summaryrefslogtreecommitdiffstats
path: root/fieryfilter.init
blob: 4aab0eb103cb68ea3618dff1a01ffa4096348fc2 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
#!/bin/bash

reset() {
    iptables -D INPUT -j ffsys_in
    iptables -D OUTPUT -j ffsys_out
    iptables -D FORWARD -j ffsys_for 

    iptables -F ffsys_in
    iptables -X ffsys_in
    iptables -F ffsys_out
    iptables -X ffsys_out
    iptables -F ffsys_for
    iptables -X ffsys_for
    iptables -F ffsys
    iptables -X ffsys
}

create() {
    iptables -N ffsys
    iptables -A ffsys -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
    iptables -A ffsys -m state --state ESTABLISHED -j ACCEPT
    iptables -A ffsys -m state --state RELATED -j ACCEPT
    iptables -A ffsys -m state --state NEW -j RETURN
    iptables -A ffsys -j DROP

    iptables -N ffsys_in 
    iptables -A ffsys_in -p icmp --icmp-type destination-unreachable -j ACCEPT
    iptables -A ffsys_in -j ffsys

    iptables -N ffsys_out
    iptables -A ffsys_out -p icmp --icmp-type destination-unreachable -j ACCEPT
    iptables -A ffsys_out -j ffsys

    grep nameserver /etc/resolv.conf | sed s/nameserver// | {
        while read ip ; do
            iptables -A ffsys_out -p udp --dport 53 -d $ip -j ACCEPT
        done
    }

    iptables -N ffsys_for
    iptables -A ffsys_for -j ffsys
}

activate() {
    iptables -A INPUT -j ffsys_in
    iptables -A OUTPUT -j ffsys_out
    iptables -A FORWARD -j ffsys_for
}

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
DAEMON=/usr/local/sbin/fieryfilterd
NAME=fieryfilterd
DESC="FieryFilter daemon"

test -x $DAEMON || exit 0

case "$1" in
  start)
	echo -n "Starting $DESC: $NAME"
    if pidof $DAEMON > /dev/null ; then
        echo " - already running."
    else
        modprobe iptable_filter
        modprobe ip_queue
        modprobe ip_conntrack_ftp

        reset 2> /dev/null
        create
        activate

        rm -f /tmp/fieryfilter

        ( $DAEMON 2>&1 ) | logger -p daemon.info -t fieryfilterd &
        disown
        echo "."
    fi
	;;
  stop)
	echo -n "Stopping $DESC: $NAME"
    if pidof $DAEMON > /dev/null ; then
        killall -INT fieryfilterd
        reset 2> /dev/null
        echo "."
    else
        echo " - not running."
    fi
	;;
  restart|force-reload)
    $0 stop
    sleep 2
    $1 start
	;;
  *)
	N=/etc/init.d/$NAME
	echo "Usage: $N {start|stop|restart|force-reload}" >&2
	exit 1
	;;
esac

exit 0