Port the RedHatIptables script to Ubuntu

I personally think the ufw provided by Ubuntu is complicated to use. In the previous article, I provided the redhatipables script to suse. This article is about to take a short time in ubuntu and there are not many tests. If there are any errors, please correct me, the script is as follows #! /Bin/bash # iptablesStartiptablesfirewall # Author: dedevil & lt; guxing1841@gmail.com & gt; # chkconfig: 234

I personally think the ufw provided by Ubuntu is complicated to use. In the previous article, I provided the redhat ipables script to suse. This article is about to take a short time in ubuntu and there are not many tests. If there are any errors, please correct them. The script is as follows:

#! /Bin/bash
#
# Iptables Start iptables firewall
#
# Author: dedevil
# Chkconfig: 2345 08 92
# Description: Starts, stops and saves iptables firewall
#
# Config:/etc/sysconfig/iptables
# Config:/etc/sysconfig/iptables-config

# Source function library.

IPTABLES = iptables
IPTABLES_DATA =/etc/sysconfig/$ IPTABLES
IPTABLES_CONFIG =/etc/sysconfig/$ {IPTABLES}-config
IPV =$ {IPTABLES % tables} # ip for ipv4 | ip6 for ipv6
PROC_IPTABLES_NAMES =/proc/net/$ {IPV} _ tables_names
VAR_SUBSYS_IPTABLES =/var/lock/subsys/$ IPTABLES

./Lib/lsb/init-functions

# Our configuration file
DEFAULT =/etc/default/iptables

# Default settings...
ENABLED = "false"
SA1_OPTIONS = ""

#... Overriden in the configuration file
Test-r "$ DEFAULT" &. "$ DEFAULT"

 

If [! -X/sbin/$ IPTABLES]; then
Log_failure_msg $ "/sbin/$ IPTABLES does not exist ."
Exit 0
Fi

If lsmod 2>/dev/null | grep-q ipchains; then
Log_failure_msg $ "ipchains and $ IPTABLES can not be used together ."
Exit 0
Fi

# Old or new modutils
/Sbin/modprobe -- version 2> & 1 | grep-q module-init-tools \
& NEW_MODUTILS = 1 \
| NEW_MODUTILS = 0

# Default firewall configuration:
IPTABLES_MODULES = ""
IPTABLES_MODULES_UNLOAD = "yes"
IPTABLES_SAVE_ON_STOP = "no"
IPTABLES_SAVE_ON_RESTART = "no"
IPTABLES_SAVE_COUNTER = "no"
IPTABLES_STATUS_NUMERIC = "yes"

# Load firewall configuration.
[-F "$ IPTABLES_CONFIG"] &. "$ IPTABLES_CONFIG"

Rmmod_r (){
# Unload module with all referring modules.
# At first all referring modules will be unloaded, then the module itself.
Local mod = $1
Local ret = 0
Local ref =

# Get referring modules.
# New modutils have another output format.
[$ NEW_MODUTILS = 1] \
& Ref = 'lsmod | awk "/^ $ {mod}/{print \ $4;}" | tr ',''''\
| Ref = 'lsmod | grep ^ $ {mod} | cut-d "["-s-f 2 | cut-d "]"-s-f 1'

# Recursive call for all referring modules
For I in $ ref; do
Rmmod_r $ I
Let ret + =$ ?;
Done

# Unload module.
# The extra test is for 2.6: The module might have autocleaned,
# After all referring modules are unloaded.
If grep-q "^ $ {mod}"/proc/modules; then
Modprobe-r $ mod>/dev/null 2> & 1
Let ret + =$ ?;
Fi

Return $ ret
}

Flush_n_delete (){
# Flush firewall rules and delete chains.
[-E "$ PROC_IPTABLES_NAMES"] | return 1

# Check if firewall is configured (has tables)
Tables = 'cat $ PROC_IPTABLES_NAMES 2>/dev/null'
[-Z "$ tables"] & return 1

Log_daemon_msg $ "Flushing firewall rules :"
Ret = 0

# For all tables
For I in $ tables; do
# Flush firewall rules.
$ IPTABLES-t $ I-F;
Let ret + =$ ?;

# Delete firewall chains.
$ IPTABLES-t $ I-X;
Let ret + =$ ?;

# Set counter to zero.
$ IPTABLES-t $ I-Z;
Let ret + =$ ?;
Done

[$ Ret-eq 0] & log_end_msg 0 | log_end_msg 1
Echo
Return $ ret
}

Set_policy (){
# Set policy for configured tables.
Policy = $1

# Check if iptable module is loaded
[! -E "$ PROC_IPTABLES_NAMES"] & return 1

# Check if firewall is configured (has tables)
Tables = 'cat $ PROC_IPTABLES_NAMES 2>/dev/null'
[-Z "$ tables"] & return 1

Log_daemon_msg $ "Setting chains to policy $ policy :"
Ret = 0
For I in $ tables; do
Log_daemon_msg "$ I"
Case "$ I" in
Raw)
$ IPTABLES-t raw-p prerouting $ policy \
& $ IPTABLES-t raw-p output $ policy \
| Let ret + = 1
;;
Filter)
$ IPTABLES-t filter-p input $ policy \
& $ IPTABLES-t filter-p output $ policy \
& $ IPTABLES-t filter-p forward $ policy \
| Let ret + = 1
;;
Nat)
$ IPTABLES-t nat-p prerouting $ policy \
& $ IPTABLES-t nat-p postrouting $ policy \
& $ IPTABLES-t nat-p output $ policy \
| Let ret + = 1
;;
Mangle)
$ IPTABLES-t mangle-p prerouting $ policy \
& $ IPTABLES-t mangle-p postrouting $ policy \
& $ IPTABLES-t mangle-p input $ policy \
& $ IPTABLES-t mangle-p output $ policy \
& $ IPTABLES-t mangle-p forward $ policy \
| Let ret + = 1
;;
*)
Let ret + = 1
;;
Esac
Done

[$ Ret-eq 0] & log_end_msg 0 | log_end_msg 1
Echo
Return $ ret
}

Start (){
# Do not start if there is no config file.
[-F "$ IPTABLES_DATA"] | return 1

Log_daemon_msg $ "Applying $ IPTABLES firewall rules :"

OPT =
["X $ IPTABLES_SAVE_COUNTER" = "xyes"] & OPT = "-c"

$ IPTABLES-restore $ OPT $ IPTABLES_DATA
If [$? -Eq 0]; then
Log_end_msg 0; echo
Else
Log_end_msg 1; echo; return 1
Fi

# Load additional modules (helpers)
If [-n "$ IPTABLES_MODULES"]; then
Log_daemon_msg $ "Loading additional $ IPTABLES modules :"
Ret = 0
For mod in $ IPTABLES_MODULES; do
Log_daemon_msg "$ mod"
Modprobe $ mod>/dev/null 2> & 1
Let ret + =$ ?;
Done
[$ Ret-eq 0] & log_end_msg 0 | log_end_msg 1
Echo
Fi

Touch $ VAR_SUBSYS_IPTABLES
Return $ ret
}

Stop (){
# Do not stop if iptables module is not loaded.
[-E "$ PROC_IPTABLES_NAMES"] | return 1

Flush_n_delete
Set_policy ACCEPT

If ["x $ IPTABLES_MODULES_UNLOAD" = "xyes"]; then
Log_daemon_msg $ "Unloading $ IPTABLES modules :"
Ret = 0
Rmmod_r $ {IPV} _ tables
Let ret + =$ ?;
Rmmod_r $ {IPV} _ conntrack
Let ret + =$ ?;
[$ Ret-eq 0] & log_end_msg 0 | log_end_msg 1
Echo
Fi

Rm-f $ VAR_SUBSYS_IPTABLES
Return $ ret
}

Save (){
# Check if iptable module is loaded
[! -E "$ PROC_IPTABLES_NAMES"] & return 1

# Check if firewall is configured (has tables)
Tables = 'cat $ PROC_IPTABLES_NAMES 2>/dev/null'
[-Z "$ tables"] & return 1

Log_daemon_msg $ "Saving firewall rules to $ IPTABLES_DATA :"

OPT =
["X $ IPTABLES_SAVE_COUNTER" = "xyes"] & OPT = "-c"

Ret = 0
TMP_FILE = '/bin/mktemp-q/tmp/$ IPTABLES. xxxxxx '\
& Amp; chmod 600 "$ TMP_FILE "\
& $ IPTABLES-save $ OPT> $ TMP_FILE 2>/dev/null \
& Size = 'stat-C' % s' $ TMP_FILE '& [$ size-gt 0] \
| Ret = 1
If [$ ret-eq 0]; then
If [-e $ IPTABLES_DATA]; then
Cp-f $ IPTABLES_DATA $ IPTABLES_DATA.save \
& Amp; chmod 600 $ IPTABLES_DATA.save \
| Ret = 1
Fi
If [$ ret-eq 0]; then
Cp-f $ TMP_FILE $ IPTABLES_DATA \
& Amp; chmod 600 $ IPTABLES_DATA \
| Ret = 1
Fi
Fi
[$ Ret-eq 0] & log_end_msg 0 | log_end_msg 1
Echo
Rm-f $ TMP_FILE
Return $ ret
}

Status (){
Tables = 'cat $ PROC_IPTABLES_NAMES 2>/dev/null'

# Do not print status if lockfile is missing and iptables modules are not
# Loaded.
# Check if iptable module is loaded
If [! -F "$ VAR_SUBSYS_IPTABLES"-a-z "$ tables"]; then
Log_daemon_msg $ "Firewall is stopped ."
Return 1
Fi

# Check if firewall is configured (has tables)
If [! -E "$ PROC_IPTABLES_NAMES"]; then
Log_daemon_msg $ "Firewall is not configured ."
Return 1
Fi
If [-z "$ tables"]; then
Log_daemon_msg $ "Firewall is not configured ."
Return 1
Fi

NUM =
["X $ IPTABLES_STATUS_NUMERIC" = "xyes"] & NUM = "-n"
VERBOSE =
["X $ IPTABLES_STATUS_VERBOSE" = "xyes"] & VERBOSE = "-- verbose"
COUNT =
["X $ IPTABLES_STATUS_LINENUMBERS" = "xyes"] & COUNT = "-- line-numbers"

For table in $ tables; do
Log_daemon_msg $ "Table: $ table"
$ IPTABLES-t $ table -- list $ NUM $ VERBOSE $ COUNT & echo
Done

Return 0
}

Restart (){
["X $ IPTABLES_SAVE_ON_RESTART" = "xyes"] & save
Stop
Start
}

Case "$1" in
Start)
If ["$ ENABLED" = "true"]; then
Stop
Start
RETVAL =$?
Else
Log_failure_msg $ "iptables is disable"
Fi
;;
Stop)
["X $ IPTABLES_SAVE_ON_STOP" = "xyes"] & save
Stop
RETVAL =$?
;;
Restart)
Restart
RETVAL =$?
;;
Condrestart)
[-E "$ VAR_SUBSYS_IPTABLES"] & restart
RETVAL =$?
;;
Status)
Status
RETVAL =$?
;;
Panic)
Flush_n_delete
Set_policy DROP
RETVAL =$?
;;
Save)
Save
RETVAL =$?
;;
*)
Log_action_msg $ "Usage: $0 {start | stop | restart | condrestart | status | panic | save }"
Exit 1
;;
Esac

Exit $ RETVAL