root:# service firewall stop
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............
Stopping Firewall.......................Stopping Firewall............

/bin/bash -vx /etc/rc.d/rc.firewall stop 2>&1 | tee /tmp/debug.log

#!/bin/sh
## /etc/rc.d/rc.firewall
## Setup the firewall system before any network services is up.
## VASM's vfirewall modifies this script !!!
##
## This script will find and start firewall in the following order
##   - user specified FIREWALL_SCRIPT variable
##   - GuardDog (/etc/rc.firewall and /etc/rc.guidedog)
##   - gShield (/etc/firewall/gShield.rc)
##   - Firewall-Jay (/etc/firewall-jay/fw-jay)
##   - the default VL firewall
##
## The default VL firewall is suitable for a workstation that allows:
##  - all outputs from this machine
##  - some inputs to this machine (domain, ssh, http)
##  - optional ipmasquerading
##
## To enable ipmasquerading, specify the GREEN_NET.
## This machine should work as a gateway with the following configuration 
##
## {RED}-----[gateway]------{GREEN}
##
## RED   = The Internet
## GREEN = Your Intranet 
##
## This firewall uses network address based rules.
## Therefore it is independent to interface, and easier to debug.
## Sufficient for home use, serving some casual clients.
## Not for a serious office !!!
## You cannot sue me for whatever reason regarding this script :P.
##
## GNU GPL (c) Eko M. Budi, 2004
##         (c) Vector Linux, 2004


## If you have another script, tell it here
## For example, /etc/rc.firewall
FIREWALL_SCRIPT=""

## This is the default VL firewall settings
## The Network you want to protect.
## If specified, forwarding will be allowed.
## It the network is internal, masquerading will be turned on
## Empty means no forwarding/masquerading.
GREEN_NET=""
#GREEN_NET="192.168.0.0/255.255.255.0"
#GREEN_NET="172.16.0.0/255.255.0.0"
#GREEN_NET="10.0.0.0/255.0.0.0"

## The open ports of THIS host.
## see /etc/services for ports definition
## list the ports, space separated. ALL means all ports.
PORT_IN="ALL"
#PORT_IN="domain ssh http https ftp ftp-data"
ICMP_IN="ALL"
#ICMP_IN="0 3 8 11"

## The traffic that can come out from this machine.
## You may protect it if you are curious there is trojan in your machine.
## list the ports, space separated. ALL allows everything.
PORT_OUT="ALL"
#PORT_OUT="domain http https pop3 pop3s imap ssh ftp ftp-data irc"

## The traffic that can pass from GREEN the RED network (internet).
## list the ports, space separated. ALL allows everything.
PORT_FORWARD="ALL"
#PORT_FORWARD="domain http https pop3 pop3s imap ssh ftp ftp-data irc"
ICMP_FORWARD="ALL"
#ICMP_FORWARD="3 8 11"

########################################################################
# Do the business ...
. /etc/rc.d/functions

## If this configuration file exist, read it
if [ -r /etc/sysconfig/config/firewall.conf ]; then
   . /etc/sysconfig/config/firewall.conf 
fi

########################################################################
# here we go now
IPT="/usr/sbin/iptables"
MODPROBE="/sbin/modprobe"

## load modules
$MODPROBE ip_tables
$MODPROBE iptable_filter
$MODPROBE iptable_nat
$MODPROBE ip_nat_ftp  
$MODPROBE ip_nat_irc 
$MODPROBE ip_conntrack  
$MODPROBE ip_conntrack_ftp  
$MODPROBE ip_conntrack_irc  

# Check if a net is an internal network
is_internal()
{
   IPADDR=$(echo $1 | cut -f 1 -d /)

   NET=$(ipmask 255.255.0.0 $IPADDR | cut -f 2 -d ' ')
   [ "$NET" = "192.168.0.0" ] && return

   NET=$(ipmask 255.240.0.0 $IPADDR | cut -f 2 -d ' ')
   [ "$NET" = "172.16.0.0" ] && return

   NET=$(ipmask 255.0.0.0 $IPADDR | cut -f 2 -d ' ')
   [ "$NET" = "10.0.0.0" ] && return

   false
}

# STANDARD RULES
firewall_basic()
{
  # Enable IP spoofing protection, turn on Source Address Verification
  for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
     echo 1 > $f
  done

  # Disable ICMP Redirect Acceptance
  for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
     echo 0 > $f
  done

  # Enabling ping of death protection
  # $IPT -A INPUT -p icmp --icmp-type echo-request -m limit ! --limit 1/s -j DROP

  # Enabling Syn flood protection
  #$IPT -A INPUT -p tcp --syn -m limit ! --limit 1/s -j DROP
 
  # Enabling Furtive port scanner protection
  #$IPT -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit ! --limit 1/s -j DROP
  
}

firewall_flush()
{
  $IPT -F 
  $IPT -F -t nat 
  $IPT -F -t mangle 
  $IPT -X
}

## This is really open everything, except IP forwarding
firewall_clear()
{
  ## Disable IP forwarding
  echo "0" > /proc/sys/net/ipv4/ip_forward

  ## Accept all for default
  $IPT -P INPUT ACCEPT
  $IPT -P FORWARD ACCEPT
  $IPT -P OUTPUT ACCEPT

  firewall_flush
}

# Rules for allowing traffic from the GREEN to the RED network
firewall_forward()
{
  ## if no green net, turn off forwarding
  if [ -z "$GREEN_NET" ]; then
     echo "0" > /proc/sys/net/ipv4/ip_forward 
     $IPT -P FORWARD DROP
     return 0   
  fi
  
  ## Turn ON masquerade automatically
  ## People said that we should use SNAT for static IP
  ## But masquerade will do no harm
  if is_internal $GREEN_NET; then
    $IPT -t nat -A POSTROUTING -s $GREEN_NET -d ! $GREEN_NET -j MASQUERADE
  fi

  ## if everything is ALL, just turn ON the FORWARD
  if [ "$PORT_FORWARD" = "ALL" ] && [ "$ICMP_FORWARD" = "ALL" ]; then
    $IPT -P FORWARD ACCEPT
    echo "1" > /proc/sys/net/ipv4/ip_forward
    return 0
  fi
  
  ## ok, complicated settings are needed
  $IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
  $IPT -A FORWARD -f -j ACCEPT

  if [ "$PORT_FORWARD" != "ALL" ]; then
     for PORT in $PORT_FORWARD; do
       $IPT -A FORWARD -s $GREEN_NET -p udp --dport $PORT -j ACCEPT
       $IPT -A FORWARD -s $GREEN_NET -p tcp --dport $PORT -j ACCEPT
     done
  else
     $IPT -A FORWARD -s $GREEN_NET -p tcp -j ACCEPT
     $IPT -A FORWARD -s $GREEN_NET -p udp -j ACCEPT
  fi
  
  if [ "$ICMP_FORWARD" != "ALL" ]; then
     for TYPE in $ICMP_FORWARD; do 
         $IPT -A FORWARD -s $GREEN_NET -p icmp --icmp-type $TYPE -j ACCEPT
     done
  else
     $IPT -A FORWARD -s $GREEN_NET -p icmp -j ACCEPT
  fi     
  $IPT -P FORWARD DROP
  echo "1" > /proc/sys/net/ipv4/ip_forward
}


# Rules for accepting input to this gateway
firewall_input()
{
  ## if ALL, open the default. Save rules and faster !
  if [ "$PORT_IN" = "ALL" ] && [ "$ICMP_IN" = "ALL" ]; then
     $IPT -P INPUT ACCEPT
     return 0
  fi
  
  ## Set a secure input
  $IPT -A INPUT -d 127.0.0.0/8 -j ACCEPT
  $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  $IPT -A INPUT -f -j ACCEPT
  
  ## Allow some ports
  if [ "$PORT_IN" != "ALL" ]; then
     for PORT in $PORT_IN ; do 
       $IPT -A INPUT -p udp --dport $PORT -j ACCEPT
       $IPT -A INPUT -p tcp --dport $PORT -j ACCEPT
     done
  else
     $IPT -A INPUT -p udp -j ACCEPT
     $IPT -A INPUT -p tcp -j ACCEPT
  fi

  ## Allow ICMPs
  if [ "$ICMP_IN" != "ALL" ]; then
     for TYPE in $ICMP_IN ; do 
       $IPT -A INPUT -p icmp --icmp-type $TYPE -j ACCEPT
     done
  else
     $IPT -A INPUT -p icmp -j ACCEPT
  fi

  ## Drop everything else
  $IPT -P INPUT DROP
}

# Rules for allowing OUTPUT traffic from this machine
firewall_output()
{
  ## if ALL, open the default. Save rules and faster !
  if [ "$PORT_OUT" = "ALL" ]; then
     $IPT -P OUTPUT ACCEPT
     return 0
  fi
  
  ## Hmmm ... the admin does not believe his own computer
  ## But let's the internal output
  $IPT -A OUTPUT -d 127.0.0.0/8 -j ACCEPT 

  ## allow all ICMPs from this host (is it secure enough ?)
  $IPT -A OUTPUT -p icmp -j ACCEPT

  ## allow some ports
  for PORT in $PORT_OUT; do
     $IPT -A OUTPUT -p udp --dport $PORT -j ACCEPT
     $IPT -A OUTPUT -p tcp --dport $PORT -j ACCEPT
  done

  ## Drop everything else by default
  $IPT -P OUTPUT DROP
}

###################################################################
## Main routines
firewall_start() {

  ## launch the specified one
  if [ "$FIREWALL_SCRIPT" ] && [ -x $FIREWALL_SCRIPT ]; then
     echo "Starting firewall $FIREWALL_SCRIPT ..."
     $FIREWALL_SCRIPT start
     return $?
  fi

  ## if exist, start the new default firewall service  
  if [ ! x$service_firewall = x ]; then
   if [ -x $service_firewall ]; then
      if [ ! -x $rc_firewall ]; then
        chmod +x $rc_firewall
      fi
      echo "Starting firewall service ..."
      service firewall start
      return $?
   fi
  fi

  ## if exist, start guarddog/guidedog firewall instead
  ## don't start guidedog if there is no guarddog
  if [ -x /etc/rc.firewall ]; then
      if [ -x /etc/rc.guidedog ]; then
          echo "Starting guarddog and guidedog ..."
          /etc/rc.firewall start && /etc/rc.guidedog start
      else
          echo "Starting guarddog ..."
          /etc/rc.firewall start
      fi
      return $?
  fi

  ## This is GShield
  if [ -x /etc/firewall/gShield.rc ]; then
      echo "Starting gshield firewall ..."
      /etc/firewall/gShield.rc --start
      return $?
  fi

  ## This is firewall-jay
  if [ -x /etc/firewall-jay/fw-jay ] && [ -f /etc/firewall-jay/firewall.config ]; then
      echo "Starting firewall-jay ..."
      /etc/firewall-jay/fw-jay start
      return $?
  fi

  ## the last contender ...default VASM firewall
  echo "Starting default firewall ..."
  firewall_basic
  firewall_flush
  firewall_input
  firewall_output
  firewall_forward
  return 0
}

firewall_stop()
{
  firewall_clear
  return 0
}

case "$1" in
  start)
    firewall_start
    ;;
  stop)
    echo "Stopping firewall ..."
    ## if exist, stop the new default firewall service  
    if [ -x $service_firewall ]; then
      # service firewall stop
      echo "No, we are not going to stop firewall"
    else
      firewall_stop
    fi
    ;;
  restart)
    echo "Restarting firewall ..."
    ## if exist, restart the new default firewall service  
    if [ -x $service_firewall ]; then
      # service firewall restart
      echo "No, we are not going to stop firewall"
    else
      ## Restarting should not stop the firewall
      ## Since stopping opens the ports for a moment
      firewall_start
    fi
    ;;
  reload)
    echo "Reloading firewall ..."
    ## if exist, restart the new default firewall service  
    if [ -x $service_firewall ]; then
      # service firewall restart
      echo "No, we are not going to stop firewall"
    else
      firewall_start
    fi
    ;;  
  status)
    $IPT -nL
    echo
    $IPT -t nat -nL
    ;;
  *)  
    echo "Usage $0 {start|stop|restart|reload|status}"
esac