bastille-netfilter

#!/bin/sh
#
# /sbin/bastille-netfilter	Load/unload netfilter rulesets
#
# $Source: /cvsroot/bastille-linux/dev/working_tree/Bastille/bastille-netfilter,v $ 
# Modified by: $Author: peterw $
# $Date: 2002/01/11 02:23:14 $
# $Revision: 1.27 $
#
# Copyright (C) 1999-2001 Peter Watkins
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
#
# Thanks to David Ranch, Brad A, Don G, Jay Beale and others 
# (especially the netfilter mailing list!) for their suggestions
#
# This script is designed to be called BY a SysV-style init script.
#
# It should be run with a "start" argument
#	1) BY an rc?.d "S" script, _before_ the "network" script
#	   (normally via the "bastille-firewall" init script; 
#	    as of 2001/02/14, the only purpose of bastille-firewall
#	    is to start this script)
#	2) any time an interface is brought up or changed, e.g.
#	   establishing a PPP conection or renewing a DHCP lease
# [also copy 'bastille-firewall-reset', 'bastille-firewall-schedule' and
#  'ifup-local' to /sbin/ (in addition to the bastille-firewall init script]
#
#   Normally you Do Not _Ever_ Want to run this with a "stop" argument!
#
# Note that running this with "stop" will disable the firewall and open
# your system to all network traffic; if you make changes to these rules,
# apply them by running the script again with a "start" argument.

PATH=/bin:/sbin:/usr/bin:/usr/sbin
IPTABLES=/sbin/iptables
CONFIG=/etc/Bastille/bastille-firewall.cfg

if [ ! -x ${IPTABLES} ]; then
	echo "ERROR: \"${IPTABLES}\" does not exist!"
	if [ -x /sbin/bastille-ipchains ]; then
		# better to fall back to 'ipchains' than do nothing
		unset IPTABLES
		echo "Executing /sbin/bastille-ipchains $1"
		/sbin/bastille-ipchains $1
		exit $?
	fi
	exit 1
fi

if [ ! -f ${CONFIG} ]; then
	echo "ERROR: unable to read configuration file \"${CONFIG}\""
	exit 1
fi

# source the configuration file, which will set environment variables
. ${CONFIG}

if [ -z "${REJECT_METHOD}" ]; then
	echo "ERROR: no reject method specified (corrupt config file?) Exiting!"
	exit 1
fi


#
# Computed values
# 
# These things should be queried/computed at run time
#
# LOCAL_ADDRESSES
#
# LOCAL_ADDRESSES lists all IP addresses for this server 
#  (for the INTERNAL_SERVICES rules); if you have virtual 
#  network devices, you may want to hand-code this, e.g.
# LOCAL_ADDRESSES="127.0.0.0/8"
#
# The following makes a list of all current IP addresses
LOCAL_ADDRESSES=`ifconfig | grep "inet addr" | awk '{print $2}' | awk -F: '{print $2"/32"}' | sed s:127\.0\.0\.1/32:127.0.0.1/8: `
#
#
# DEFAULT_GW_IFACE
#
# The name of the address that is the default gateway (for SNAT)
DEFAULT_GW_IFACE=`netstat -nr | awk '$1 == "0.0.0.0" {print $8}'`
#
#
# INTERNAL_NETWORKS
#
# INTERNAL_NETWORKS lists the masked networks for the INT_INTERFACES
# e.g. INTERNAL_NETWORKS="10.0.0.0/255.0.0.0"
# The following makes a list of all current internal IP addresses _with netmasks_
for i in ${INTERNAL_IFACES} ; do
	INTERNAL_NETWORKS="${INTERNAL_NETWORKS} `ifconfig ${i} | grep "inet addr" | awk '{print $2":"$4}' | awk -F: '{print $2"/"$4}' | sed 's:127\.0\.0\.1/$:127.0.0.1/8:'`"
	if [ $i = "${DEFAULT_GW_IFACE}" ]; then
		DEFAULT_GW_IP=`ifconfig ${i} | grep "inet addr" | awk '{print $2}'`
	fi
done
#
#
# CALLED_METHOD
#
# Variable to hold $1, for use in functions (which have their own $1 vars)
CALLED_METHOD="$1"
#
#
# REJECT_METHOD
#
# Convert ipchains/DENY to netfilter/DROP
if [ "${REJECT_METHOD}" = "DENY" ]; then
	REJECT_METHOD="DROP"
fi

# counter number to help toubleshoot
RULENUM=0

#
# Shell functions
#
# include_supplemental
# source supplemental (plug-in) firewall scripts
include_supplemental()
{
	# args: $1 = nickname for the supplemental phase
	nickname="$1"
	if [ -e /etc/Bastille/firewall.d/${nickname}.sh ]; then
		cd /etc/Bastille/firewall.d && . ./${nickname}.sh
	fi
	if [ -d /etc/Bastille/firewall.d/${nickname}.d ]; then
		for s in `ls /etc/Bastille/firewall.d/${nickname}.d/*.sh`; do
			cd /etc/Bastille/firewall.d/${nickname}.d && \
			. ${s}
		done
	fi
}
#
# incr_rule_num
# Increment counter number to help toubleshoot
incr_rule_num()
{
	RULENUM=`expr $RULENUM + 1`
	return 0
}
#
# do_masq_mods
# Function to load/unload NAT kernel modules
do_masq_mods()
{
	# args: $1 = "load" or "unload"
	#
	# find the currently loaded modules
	masq_mods=`lsmod | awk '{print $1}' | grep '^ip_nat_'`
	#
	# Step 1: unload unwanted modules
	for m in ${masq_mods} ; do
		UNLOAD_THIS_MOD=Y
		for normal_mod in ${IP_MASQ_MODULES} ; do
			if [ "ip_nat_${normal_mod}" = $m -o "ip_nat_${normal_mod}_conntrack" = $m ]; then
				# this module is _supposed_ to be loaded
				UNLOAD_THIS_MOD=N
			fi
		done
		if [ "${CALLED_METHOD}" = "stop" -o -z "${IP_MASQ_NETWORK}" ]; then
			# we're either disabling the firewall or we've disabled masquerading,
			# so we should unload _all_ masq modules
			UNLOAD_THIS_MOD=Y
		fi
		if [ $UNLOAD_THIS_MOD = "Y" -a $1 = "unload" ]; then
			rmmod ${m} || echo "Error unloading ${m} module"
		fi
	done
	# Step 2: load wanted modules that are not already loaded
	if [ $1 = "load" ]; then
		for normal_mod in ${IP_MASQ_MODULES} ; do
			MOD_LOADED=N
			for m in ${masq_mods} ; do
				if [ "ip_nat_${normal_mod}" = $m ]; then
					MOD_LOADED=Y
				fi
			done
			if [ $MOD_LOADED = "N" ]; then
				insmod "ip_nat_${normal_mod}" || echo "Error loading ip_nat_${normal_mod} module"
			fi
			# try to load any _conntrack variants
			modprobe "ip_nat_${normal_mod}_conntrack" 2>/dev/null
		done
	fi
}

# See how we were called.
case "$1" in
  start|restart|reload)
	#
	# anything to do before resetting?
	include_supplemental pre-reset
	#
	# Make sure we don't have any ipchains rules!
	for c in INPUT OUTPUT FORWARD; do
		ipchains -P ${c} DENY 2>/dev/null
		ipchains -F ${c} 2>/dev/null
	done
	ipchains -X 2>/dev/null
	rmmod ipchains 2>/dev/null
	#
	# For Red Hat users, let's ensure that its firewalls are disabled
        rhtest_ipchains=`chkconfig --list ipchains 2>/dev/null | grep :on`
        rhtest_iptables=`chkconfig --list iptables 2>/dev/null | grep :on`
        bftest=`chkconfig --list bastille-firewall 2>/dev/null | grep :on`
        if [ \( -n "${rhtest_ipchains}" -o -n "${rhtest_iptables}" \) -a -n "${bftest}" ]; then
		echo
                echo "bastille-firewall conflicts with Red Hat 7.1's 'ipchains'"
                echo "and 'iptables' firewalls. We are disabling Red Hat's firewalls."
                [ -n "${rhtest_ipchains}" ] && chkconfig --level 0123456 ipchains off
                [ -n "${rhtest_iptables}" ] && chkconfig --level 0123456 iptables off
		echo
        fi
	#
	# Make sure the iptables/netfilter kernel module is loaded
	modprobe ip_tables
	#
	# Clean up the default chains
	#
	# we set defaults to DROP to minimize possible interruptions
	# if this script is re-run to reset rules
	#
	for chain in INPUT OUTPUT FORWARD ; do
		${IPTABLES} -P ${chain} DROP
		# flush rules
		${IPTABLES} -F ${chain}
	done
	#
	for chain in PREROUTING POSTROUTING ; do
		${IPTABLES} -t nat -F ${chain}
	done
	${IPTABLES} -t mangle -F PREROUTING
	# Our custom chains
	for chain in PUB_IN PUB_OUT INT_IN INT_OUT ; do
		${IPTABLES} -N ${chain} 2> /dev/null
		${IPTABLES} -F ${chain}
		${IPTABLES} -A ${chain} -j DROP
	done

	# PAROLE chain is used for TCP services
	${IPTABLES} -N PAROLE 2> /dev/null
	${IPTABLES} -F PAROLE
	if [ "${IP_ALWAYS_USE_STATE}" = "Y" ]; then
		# nmap NULL scans pass the --syn test, but this doesn't seem
		# to catch them, either
		[ "${LOG_FAILURES}" = "Y" ] && \
		${IPTABLES} -A PAROLE -p tcp --tcp-flags ALL NONE -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "PAROLE ${REJECT_METHOD} $RULENUM" ; incr_rule_num
		${IPTABLES} -A PAROLE -p tcp --tcp-flags ALL NONE -j ${REJECT_METHOD}
		${IPTABLES} -A PAROLE -p tcp -m state --state NEW --syn -j ACCEPT
		[ "${LOG_FAILURES}" = "Y" ] && \
		${IPTABLES} -A PAROLE -p tcp -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "PAROLE ${REJECT_METHOD} $RULENUM" ; incr_rule_num
		${IPTABLES} -A PAROLE -p tcp -j ${REJECT_METHOD}
	fi
	${IPTABLES} -A PAROLE -j ACCEPT

        # Run our "early" custom script if it exists
        [ -f /etc/Bastille/bastille-firewall-early.sh ] && . /etc/Bastille/bastille-firewall-early.sh

	# any new-style "early" plugins?
	include_supplemental early

	# enable stateful rules
	modprobe ip_conntrack
	modprobe ip_conntrack_ftp
	modprobe ipt_LOG

	# from the ipchains HOWTO
	if [ "${ENABLE_SRC_ADDR_VERIFY}" = "Y" ]; then
		if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
        		echo -n "Setting up IP spoofing protection..."
		        for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
            		echo 1 > $f
        		done
        		echo " done."
		else
        		echo "WARNING: errors encountered while trying to enable IP spoofing protection!"
		fi
	fi

	include_supplemental pre-local-block

	# Block any non-local attempts to get localhost addresses
	# per woody@thebunker.net's bugtraq post	
	[ "${LOG_FAILURES}" = "Y" ] && \
	${IPTABLES} -A INPUT -p tcp -d 127.0.0.0/8 ! -i lo -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "INPUT ${REJECT_METHOD} $RULENUM" ; incr_rule_num
	${IPTABLES} -A INPUT -p tcp -d 127.0.0.0/8 ! -i lo -j ${REJECT_METHOD}

	# Uncomment this to really, truly block active FTP
	# (shouldn't be necessary if ip_conntrack_ftp does its job)
	#if [ ${FORCE_PASV_FTP} = "Y" ]; then
	#	[ "${LOG_FAILURES}" = "Y" ] && \
	#	${IPTABLES} -A INPUT -p tcp --sport ftp-data -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "INPUT ${REJECT_METHOD} $RULENUM " ; incr_rule_num
	#	${IPTABLES} -A INPUT -p tcp --sport ftp-data -j ${REJECT_METHOD}
	#	[ "${LOG_FAILURES}" = "Y" ] && \
	#	${IPTABLES} -A FORWARD -p tcp --sport ftp-data -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "FORWARD ${REJECT_METHOD} $RULENUM " ; incr_rule_num
	#	${IPTABLES} -A FORWARD -p tcp --sport ftp-data -j ${REJECT_METHOD}
	#fi

	include_supplemental pre-established

	# Stateful data returns (this should include ICMP messages)
	# ...for data to this box
	${IPTABLES} -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	${IPTABLES} -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

	# Fragments
	if [ "${ALLOW_FRAGMENTS}" = "N" ]; then
		[ "${LOG_FAILURES}" = "Y" ] && \
		${IPTABLES} -A INPUT -f -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "INPUT ${REJECT_METHOD} $RULENUM " ; incr_rule_num
		${IPTABLES} -A INPUT -f -j ${REJECT_METHOD}
	fi

	include_supplemental pre-trusted
	
	# Allow all traffic from trusted interfaces
	echo -n "Allowing traffic from trusted interfaces..."
	for t_iface in ${TRUSTED_IFACES} ; do	
		# we could be pickier here, e.g. only allow traffic
		# that looks valid
		${IPTABLES} -A INPUT -i ${t_iface} -j ACCEPT
	done
	echo " done. "

	# If you have networks that route traffic to each other through this
	# server, you may want to add some forwarding rules, here, e.g.
	# one way, 192.168.*.* -> 10.*.*.* with 192.168.*.* on "eth0"
	#
	# Note: I _think_ this is right; if not, please let me know!
	#
	#${IPTABLES} -A FORWARD -i eth0 -s 192.168.0.0/16 -d 10.0.0.0/8 -j ACCEPT
	# the other direction, 10.*.*.* -> 192.168.*.* with 10.*.*.* on "eth1"
	#${IPTABLES} -A FORWARD -i eth1 -d 192.168.0.0/16 -s 10.0.0.0/8 -j ACCEPT	

	include_supplemental pre-mcast-block

	# No packets with multicast source addresses (Joshua K, RFC 1122)
	# (If you want to enable multicast, comment this out!)
	[ "${LOG_FAILURES}" = "Y" ] && \
	${IPTABLES} -A INPUT -s 224.0.0.0/4 -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "INPUT ${REJECT_METHOD} $RULENUM " ; incr_rule_num
	${IPTABLES} -A INPUT -s 224.0.0.0/4 -j ${REJECT_METHOD}

	# Forwarding

	include_supplemental pre-nat

	# IP Masquerading/forwarding
	#
	# Unload masq modules (maybe we're disabling masquerading, maybe we changed the module list)
	#do_masq_mods unload
	#
	if [ -n "${IP_MASQ_NETWORK}" ]; then
		echo -n "Loading NAT modules..."
		modprobe iptable_nat
		echo " done."
		echo -n "Setting up masquerading rules..."	
		# since we've set the default forwarding policy to
		# reject, we can enable forwarding now
		echo 1 > /proc/sys/net/ipv4/ip_forward
		# set up rules for masqueraded networks
		for net in ${IP_MASQ_NETWORK} ; do
			for pub in ${PUBLIC_IFACES} ; do
				# NAT should be one-way, deny traffic from public
				# interfaces that is addresses to masq'ed networks
				[ "${LOG_FAILURES}" = "Y" ] && \
				${IPTABLES} -A INPUT -d ${net} -i ${pub} -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "INPUT ${REJECT_METHOD} $RULENUM " ; incr_rule_num
				${IPTABLES} -A INPUT -d ${net} -i ${pub} -j ${REJECT_METHOD}
				# spoofed addreses from outside
				[ "${LOG_FAILURES}" = "Y" ] && \
				${IPTABLES} -A INPUT -s ${net} -i ${pub} -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "INPUT ${REJECT_METHOD} $RULENUM " ; incr_rule_num
				${IPTABLES} -A INPUT -s ${net} -i ${pub} -j ${REJECT_METHOD}
				if [ "${DROP_SMB_NAT_BCAST}" = "Y" ]; then
					# NetBIOS
					[ "${LOG_FAILURES}" = "Y" ] && \
					${IPTABLES} -A FORWARD -p tcp -s ${net} -o ${pub} --dport 137:139 -d 0.0.0.255/0.0.0.255 -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "FORWARD ${REJECT_METHOD} $RULENUM " ; incr_rule_num
					${IPTABLES} -A FORWARD -p tcp -s ${net} -o ${pub} --dport 137:139 -d 0.0.0.255/0.0.0.255 -j ${REJECT_METHOD}
					[ "${LOG_FAILURES}" = "Y" ] && \
					${IPTABLES} -A FORWARD -p udp -s ${net} -o ${pub} --dport 137:139 -d 0.0.0.255/0.0.0.255 -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "FORWARD ${REJECT_METHOD} $RULENUM " ; incr_rule_num
					${IPTABLES} -A FORWARD -p udp -s ${net} -o ${pub} --dport 137:139 -d 0.0.0.255/0.0.0.255 -j ${REJECT_METHOD}
				fi
				# set up a NAT rule with MASQ -- se below for SNAT
				${IPTABLES} -t nat -A POSTROUTING -s ${net} -o ${pub} -j MASQUERADE
				${IPTABLES} -A FORWARD -s ${net} -o ${pub} -j ACCEPT
			done
		done
		# If you have a statuc address for the public interface,
		# you might prefer setting upp static NAT instead of the
		# -j MASQUERADE code above:
		#${IPTABLES} -t nat -A POSTROUTING -o ${DEFAULT_GW_IFACE} -j SNAT --to ${DEFAULT_GW_IP}
		echo " done."
		echo -n "Loading masquerading modules..."	
		do_masq_mods load
		echo " done."
	fi
	
	include_supplemental pre-chain-split

	echo -n "Setting up chains for public/internal interface traffic..."	

	# Direct PUBLIC interface traffic to the proper chain
	for iface in ${PUBLIC_IFACES} ; do
		${IPTABLES} -A INPUT -i ${iface} -j PUB_IN
		${IPTABLES} -A OUTPUT -o ${iface} -j PUB_OUT
	done


	# disallow any attempts to get to internal interfaces from outside
	# not good if this is supposed to route between normal networks
	for int in ${INTERNAL_NETWORKS} ; do
		# deny traffic from public
		# interfaces that is addressed to internal networks
		[ "${LOG_FAILURES}" = "Y" ] && \
		${IPTABLES} -A PUB_IN -d ${int} -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "PUB_IN ${REJECT_METHOD} $RULENUM " ; incr_rule_num
		${IPTABLES} -A PUB_IN -d ${int} -j ${REJECT_METHOD}
		# spoofed addreses from outside
		[ "${LOG_FAILURES}" = "Y" ] && \
		${IPTABLES} -A PUB_IN -s ${int} -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "PUB_IN ${REJECT_METHOD} $RULENUM " ; incr_rule_num
		${IPTABLES} -A PUB_IN -s ${int} -j ${REJECT_METHOD}
	done
	
	# direct packets to the INTERNAL_* chains
	for iface in ${INTERNAL_IFACES} ; do
		${IPTABLES} -A INPUT -i ${iface} -j INT_IN
		${IPTABLES} -A OUTPUT -o ${iface} -j INT_OUT
	done
	echo " done. "
		
	echo -n "Setting up general rules..."	

	include_supplemental pre-dhcp

	# Allow response from DHCP servers
	for iface in ${DHCP_IFACES} ; do
		# make link so dhcpcd runs firewall when IP changes (if no such file already)
		[ ! -d /etc/dhcpc ] && mkdir /etc/dhcpc -m 0750
		if [ -x /sbin/bastille-firewall-reset -a ! -L /etc/dhcpc/dhcpcd-${iface}.exe ]; then
			ln -s /sbin/bastille-firewall-reset /etc/dhcpc/dhcpcd-${iface}.exe
		fi
	done

	include_supplemental pre-internal

	# internal interface rules
	# Allow accessses to TCP services on this system
	for serv in ${TCP_INTERNAL_SERVICES} ; do
		${IPTABLES} -A INT_IN -p tcp --dport ${serv} -j PAROLE
	done
	# UDP services
	for serv in ${UDP_INTERNAL_SERVICES} ; do
		${IPTABLES} -A INT_IN -p udp --dport ${serv} -j ACCEPT 
	done
	# ICMP
	# hopefully you don't care about hiding from internal hosts!
	${IPTABLES} -A INT_IN -p icmp -j ACCEPT 
	${IPTABLES} -A INT_OUT -p icmp -j ACCEPT 
	# ...but if you do... try this... (and see the PUB_IN rules below)
	#for type in ${ICMP_ALLOWED_TYPES} ; do
	#	${IPTABLES} -A INT_IN -p icmp --icmp-type ${type} -j ACCEPT 
	#done
        
	include_supplemental pre-input

	# input rules
	#
	# public interfaces

	# --------------------- ICMP --------------------------
	for type in ${ICMP_ALLOWED_TYPES} ; do
		${IPTABLES} -A PUB_IN -p icmp --icmp-type ${type} -j ACCEPT 
	done

	# --------------------- TCP --------------------------
	for serv in ${TCP_PUBLIC_SERVICES} ; do
		${IPTABLES} -A PUB_IN -p tcp --dport ${serv} -j PAROLE
	done
	
	# --------------------- UDP --------------------------
	for serv in ${UDP_PUBLIC_SERVICES} ; do
		${IPTABLES} -A PUB_IN -p udp --dport ${serv} -j ACCEPT 		
	done
	
	include_supplemental pre-audit

	# -------------- Public interface input auditing ---------------
	# Note that this will only audit services that are not actually available
	#
	for service in ${TCP_AUDIT_SERVICES} ; do
		${IPTABLES} -A PUB_IN -p tcp --dport ${service} -m state --state NEW,INVALID -m limit --limit 5/second --limit-burst 8 -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "audit"
	done   
	for service in ${UDP_AUDIT_SERVICES} ; do
		${IPTABLES} -A PUB_IN -p udp --dport ${service} -m state --state NEW,INVALID -m limit --limit 5/second --limit-burst 8 -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "audit"
	done   
	for type in ${ICMP_AUDIT_TYPES} ; do
		${IPTABLES} -A PUB_IN -p icmp --icmp-type ${type} -m state --state NEW,INVALID -m limit --limit 5/second --limit-burst 8 -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "audit"
	done

	# if you're disallowing ICMP, you may be trying to look 
	# invisible/disable ping, so let's just drop these attempts
	[ "${LOG_FAILURES}" = "Y" ] && \
	${IPTABLES} -A PUB_IN -p icmp -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "PUB_IN DROP $RULENUM" ; incr_rule_num
	${IPTABLES} -A PUB_IN -p icmp -j DROP

	# --------------------- catch-all --------------------------
	# Reject all other traffic (redundant if not logging)
	if [ ${LOG_FAILURES} = "Y" ]; then
		for chain in INPUT PUB_IN INT_IN ; do
			[ "${LOG_FAILURES}" = "Y" ] && \
 			${IPTABLES} -A ${chain} -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "${chain} ${REJECT_METHOD} $RULENUM " ; incr_rule_num
 			${IPTABLES} -A ${chain} -j ${REJECT_METHOD}
 		done
 	fi

	#
       	echo " done."

	include_supplemental pre-output

	echo -n "Setting up outbound rules..."	
	# 
	# Here you might really lock things down if this is a server,
	# e.g., to keep it from doing anything but connecting to
	# SMTP servers and responding to Web requests, or whatever
	# the specific requirements are. 
	#
	# Such lockdowns are recommended if the situation affords you
	# that flexibility.
	#
	# If you want to only allow the server to respond to requests
	# (and not even make DNS/dhcp/ntp queries!), then uncomment these lines:
	# # Note: if the connection table fills, you won't be able to
	# # respond to requests if you rely on "-m state" with these rules
	# ${IPTABLES} -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	# [ ${LOG_FAILURES} = "Y" ] && \
	# ${IPTABLES} -A OUTPUT -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "OUTPUT ${REJECT_METHOD} $RULENUM " ; incr_rule_num
	# ${IPTABLES} -A OUTPUT -j REJECT
	#
	# default is to enable outbound traffic
	${IPTABLES} -P OUTPUT ACCEPT

	include_supplemental pre-policy-reset
	
	# Now that all rules are set, we can change the policies
	# to the user preference safely
	[ ${REJECT_METHOD} != "DROP" ] && ${IPTABLES} -A FORWARD -j ${REJECT_METHOD}
	[ ${REJECT_METHOD} != "DROP" ] && ${IPTABLES} -A INPUT -j ${REJECT_METHOD}
	# to set default "policies" for PUB_* and INT_* chains, add a final rule
	if [ ${LOG_FAILURES} != "Y" ]; then
		# if LOG_FAILURES were set, we would have already done this
		for chain in PUB_IN INT_IN INPUT FORWARD; do
			[ "${LOG_FAILURES}" = "Y" ] && \
			${IPTABLES} -A ${chain} -j LOG --log-level ${IP_LOG_LEVEL} --log-prefix "${chain} ${REJECT_METHOD} $RULENUM " ; incr_rule_num
			${IPTABLES} -A ${chain} -j ${REJECT_METHOD}
		done
	fi
	for chain in PUB_OUT INT_OUT ; do
		${IPTABLES} -A ${chain} -j ACCEPT
	done
	# rule 1 in all of these chains is a deny rule; remove it so other rules work
	for chain in PUB_IN INT_IN PUB_OUT INT_OUT ; do
		${IPTABLES} -D ${chain} -j DROP
	done

	include_supplemental post-rule-setup
	
	echo " done."

	;;
  stop)
	include_supplemental pre-drop-rules
	echo
	echo "WARNING: reverting to default settings (dropping firewall)"
	# We should disable NAT/forwarding even if not set to restore defaults
	echo -n "disabling IP forwarding..."	
	echo 0 > /proc/sys/net/ipv4/ip_forward
	echo " done."
	echo -n "unloading masquerading modules..."	
	do_masq_mods unload
	echo " done."
	# flushing leaves the default input at ${REJECT_METHOD}
	echo -n "resetting default input rules to accept..."
	${IPTABLES} -P INPUT ACCEPT
	echo " done."
	echo -n "resetting default output rule to accept..."
	${IPTABLES} -P OUTPUT ACCEPT
	echo " done."
	#  We disabled forwarding with the /proc interface, but we
	#  reset FORWARD to ACCEPT because that;s the normal default
	echo -n "resetting default forward rule to accept..."
	${IPTABLES} -P FORWARD ACCEPT
	echo " done."
	for chain in INPUT OUTPUT FORWARD ; do
		echo -n "flushing ${chain} rules..."	
		${IPTABLES} -F ${chain}
		echo " done."
	done
	for chain in PREROUTING POSTROUTING ; do
		${IPTABLES} -t nat -F ${chain}
	done
	${IPTABLES} -t mangle -F PREROUTING
	# flush and delete the user-defined chains
	echo -n "removing user-defined chains..."
	for chain in PUB_IN PUB_OUT INT_IN INT_OUT PAROLE ; do
		${IPTABLES} -F ${chain}
		${IPTABLES} -X ${chain}
	done
	include_supplemental post-drop-rules
	echo " done."
	;;
  status)
	${IPTABLES} -L -v -n
	;;
  *)
	echo "Usage: $0 {start|restart|reload|stop|status}"
	exit 1
esac

exit 0