#!/bin/sh
### BEGIN INIT INFO
# Provides: local-iptables
# Required-Start: $local_fs
# Required-Stop: $local_fs
# Default-Start: S
# Default-Stop: 0 6
# X-Start-Before: networking
# X-Stop-After: networking
# Short-Description: Load and save iptables rules
# Description: This script automatically loads and saves *iptables(8)* rules.
#  Rules are found in *iptables-save(8)* format in ``$rules``.
#  Current rules are saved to ``$rules.bak`` on reload.
#  The ``$rules`` file is also copied to ``$rules.bak`` on save.
#  Default inactive policy is accept everything with no NAT nor mangling,
#  see ``iptables_reset()``.
#  This script can be made to work with ip6tables just by changing ``$iptver``
#  and the value of the Provides keyword.
#  Rule files for IPv4 and IPv6 don't clash.
### END INIT INFO
#
# This is the recommended activation for a Debian-based system with no
# dependency-based boot::
#
# 	# update-rc.d local-iptables start 39 S .
#
# You can manually set your iptables rules and then issue::
#
# 	# invoke-rc.d local-iptables save
#
# This saves your rules so that they are also available on restart.
#
#
# Ivan Vilata i Balaguer <reverse:net.selidor@ivan>, 2000-2002, 2008, 2011,
# 2012, 2015.
#
# Do what you want with this, but acknowledgement is welcome.
# Of course there is NO WARRANTY of any kind.


# Change this to ip6tables to handle IPv6 tables instead of IPv4 ones.
iptver=iptables
rules=/etc/local/network/$iptver.rules
iptables=/sbin/$iptver
iptables_save=/sbin/$iptver-save
iptables_restore=/sbin/$iptver-restore


# Import LSB logging functions.
. /lib/lsb/init-functions


# Is iptables there?
if [ ! -x $iptables ] ; then
	log_failure_msg "$0: No $iptver program: $iptables"
	exit 5
fi

# Is this the right kernel version?
kver=$(uname -r)
if ! expr "$kver" '>=' '2.3' > /dev/null; then
	log_failure_msg "$0: Incorrect kernel version $kver."
	exit 1
fi

# Are there rules?
if [ ! -f $rules -a "$1" != 'save' ] ; then
	log_failure_msg "$0: No rules file available: $rules"
	exit 6
fi


iptables_reset() {
	$iptables -w -t filter -F
	$iptables -w -t filter -X
	$iptables -w -t filter -P INPUT ACCEPT
	$iptables -w -t filter -P FORWARD ACCEPT
	$iptables -w -t filter -P OUTPUT ACCEPT

	if [ $iptver = iptables ] ; then
		$iptables -w -t nat -F
		$iptables -w -t nat -X
		$iptables -w -t nat -P PREROUTING ACCEPT
		$iptables -w -t nat -P OUTPUT ACCEPT
		$iptables -w -t nat -P POSTROUTING ACCEPT
	fi

	$iptables -w -t mangle -F
	$iptables -w -t mangle -X
	$iptables -w -t mangle -P PREROUTING ACCEPT
	$iptables -w -t mangle -P OUTPUT ACCEPT
	$iptables -w -t mangle -P INPUT ACCEPT
	$iptables -w -t mangle -P FORWARD ACCEPT
	$iptables -w -t mangle -P POSTROUTING ACCEPT
}


case "$1" in
    start)
	log_begin_msg "Loading $iptver rules"
	iptables_reset
	$iptables_restore < $rules
	log_end_msg $?
	;;
    stop)
	log_begin_msg "Clearing $iptver rules"
	iptables_reset
	log_end_msg $?
	;;
    restart)
	$0 stop
	$0 start
	;;
    reload|force-reload)
	log_begin_msg "Reloading $iptver rules"
	$iptables_save > $rules.bak
	iptables_reset
	$iptables_restore < $rules
	log_end_msg $?
	;;
    status)
	# I can't come up with a sensible way of checking whether filtering
	# has already been set up.
	exit 4
	;;
    save)
	log_begin_msg "Saving $iptver rules"
	[ -f $rules ] && cp $rules $rules.bak
	$iptables_save > $rules
	log_end_msg $?
	;;
    *)
	echo "Usage: $0 {start|stop|restart|reload|force-reload|save}" >&2
	exit 2
	;;
esac
