#!/bin/sh
#
# Startup script to implement /etc/sysconfig/iptables pre-defined rules.
#
# chkconfig: 2345 08 92
#
# description: Automates a packet filtering firewall with iptables.
#
# by bero@redhat.com, based on the ipchains script:
# Script Author:	Joshua Jensen <joshua@redhat.com>
#   -- hacked up by gafton with help from notting
# modified by Anton Altaparmakov <aia21@cam.ac.uk>:
# modified by Nils Philippsen <nils@redhat.de>
#
# config: /etc/sysconfig/iptables

# Source 'em up
. /etc/init.d/functions


if [ ! -x /sbin/iptables ]; then
	exit 0
fi



start() {
	    # If we don't clear these first, we might be adding to
	    #  pre-existing rules.
	    action $"Flushing all current rules and user defined chains:" iptables -F
	    action $"Clearing all current rules and user defined chains:" iptables -X
	    chains=`cat /proc/net/ip_tables_names 2>/dev/null`
            for i in $chains; do iptables -t $i -F; done && \
              success $"Flushing all current rules and user defined chains:" || \
              failure $"Flushing all current rules and user defined chains:"	    
            for i in $chains; do iptables -t $i -X; done && \
              success $"Clearing all current rules and user defined chains:" || \
              failure $"Clearing all current rules and user defined chains:"

            for i in $chains; do iptables -t $i -Z; done

	    echo $"Applying iptables firewall rules: "
	    #iptables-restore</etc/multiconf/iptablerules
	    retvalue=`/etc/multiconf/scripts/iptableop rest`
	    if [ $retvalue -ne 0 ]; then
	    	if [ $retvalue -eq 1 ]; then
			cp -f /etc/multiconf/iptinitbackup1 /etc/multiconf/iptablerules
		fi
	    	if [ $retvalue -eq 2 ]; then
			cp -f /etc/multiconf/iptinitbackup /etc/multiconf/iptablerules
		fi
		/etc/multiconf/scripts/iptableop rest
	  fi
			
	    
	    # Flush the dynamic chains
	    /sbin/iptables -F DYNAMIC_PORTS_OUTBOUND
	    if [ $? -ne 0 ]; then
		if [ -f /etc/multiconf/iptinitbackup1 ]; then
			cp -f /etc/multiconf/iptinitbackup1 /etc/multiconf/iptablerules
			retvalue=`/etc/multiconf/scripts/iptableop rest`
			if [ $retvalue -eq 1 ]; then
				cp -f /etc/multiconf/iptinitbackup /etc/multiconf/iptablerules
				/etc/multiconf/scripts/iptableop rest
			fi
		else
			cp -f /etc/multiconf/iptinitbackup /etc/multiconf/iptablerules
			/etc/multiconf/scripts/iptableop rest
			
		fi
		
	fi
		rm -f /etc/multiconf/iptinitbackup
		if [ -f /etc/multiconf/iptinitbackup1 ]; then
			rm -f /etc/multiconf/iptinitbackup1
		fi 
	    touch /var/lock/subsys/iptables
}

stop() {
	`/etc/multiconf/scripts/seteth1address checkpppup 1>/dev/null 2>/dev/null`
	
#	iptables-save>/etc/multiconf/iptablerules

	chains=`cat /proc/net/ip_tables_names 2>/dev/null`
        for i in $chains; do iptables -t $i -F; done && \
                success $"Flushing all chains:" || \
                failure $"Flushing all chains:"
        for i in $chains; do iptables -t $i -X; done && \
                success $"Removing user defined chains:" || \
                failure $"Removing user defined chains:"
        echo -n $"Resetting built-in chains to the default DROP policy:"
	iptables -P FORWARD DROP
	iptables -P INPUT DROP
	iptables -P OUTPUT DROP
#	/etc/multiconf/scripts/iptables_stop
	echo
	rm -f /var/lock/subsys/iptables

}

case "$1" in
  start)
	start
	;;

  stop)
	stop
	;;

  restart)
	# "restart" is really just "start" as this isn't a daemon,
	#  and "start" clears any pre-defined rules anyway.
	#  This is really only here to make those who expect it happy
	start
	;;

  condrestart)
	[ -e /var/lock/subsys/iptables ] && start
	;;

  status)
	echo $"Table: filter"
	iptables --list
	echo $"Table: nat"
	iptables -t nat --list
	echo $"Table: mangle"
	iptables -t mangle --list
	;;

  panic)
	echo -n $"Changing target policies to DROP: "	
	iptables -P INPUT DROP && \
	    iptables -P FORWARD DROP && \
	    iptables -P OUTPUT DROP && \
	    iptables -t nat -P PREROUTING DROP && \
	    iptables -t nat -P POSTROUTING DROP && \
	    iptables -t nat -P OUTPUT DROP && \
	    iptables -t mangle -P PREROUTING DROP && \
	    iptables -t mangle -P OUTPUT DROP && \
	    success $"Changing target policies to DROP" || \
	    failure $"Changing target policies to DROP"
	echo
        iptables -F INPUT && \
                iptables -F FORWARD && \
                iptables -F OUTPUT && \
                iptables -t nat -F PREROUTING && \
                iptables -t nat -F POSTROUTING && \
                iptables -t nat -F OUTPUT && \
                iptables -t mangle -F PREROUTING && \
                iptables -t mangle -F OUTPUT && \
                success $"Flushing all chains:" || \
                failure $"Flushing all chains:"
        iptables -X INPUT && \
                iptables -X FORWARD && \
                iptables -X OUTPUT && \
                iptables -t nat -X PREROUTING && \
                iptables -t nat -X POSTROUTING && \
                iptables -t nat -X OUTPUT && \
                iptables -t mangle -X PREROUTING && \
                iptables -t mangle -X OUTPUT && \
                success $"Removing user defined chains:" || \
                failure $"Removing user defined chains:"
        ;;

  save)
	echo -n $"Saving current rules: "
	#/sbin/iptables-save > /etc/multiconf/iptablerules  2>/dev/null && \
	#  success $"Saving current rules" || \
	#  failure $"Saving current rules"
	`/etc/multiconf/scripts/iptableop save  2>/dev/null` && \
	  success $"Saving current rules" || \
	  failure $"Saving current rules"
	echo
	;;

  *)
	echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save}"
	exit 1
esac

exit 0

