#!/bin/sh
# rc.netfilter:  start/stop/restart the Linux firewall (netfilter)
#
#
# Customize the activate_rules() function according to your needs and restart the service 
# with command "rc.netfilter restart"


# Every allowed traffic should be specified, default policy is "DROP every protocol" but 

# you can change it at your own risks

#



#########################################################



# HERE YOU MAY DEFINE YOUR POLICY IF NEEDED ( DROP | ACCEPT )

POLICY='DROP'



# HERE YOU MAY DEFINE YOUR RULES AS IPTABLES COMMANDS

activate_rules() {



  iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT # ssh

  iptables -t filter -A OUTPUT -j ACCEPT



}



#########################################################



netfilter_start() {

  # If netfilter is not running, start it:



  /sbin/modprobe ip_tables

  /sbin/modprobe iptable_filter

  /sbin/modprobe iptable_nat

  /sbin/modprobe ip_conntrack

  /sbin/modprobe ipt_state

  /sbin/modprobe ip_conntrack_ftp



  for TABLE in filter nat mangle; do

    iptables -t $TABLE -F 1>&2 2>/dev/null

    iptables -t $TABLE -X 1>&2 2>/dev/null

  done

  for CHAIN in INPUT OUTPUT FORWARD; do

    iptables -t filter -P $CHAIN $POLICY 1>&2 2>/dev/null

  done

  iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

  iptables -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

  iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

  iptables -t filter -A INPUT -i lo -j ACCEPT

  iptables -t filter -A OUTPUT -o lo -j ACCEPT

  

  activate_rules



}



netfilter_stop() {



  for TABLE in filter nat mangle; do

    iptables -t $TABLE -F 1>&2 2>/dev/null

    iptables -t $TABLE -X 1>&2 2>/dev/null

  done

  for CHAIN in INPUT OUTPUT FORWARD; do

    iptables -t filter -P $CHAIN ACCEPT 1>&2 2>/dev/null

  done



}



netfilter_restart() {

  netfilter_start

}



case "$1" in

'start')

  netfilter_start

  ;;

'stop')

  netfilter_stop

  ;;

'restart')

  netfilter_restart

  ;;

*)

  echo "usage $0 start|stop|restart"

esac



# Copyright Jean-Philippe Guillemin. This program is free software; you can redistribute 

# it and/or modify it under the terms of the GNU General Public License as published by

# the Free Software Foundation; either version 2 of the License, or (at your option) 

# any later version. Please take a look at http://www.gnu.org/copyleft/gpl.htm