLES -A FORWARD -i eth0 -o eth1 -p tcp --dport 5222 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT #$IPTABLES -A FORWARD -i eth0 -o eth1 -p tcp --dport 5269 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT #$IPTABLES -A FORWARD -i eth0 -o eth1 -p tcp --dport 5555 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT ## END ONLY NEEDED FOR Special PORT FORWARDING### $IPTABLES -A FORWARD -i eth0 -o eth1 -j ACCEPT echo touch /var/lock/subsys/iptables } stop() { chains=`cat /proc/net/ip_tables_names 2>/dev/null` for i in $chains; do iptables -t $i -F; done && \ success $"Flushing all chains:" || \ failure $"Flushing all chains:" for i in $chains; do iptables -t $i -X; done && \ success $"Removing user defined chains:" || \ failure $"Removing user defined chains:" echo -n $"Resetting built-in chains to the default ACCEPT policy:" iftable filter -P INPUT ACCEPT && \ iftable filter -P OUTPUT ACCEPT && \ iftable filter -P FORWARD ACCEPT && \ iftable nat -P PREROUTING ACCEPT && \ iftable nat -P POSTROUTING ACCEPT && \ iftable nat -P OUTPUT ACCEPT && \ iftable mangle -P PREROUTING ACCEPT && \ iftable mangle -P OUTPUT ACCEPT && \ success $"Resetting built-in chains to the default ACCEPT policy" || \ failure $"Resetting built-in chains to the default ACCEPT policy" echo rm -f /var/lock/subsys/iptables } case "$1" in start) start ;; stop) stop ;; restart) # "restart" is really just "start" as this isn't a daemon, # and "start" clears any pre-defined rules anyway. # This is really only here to make those who expect it happy start ;; condrestart) [ -e /var/lock/subsys/iptables ] && start ;; status) tables=`cat /proc/net/ip_tables_names 2>/dev/null` for table in $tables; do echo $"Table: $table" iptables -t $table --list done ;; panic) echo -n $"Changing target policies to DROP: " iftable filter -P INPUT DROP && \ iftable filter -P FORWARD DROP && \ iftable filter -P OUTPUT DROP && \ iftable nat -P PREROUTING DROP && \ iftable nat -P POSTROUTING DROP && \ iftable nat -P OUTPUT DROP && \ iftable mangle -P PREROUTING DROP && \ iftable mangle -P OUTPUT DROP && \ success $"Changing target policies to DROP" || \ failure $"Changing target policies to DROP" echo iftable filter -F INPUT && \ iftable filter -F FORWARD && \ iftable filter -F OUTPUT && \ iftable nat -F PREROUTING && \ iftable nat -F POSTROUTING && \ iftable nat -F OUTPUT && \ iftable mangle -F PREROUTING && \ iftable mangle -F OUTPUT && \ success $"Flushing all chains:" || \ failure $"Flushing all chains:" iftable filter -X INPUT && \ iftable filter -X FORWARD && \ iftable filter -X OUTPUT && \ iftable nat -X PREROUTING && \ iftable nat -X POSTROUTING && \ iftable nat -X OUTPUT && \ iftable mangle -X PREROUTING && \ iftable mangle -X OUTPUT && \ success $"Removing user defined chains:" || \ failure $"Removing user defined chains:" ;; save) echo -n $"Saving current rules to $IPTABLES_CONFIG: " touch $IPTABLES_CONFIG chmod 600 $IPTABLES_CONFIG /sbin/iptables-save -c > $IPTABLES_CONFIG 2>/dev/null && \ success $"Saving current rules to $IPTABLES_CONFIG" || \ failure $"Saving current rules to $IPTABLES_CONFIG" echo ;; *) echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save}" exit 1 esac exit 0