summaryrefslogtreecommitdiffstats
path: root/roles/common/files/etc/network/if-pre-up.d/iptables
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2013-10-30 21:06:51 +0100
committerGuilhem Moulin <guilhem@fripost.org>2015-06-07 02:50:28 +0200
commitfbde929fce7405f018fc66bb5796bf0a16292913 (patch)
tree25be7bfa8547295694be7658d41cdc9e33423b2a /roles/common/files/etc/network/if-pre-up.d/iptables
parente54c9bc8d96bdef1c9a5634f5cff3b66f38f487e (diff)
Configure v4 and v6 iptable rulesets.
Diffstat (limited to 'roles/common/files/etc/network/if-pre-up.d/iptables')
-rwxr-xr-xroles/common/files/etc/network/if-pre-up.d/iptables38
1 files changed, 38 insertions, 0 deletions
diff --git a/roles/common/files/etc/network/if-pre-up.d/iptables b/roles/common/files/etc/network/if-pre-up.d/iptables
new file mode 100755
index 0000000..6a50948
--- /dev/null
+++ b/roles/common/files/etc/network/if-pre-up.d/iptables
@@ -0,0 +1,38 @@
+#!/bin/bash
+#
+# A pre-up hook to auto-(re)load the iptables rulesets whenever the
+# network is brought up. If the action fails, an alert message is passed
+# to syslogd.
+#
+# Copyright 2013 Guilhem Moulin <guilhem@fripost.org>
+#
+# Licensed under the GNU GPL version 3 or higher.
+#
+
+set -uo pipefail
+PATH=/usr/sbin:/usr/bin:/sbin:/bin
+
+# NOTE: syslog starts after networking during the boot process, messages
+# won't be logged at boot time.
+log="/usr/bin/logger -st firewall"
+
+# Ignore the loopback interface; run the strip for ifup only.
+[ "$IFACE" != lo -a "$MODE" = start ] || exit 0
+
+# We support only IPv4 and IPv6.
+[ "$ADDRFAM" = inet -o "$ADDRFAM" = inet6 ] || exit 0
+
+$log -p syslog.info -- "Loading $ADDRFAM firewall on interface $IFACE."
+
+case "$ADDRFAM" in
+ inet) iptr=/sbin/iptables-restore; rules=rules.v4;;
+ inet6)iptr=/sbin/ip6tables-restore; rules=rules.v6;;
+esac
+rules="/etc/iptables/$rules"
+
+$iptr < $rules 2>&1 | $log -p syslog.err
+rv=$?
+
+[ $rv -gt 0 ] && $log -p syslog.alert \
+ "WARN: Failed to load iptables rulesets; the machine may be unprotected!"
+exit $rv