Ignore:
Timestamp:
Jul 12, 2006, 12:40:18 AM (19 years ago)
Author:
Thorsten Glaser <tg@…>
Branches:
freewrt_1_0, freewrt_2_0
Children:
4486a95
Parents:
115d022
Message:
  • change the SYSV init system to add a target "autostart"
  • on system startup, call autostart instead of start
  • on autostart, check /etc/rc.conf for whether the service is enabled and act appropriately; fall through into start target
  • move some pre-startup checks into the start target
  • some whitespace cleanup, when it makes much sense (XXX when I get the person who wrote these scripts...)
  • optimise dropbear a little

ok and approved wbx@

git-svn-id: ​svn://www.freewrt.org/trunk/freewrt@191 afb5a338-a214-0410-bd46-81f09a774fd1

File:
1 edited

Legend:

Unmodified
Added
Removed

  • package/iptables/files/firewall.init

    r115d022 r583d755  
    22
    33. /etc/rc.conf
    4 
    5 if [ X"${firewall}" == X"NO" ]; then
    6         exit 0
    7 fi
    8 
    94. /etc/functions.sh
    105
    … …  
    138
    149case $1 in
    15         start)
    16                 iptables -N input_rule
    17                 iptables -N output_rule
    18                 iptables -N forwarding_rule
     10autostart)
     11        test x"$firewall" = x"NO" && exit 0
     12        # FALLTHROUGH
     13start)
     14        iptables -N input_rule
     15        iptables -N output_rule
     16        iptables -N forwarding_rule
    1917
    20                 iptables -t nat -N prerouting_rule
    21                 iptables -t nat -N postrouting_rule
     18        iptables -t nat -N prerouting_rule
     19        iptables -t nat -N postrouting_rule
    2220
    23                 ### INPUT
    24                 ###  (connections with the router as destination)
     21        ### INPUT
     22        ###  (connections with the router as destination)
    2523
    26                 # base case
    27                 iptables -P INPUT DROP
    28                 iptables -A INPUT -m state --state INVALID -j DROP
    29                 iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    30                 iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j  DROP
     24        # base case
     25        iptables -P INPUT DROP
     26        iptables -A INPUT -m state --state INVALID -j DROP
     27        iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
     28        iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j  DROP
    3129
    32                 #
    33                 # insert accept rule or to jump to new accept-check table here
    34                 #
    35                 iptables -A INPUT -j input_rule
     30        #
     31        # insert accept rule or to jump to new accept-check table here
     32        #
     33        iptables -A INPUT -j input_rule
    3634
    37                 # allow
    38                 iptables -A INPUT ${WAN:+\! -i $WAN} -j ACCEPT  # allow from all interfaces except for wan
    39                 iptables -A INPUT -p icmp       -j ACCEPT       # allow ICMP
    40                 iptables -A INPUT -p gre        -j ACCEPT       # allow GRE
    41                 # allow ssh from remote
    42                 iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 22 -j ACCEPT
    43                 iptables        -A input_rule      -i $WAN -p tcp --dport 22 -j ACCEPT
     35        # allow
     36        iptables -A INPUT ${WAN:+\! -i $WAN} -j ACCEPT  # allow from all interfaces except for wan
     37        iptables -A INPUT -p icmp       -j ACCEPT       # allow ICMP
     38        iptables -A INPUT -p gre        -j ACCEPT       # allow GRE
     39        # allow ssh from remote
     40        iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 22 -j ACCEPT
     41        iptables        -A input_rule      -i $WAN -p tcp --dport 22 -j ACCEPT
    4442
    45                 # reject (what to do with anything not allowed earlier)
    46                 iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
    47                 iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
     43        # reject (what to do with anything not allowed earlier)
     44        iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
     45        iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
    4846
    49                 ### OUTPUT
    50                 # (connections with the router as source)
     47        ### OUTPUT
     48        # (connections with the router as source)
    5149
    52                 # base case
    53                 iptables -P OUTPUT DROP
    54                 iptables -A OUTPUT -m state --state INVALID -j DROP
    55                 iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
     50        # base case
     51        iptables -P OUTPUT DROP
     52        iptables -A OUTPUT -m state --state INVALID -j DROP
     53        iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    5654
    57                 #
    58                 # insert accept rule or to jump to new accept-check table here
    59                 #
    60                 iptables -A OUTPUT -j output_rule
     55        #
     56        # insert accept rule or to jump to new accept-check table here
     57        #
     58        iptables -A OUTPUT -j output_rule
    6159
    62                 # allow
    63                 iptables -A OUTPUT -j ACCEPT            #allow everything out
     60        # allow
     61        iptables -A OUTPUT -j ACCEPT            #allow everything out
    6462
    65                 # reject (what to do with anything not allowed earlier)
    66                 iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
    67                 iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
     63        # reject (what to do with anything not allowed earlier)
     64        iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
     65        iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
    6866
    69                 ### FORWARDING
    70                 ### (connections routed through the router)
     67        ### FORWARDING
     68        ### (connections routed through the router)
    7169
    72                 # base case
    73                 iptables -P FORWARD DROP
    74                 iptables -A FORWARD -m state --state INVALID -j DROP
    75                 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
    76                 iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     70        # base case
     71        iptables -P FORWARD DROP
     72        iptables -A FORWARD -m state --state INVALID -j DROP
     73        iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
     74        iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    7775
    78                 #
    79                 # insert accept rule or to jump to new accept-check table here
    80                 #
    81                 iptables -A FORWARD -j forwarding_rule
     76        #
     77        # insert accept rule or to jump to new accept-check table here
     78        #
     79        iptables -A FORWARD -j forwarding_rule
    8280
    83                 # allow
    84                 iptables -A FORWARD -i br0 -o br0 -j ACCEPT
    85                 [ -z "$WAN" ] || iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT
     81        # allow
     82        iptables -A FORWARD -i br0 -o br0 -j ACCEPT
     83        [ -z "$WAN" ] || iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT
    8684
    87                 # reject (what to do with anything not allowed earlier)
    88                 # uses the default -P DROP
     85        # reject (what to do with anything not allowed earlier)
     86        # uses the default -P DROP
    8987
    90                 ### MASQ
    91                 iptables -t nat -A PREROUTING -j prerouting_rule
    92                 iptables -t nat -A POSTROUTING -j postrouting_rule
    93                 [ -z "$WAN" ] || iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
    94                 ;;
    95         stop)
    96                 ## CLEAR TABLES
    97                 for T in filter nat; do
    98                         iptables -t $T -F
    99                         iptables -t $T -X
    100                 done
    101                 ;;
    102         restart)
    103                 $0 stop
    104                 $0 start
    105                 ;;
    106         *)
    107                 echo "Usage: $0 {start | stop | restart}"
    108                 ;;
     88        ### MASQ
     89        iptables -t nat -A PREROUTING -j prerouting_rule
     90        iptables -t nat -A POSTROUTING -j postrouting_rule
     91        [ -z "$WAN" ] || iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
     92        ;;
     93stop)
     94        ## CLEAR TABLES
     95        for T in filter nat; do
     96                iptables -t $T -F
     97                iptables -t $T -X
     98        done
     99        ;;
     100restart)
     101        $0 stop
     102        $0 start
     103        ;;
     104*)
     105        echo "Usage: $0 {start | stop | restart}"
     106        ;;
    109107esac
    110108exit 0
Note: See TracChangeset for help on using the changeset viewer.