#!/bin/sh
#
# Startup script to implement /etc/sysconfig/iptables pre-defined rules.
#
# chkconfig: 2345 03 92
#
# description: Automates a packet filtering firewall with iptables.
#
# by bero@redhat.com, based on the ipchains script:
# Script Author:        Joshua Jensen <joshua@redhat.com>
#   -- hacked up by gafton with help from notting
# modified by Anton Altaparmakov <aia21@cam.ac.uk>:
# modified by Nils Philippsen <nils@redhat.de>
#
# config: /etc/sysconfig/iptables
#
### BEGIN INIT INFO
# Provides: iptables firewall
# Default-Start: 2 3 4 5
# Short-Description: iptables packet filtering
# Description: Automates a packet filtering firewall with iptables,
#              using /etc/sysconfig/iptables pre-defined rules.
### END INIT INFO

# Source 'em up
. /etc/init.d/functions

IPTABLES_CONFIG=/etc/sysconfig/iptables

if [ ! -x /sbin/iptables ]; then
        exit 0
fi

KERNELMAJ=`uname -r | sed                   -e 's,\..*,,'`
KERNELMIN=`uname -r | sed -e 's,[^\.]*\.,,' -e 's,\..*,,'`

if [ "$KERNELMAJ" -lt 2 ] ; then
        exit 0
fi
if [ "$KERNELMAJ" -eq 2 -a "$KERNELMIN" -lt 3 ] ; then
        exit 0
fi

if  /sbin/lsmod 2>/dev/null |grep -q ipchains ; then
        # Don't do both
        exit 0
fi

iftable() {
        if fgrep -qsx $1 /proc/net/ip_tables_names; then
                iptables -t "$@"
        fi
}

check() {
        if [ -n "$1" ]; then
                rm -f /lib/iptables
                ln -s /lib/iptables.d/${1} /lib/iptables
                iftable nat -N __T__${1##*-}__ >/dev/null 2>&1
                iftable nat -A __T__${1##*-}__ -j MASQUERADE >/dev/null 2>&1
                res=$?
                iftable nat -F __T__${1##*-}__ >/dev/null 2>&1
                iftable nat -X __T__${1##*-}__ >/dev/null 2>&1
                return $res
        else
                /sbin/modprobe ipt_MASQUERADE >/dev/null 2>&1
                kmajor=`uname -r`
                kminor=${kmajor#*.}
                kminor=${kminor%%.*}
                kmajor=${kmajor%%.*}
                for i in /lib/iptables.d/linux-$kmajor.$kminor-*; do
                        check ${i##*/} && break
                done
                /sbin/modprobe -r ipt_MASQUERADE >/dev/null 2>&1
        fi
}

start() {
        # don't do squat if we don't have the config file
        if [ -f $IPTABLES_CONFIG ]; then
            # We do _not_ need to flush/clear anything when using iptables-restore
            gprintf "Applying iptables firewall rules: \n"
            grep -v "^[[:space:]]*#" $IPTABLES_CONFIG | grep -v '^[[:space:]]*$' | /sbin/iptables-restore -c && \
                    success "Applying iptables firewall rules" || \
                    failure "Applying iptables firewall rules"

y sigue...