#!/bin/sh
#
# chkconfig: 2345 11 89
#
# description: Loads the rc.firewall-2.4 ruleset.
#
# processname: firewall-2.4
# pidfile: /var/run/firewall.pid
# config: /etc/rc.d/rc.firewall
# probe: true

# ----------------------------------------------------------------------------
# v02/09/02
#
# Part of the copyrighted and trademarked TrinityOS document.
# http://www.ecst.csuchico.edu/~dranch
#
# Written and Maintained by David A. Ranch
# dranch@trinnet.net
#
# Updates
# -------
#
# ----------------------------------------------------------------------------


# Source function library.
. /etc/rc.d/init.d/functions

# Check that networking is up.

# This line no longer work with bash2
#[ ${NETWORKING} = "no" ] &#38;&#38; exit 0
# This should be OK. 
[ "XXXX${NETWORKING}" = "XXXXno" ] &#38;&#38; exit 0

[ -x /sbin/ifconfig ] || exit 0

# The location of various iptables and other shell programs
#
#   If your Linux distribution came with a copy of iptables, most
#   likely it is located in /sbin.  If you manually compiled
#   iptables, the default location is in /usr/local/sbin
#
# ** Please use the "whereis iptables" command to figure out
# ** where your copy is and change the path below to reflect
# ** your setup
#
IPTABLES=/usr/local/sbin/iptables


# See how we were called.
case "$1" in
  start)
    /etc/rc.d/rc.firewall
    ;;

  stop)
    echo -e "\nFlushing firewall and setting default policies to ACCEPT\n"
    $IPTABLES -P INPUT DROP
    $IPTABLES -F INPUT
    $IPTABLES -P INPUT ACCEPT
    $IPTABLES -P OUTPUT DROP
    $IPTABLES -F OUTPUT
    $IPTABLES -P OUTPUT ACCEPT
    $IPTABLES -P FORWARD DROP
    $IPTABLES -F FORWARD
    $IPTABLES -P FORWARD ACCEPT
    $IPTABLES -F -t nat

    # Delete all User-specified chains
    $IPTABLES -X
    #
    # Reset all IPTABLES counters
    $IPTABLES -Z
    ;;

  restart)
        $0 stop
        $0 start
        ;;

  status)
        $IPTABLES -L
        ;;

  mlist)
    cat /proc/net/ip_conntrack
    ;;
  
  add-dnat)
    if [ -z "$2" -o -z "$3" -o -z "$4" -o -z "$5" ]; then
       echo "$0: Invalid arguemnt"
       exit 1
    fi
    EXTIF=`/sbin/route -n | grep ^"0.0.0.0" | awk '{print $NF}'`
    INTIF=eth0
    $IPTABLES -t nat -A PREROUTING -i $EXTIF -p $2 --dport $3 -j DNAT --to $4:$5
    $IPTABLES -I FORWARD -i $EXTIF -o $INTIF -p $2 -d $4 --dport $5 -j ACCEPT
    ;;

  del-dnat)
    if [ -z "$2" -o -z "$3" -o -z "$4" -o -z "$5" ]; then
       echo "$0: Invalid arguemnt"
       exit 1
    fi
    EXTIF=`/sbin/route -n | grep ^"0.0.0.0" | awk '{print $NF}'`
    INTIF=eth0
    $IPTABLES -t nat -D PREROUTING -i $EXTIF -p $2 --dport $3 -j DNAT --to $4:$5
    $IPTABLES -D FORWARD -i $EXTIF -o $INTIF -p $2 -d $4 --dport $5 -j ACCEPT
    ;;

  *)
        echo "Usage: firewall-2.4 {start|stop|status|mlist|add-dnat|del-dnat}"
        exit 1
esac



echo -e "\nDone.\n"
