iptables firewall script [example]

[pinnockio]

Hello,


As there doesn't seem to be any iptables script which saves and restores the rules on startup/ and shutdown, I've adapted an iptables script used by Gento gentoo (http://www.gentoo.org).

#!/bin/sh
#
#This is a ubuntu adapted iptables script from gentoo
#(http://www.gentoo.org) which was originally distributed
# under the terms of the GNU General Public License v2
#and was Copyrighted 1999-2004 by the Gentoo Foundation
#
#This adapted version was intended for and ad-hoc personal
#situation and as such no warranty is provided.

IPTABLES_SAVE="/etc/default/iptables-rules"
SAVE_RESTORE_OPTIONS="-c"
SAVE_ON_STOP="yes"

checkrules() {
if [ ! -f ${IPTABLES_SAVE} ]
then
echo "Not starting iptables. First create some rules then run"
echo "\"/etc/init.d/iptables save\""
return 1
fi
}

save() {
echo "Saving iptables state"
/sbin/iptables-save ${SAVE_RESTORE_OPTIONS} > ${IPTABLES_SAVE}
}

start(){
checkrules || return 1
echo "Loading iptables state and starting firewall"
echo -n "Restoring iptables ruleset"
start-stop-daemon --start --quiet --exec /sbin/iptables-restore -- ${SAVE_RESTORE_OPTIONS} < ${IPTABLES_SAVE}
}

case "$1" in
save)
save
echo "."
;;

start)
start
echo "."
;;
stop)
if [ "${SAVE_ON_STOP}" = "yes" ]; then
save || exit 1
fi
echo -n "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a

if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
start-stop-daemon --stop --quiet --pidfile /var/run/iptables.pid --exec /sbin/iptables
echo "."
;;

restart)
echo -n "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
start
echo "."
;;
*)
echo "Usage: /etc/init.d/iptables {start|stop|restart|save}" >&2
exit 1
;;
esac

exit 0

Just copy this file to /etc/init.d/iptables and add it to the boot runlevel before any other networking is started by issuing the following command:
sudo update-rc.d iptables start 37 S . stop 37 0 .

How to use?
first time:
1. add you rules to iptables ("sudo iptables -A INPUT etc...")
2. then issue "sudo /etc/init.d/iptables save
afterwards:
nothing has to be done any-more ;)

Note that if you issue "sudo /etc/init.d/iptables stop"; it saves the current rules to "/etc/default/iptables-rules" and flushes iptables (meaning setting everything to accept). So if you issue "sudo /etc/init.d/iptables stop" 2 x after eachother, this file will be empty!

I hope it helps you (and not forget this script originally came from gentoo-linux!).

Kind regards,

Maurits

[nate]

Very nice of you. I'd recommend everyone have a copy of the /etc/default/iptables-rules file somewhere else to make sure you can restore your rules if you accidentially stop it twice in a row.

If someone wanted to try and improve it further, maybe only write to iptables-save if what is being written does not match the default iptables rules? There should be a number of options for testing whether the rules are in their default state or not. This would still mean that the rules you want can get overwritten if you "stop", change the rules as a test, then "stop" again but it would eliminate overwriting the save with the default of accepting any.

[huggy77]

this is a GREAT script - thankyou!!! perfect

[nowshining]

i recommend arno-iptables-firewall :) does it automatically - can setup from a config file to enable/disable options and even set your own rules in a custom rules files already made out just input any rules there - stop and restart the firewall REALLY EASY to get going.. :)

[phil_websurfer]

Version with IPv6 support. Thank you Gentoo!
:)

The updated script:

#! /bin/sh

#This is an Ubuntu adapted iptables script from gentoo
#(http://www.gentoo.org) which was originally distributed
#under the terms of the GNU General Public License v2
#and was Copyrighted 1999-2004 by the Gentoo Foundation
#
#This adapted version was intended for and ad-hoc personal
#situation and as such no warranty is provided.

. /lib/lsb/init-functions


IPTABLES_SAVE="/etc/iptables"
IP6TABLES_SAVE="/etc/ip6tables"
SAVE_RESTORE_OPTIONS="-c"


checkrules() {
if [ ! -f ${IPTABLES_SAVE} ]
then
echo "Not starting iptables. First create some rules then run"
echo "\"/etc/init.d/iptables save\""
return 1
fi
}

save() {
/sbin/iptables-save ${SAVE_RESTORE_OPTIONS} > ${IPTABLES_SAVE}
/sbin/ip6tables-save ${SAVE_RESTORE_OPTIONS} > ${IP6TABLES_SAVE}
return $?
}

start(){
checkrules || return 1
/sbin/iptables-restore ${SAVE_RESTORE_OPTIONS} < ${IPTABLES_SAVE}
/sbin/ip6tables-restore ${SAVE_RESTORE_OPTIONS} < ${IP6TABLES_SAVE}
return $?
}


case "$1" in
save)
echo -n "Saving iptables state..."
save
if [ $? -eq 0 ] ; then
echo " ok"
else
echo " error !"
fi
;;

start)
log_begin_msg "Loading iptables state and starting firewall..."
start
log_end_msg $?
;;
stop)
log_begin_msg "Stopping firewall..."
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a

if [ $a = nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a = mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a = filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
for a in `cat /proc/net/ip6_tables_names`; do
/sbin/ip6tables -F -t $a
/sbin/ip6tables -X -t $a

if [ $a = nat ]; then
/sbin/ip6tables -t nat -P PREROUTING ACCEPT
/sbin/ip6tables -t nat -P POSTROUTING ACCEPT
/sbin/ip6tables -t nat -P OUTPUT ACCEPT
elif [ $a = mangle ]; then
/sbin/ip6tables -t mangle -P PREROUTING ACCEPT
/sbin/ip6tables -t mangle -P INPUT ACCEPT
/sbin/ip6tables -t mangle -P FORWARD ACCEPT
/sbin/ip6tables -t mangle -P OUTPUT ACCEPT
/sbin/ip6tables -t mangle -P POSTROUTING ACCEPT
elif [ $a = filter ]; then
/sbin/ip6tables -t filter -P INPUT ACCEPT
/sbin/ip6tables -t filter -P FORWARD ACCEPT
/sbin/ip6tables -t filter -P OUTPUT ACCEPT
fi
done
log_end_msg 0
;;

restart)
log_begin_msg "Restarting firewall..."
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
for a in `cat /proc/net/ip6_tables_names`; do
/sbin/ip6tables -F -t $a
/sbin/ip6tables -X -t $a
done;
start
log_end_msg $?
;;

*)
echo "Usage: /etc/init.d/iptables {start|stop|restart|save}" >&2
exit 1
;;
esac

exit 0
iptables configuration sample from Fedora

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:FW-INPUT-RULE - [0:0]
-A INPUT -j FW-INPUT-RULE
-A FW-INPUT-RULE -i lo -j ACCEPT
-A FW-INPUT-RULE -p icmp --icmp-type any -j ACCEPT
#-A FW-INPUT-RULE -p 50 -j ACCEPT
#-A FW-INPUT-RULE -p 51 -j ACCEPT
#-A FW-INPUT-RULE -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
#-A FW-INPUT-RULE -p udp -m udp --dport 631 -j ACCEPT
#-A FW-INPUT-RULE -p tcp -m tcp --dport 631 -j ACCEPT
-A FW-INPUT-RULE -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FW-INPUT-RULE -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A FW-INPUT-RULE -m state --state NEW -m tcp -p tcp --dport 8010 -j ACCEPT
-A FW-INPUT-RULE -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
ip6tables configuration sample from Fedora

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:FW-INPUT-RULE - [0:0]
-A INPUT -j FW-INPUT-RULE
-A FW-INPUT-RULE -i lo -j ACCEPT
-A FW-INPUT-RULE -p icmpv6 -j ACCEPT
#-A FW-INPUT-RULE -p 50 -j ACCEPT
#-A FW-INPUT-RULE -p 51 -j ACCEPT
#-A FW-INPUT-RULE -p udp --dport 5353 -d ff02::fb -j ACCEPT
#-A FW-INPUT-RULE -p udp -m udp --dport 631 -j ACCEPT
#-A FW-INPUT-RULE -p tcp -m tcp --dport 631 -j ACCEPT
-A FW-INPUT-RULE -p udp -m udp --dport 32768:61000 -j ACCEPT
-A FW-INPUT-RULE -p tcp -m tcp --dport 32768:61000 -j ACCEPT
-A FW-INPUT-RULE -m tcp -p tcp --dport 22 -j ACCEPT
-A FW-INPUT-RULE -m tcp -p tcp --dport 8010 -j ACCEPT
-A FW-INPUT-RULE -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -j REJECT --reject-with icmp6-port-unreachable
COMMIT
To make it run in the startup. It must be run before vmware init script (90):
update-rc.d iptables start 91 2 3 5 .

[misterhaan]

thanks, this is the 3rd or so thing i tried and finally something worked!