src/initscripts/system/firewall

   1 #!/bin/sh
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 . /etc/sysconfig/rc
  23 . ${rc_functions}
  24
  25 eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
  26 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  27 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
  28 IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
  29 if [ -z $IFACE ]; then
  30         IFACE="red0"
  31 fi
  32
  33 if [ -f /var/ipfire/red/device ]; then
  34         DEVICE=`/bin/cat /var/ipfire/red/device 2> /dev/null | /usr/bin/tr -d '\012'`
  35 fi
  36
  37 NAT_MASK="0x0f000000"
  38
  39 IPS_REPEAT_MARK="0x80000000"
  40 IPS_REPEAT_MASK="0x80000000"
  41 IPS_BYPASS_MARK="0x40000000"
  42 IPS_BYPASS_MASK="0x40000000"
  43
  44 IPSET_DB_DIR="/var/lib/location/ipset"
  45
  46 function iptables() {
  47         /sbin/iptables --wait "$@"
  48 }
  49
  50 iptables_init() {
  51         # Flush all rules and delete all custom chains
  52         iptables -F
  53         iptables -t nat -F
  54         iptables -t mangle -F
  55         iptables -t raw -F
  56         iptables -X
  57         iptables -t nat -X
  58         iptables -t mangle -X
  59         iptables -t raw -X
  60
  61         # Set up policies
  62         iptables -P INPUT DROP
  63         iptables -P FORWARD DROP
  64         iptables -P OUTPUT ACCEPT
  65
  66         # Enable TRACE logging to syslog
  67         modprobe nf_log_ipv4
  68         sysctl -q -w net.netfilter.nf_log.2=nf_log_ipv4
  69
  70         # IPS Bypass Chain which stores the BYPASS bit in connection tracking
  71         iptables -N IPSBYPASS
  72         iptables -A IPSBYPASS -j CONNMARK --save-mark --mask "$(( ~IPS_REPEAT_MASK & 0xffffffff ))"
  73
  74         # Jump into bypass chain when the BYPASS bit is set
  75         for chain in INPUT FORWARD OUTPUT; do
  76                 iptables -A "${chain}" -m mark \
  77                         --mark "$(( IPS_REPEAT_MARK | IPS_BYPASS_MARK ))/$(( IPS_REPEAT_MASK | IPS_BYPASS_MASK ))" -j IPSBYPASS
  78         done
  79
  80         # Empty LOG_DROP and LOG_REJECT chains
  81         iptables -N LOG_DROP
  82         iptables -A LOG_DROP   -m limit --limit 10/second -j LOG
  83         iptables -A LOG_DROP   -j DROP
  84         iptables -N LOG_REJECT
  85         iptables -A LOG_REJECT -m limit --limit 10/second -j LOG
  86         iptables -A LOG_REJECT -j REJECT
  87
  88         # This chain will log, then DROPs packets with certain bad combinations
  89         # of flags might indicate a port-scan attempt (xmas, null, etc.)
  90         iptables -N PSCAN
  91         if [ "$DROPPORTSCAN" == "on" ]; then
  92                 iptables -A PSCAN -p tcp  -m limit --limit 10/second -j LOG --log-prefix "DROP_TCP Scan "  -m comment --comment "DROP_TCP PScan"
  93                 iptables -A PSCAN -p udp  -m limit --limit 10/second -j LOG --log-prefix "DROP_UDP Scan "  -m comment --comment "DROP_UDP PScan"
  94                 iptables -A PSCAN -p icmp -m limit --limit 10/second -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan"
  95                 iptables -A PSCAN -f      -m limit --limit 10/second -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan"
  96         fi
  97         iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan"
  98
  99         # New tcp packets without SYN set - could well be an obscure type of port scan
 100         # that's not covered above, may just be a broken Windows machine
 101         iptables -N NEWNOTSYN
 102         if [ "$DROPNEWNOTSYN" == "on" ]; then
 103                 iptables -A NEWNOTSYN  -m limit --limit 10/second -j LOG  --log-prefix "DROP_NEWNOTSYN "
 104         fi
 105         iptables -A NEWNOTSYN  -j DROP -m comment --comment "DROP_NEWNOTSYN"
 106
 107         # Log and subsequently drop spoofed packets or "martians", arriving from sources
 108         # on interfaces where we don't expect them
 109         iptables -N SPOOFED_MARTIAN
 110         if [ "$DROPSPOOFEDMARTIAN" == "on" ]; then
 111                 iptables -A SPOOFED_MARTIAN  -m limit --limit 10/second -j LOG  --log-prefix "DROP_SPOOFED_MARTIAN "
 112         fi
 113         iptables -A SPOOFED_MARTIAN -j DROP -m comment --comment "DROP_SPOOFED_MARTIAN"
 114
 115         # Chain to contain all the rules relating to bad TCP flags
 116         iptables -N BADTCP
 117
 118         # Don't check loopback
 119         iptables -A BADTCP -i lo -j RETURN
 120
 121         # Disallow packets frequently used by port-scanners
 122         # NMAP FIN/URG/PSH (XMAS scan)
 123         iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH -j PSCAN
 124         # SYN/RST/ACK/FIN/URG
 125         iptables -A BADTCP -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j PSCAN
 126         # ALL/ALL
 127         iptables -A BADTCP -p tcp --tcp-flags ALL ALL -j PSCAN
 128         # FIN Stealth
 129         iptables -A BADTCP -p tcp --tcp-flags ALL FIN -j PSCAN
 130         # SYN/RST (also catches xmas variants that set SYN+RST+...)
 131         iptables -A BADTCP -p tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
 132         # SYN/FIN (QueSO or nmap OS probe)
 133         iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j PSCAN
 134         # Null
 135         iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN
 136         # NEW TCP without SYN
 137         iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN
 138
 139         iptables -A INPUT   -p tcp -j BADTCP
 140         iptables -A FORWARD -p tcp -j BADTCP
 141
 142         # Connection tracking chains
 143         iptables -N CTINVALID
 144         if [ "$LOGDROPCTINVALID" == "on" ]; then
 145                 iptables -A CTINVALID  -m limit --limit 10/second -j LOG  --log-prefix "DROP_CTINVALID "
 146         fi
 147         iptables -A CTINVALID  -j DROP -m comment --comment "DROP_CTINVALID"
 148
 149         iptables -N CONNTRACK
 150         iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT
 151         iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID
 152         iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT
 153
 154         # Restore any connection marks
 155         iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
 156
 157         # Fix for braindead ISPs
 158         iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
 159
 160         # CUSTOM chains, can be used by the users themselves
 161         iptables -N CUSTOMINPUT
 162         iptables -A INPUT -j CUSTOMINPUT
 163         iptables -N CUSTOMFORWARD
 164         iptables -A FORWARD -j CUSTOMFORWARD
 165         iptables -N CUSTOMOUTPUT
 166         iptables -A OUTPUT -j CUSTOMOUTPUT
 167         iptables -t nat -N CUSTOMPREROUTING
 168         iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
 169         iptables -t nat -N CUSTOMPOSTROUTING
 170         iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
 171
 172         # IPS (Guardian) chains
 173         iptables -N GUARDIAN
 174         iptables -A INPUT -j GUARDIAN
 175         iptables -A FORWARD -j GUARDIAN
 176
 177         # Block non-established IPsec networks
 178         iptables -N IPSECBLOCK
 179         iptables -A FORWARD -m policy --dir out --pol none -j IPSECBLOCK
 180         iptables -A OUTPUT  -m policy --dir out --pol none -j IPSECBLOCK
 181
 182         # Block OpenVPN transfer networks
 183         iptables -N OVPNBLOCK
 184         iptables -A INPUT   -i tun+ -j OVPNBLOCK
 185         iptables -A FORWARD -i tun+ -j OVPNBLOCK
 186         iptables -A FORWARD -o tun+ -j OVPNBLOCK
 187
 188         # IPS (Suricata) chains
 189         iptables -N IPS_INPUT
 190         iptables -N IPS_FORWARD
 191         iptables -N IPS_OUTPUT
 192
 193         for chain in INPUT FORWARD OUTPUT; do
 194                 iptables -A "${chain}" -m mark --mark "0x0/$(( IPS_REPEAT_MASK | IPS_BYPASS_MASK ))" -j "IPS_${chain}"
 195         done
 196
 197         # OpenVPN transfer network translation
 198         iptables -t nat -N OVPNNAT
 199         iptables -t nat -A POSTROUTING -j OVPNNAT
 200
 201         # IPTV chains for IGMPPROXY
 202         iptables -N IPTVINPUT
 203         iptables -A INPUT -j IPTVINPUT
 204         iptables -N IPTVFORWARD
 205         iptables -A FORWARD -j IPTVFORWARD
 206
 207         # Allow to ping the firewall.
 208         iptables -N ICMPINPUT
 209         iptables -A INPUT -j ICMPINPUT
 210         iptables -A ICMPINPUT -p icmp --icmp-type 8 -j ACCEPT
 211
 212         # Accept everything on loopback
 213         iptables -N LOOPBACK
 214         iptables -A LOOPBACK -i lo -j ACCEPT
 215         iptables -A LOOPBACK -o lo -j ACCEPT
 216
 217         # Filter all packets with loopback addresses on non-loopback interfaces (spoofed)
 218         iptables -A LOOPBACK -s 127.0.0.0/8 -j SPOOFED_MARTIAN
 219         iptables -A LOOPBACK -d 127.0.0.0/8 -j SPOOFED_MARTIAN
 220
 221         for i in INPUT FORWARD OUTPUT; do
 222                 iptables -A ${i} -j LOOPBACK
 223         done
 224
 225         # Captive portal
 226         iptables -N CAPTIVE_PORTAL
 227         iptables -N CAPTIVE_PORTAL_CLIENTS
 228         for i in INPUT FORWARD; do
 229                 iptables -A ${i} -j CAPTIVE_PORTAL
 230         done
 231
 232         # Accept everything connected
 233         for i in INPUT FORWARD OUTPUT; do
 234                 iptables -A ${i} -j CONNTRACK
 235         done
 236
 237         # Allow DHCP
 238         iptables -N DHCPINPUT
 239         iptables -A DHCPINPUT -p udp --sport 68 --dport 67 -j ACCEPT
 240         iptables -A DHCPINPUT -p tcp --sport 68 --dport 67 -j ACCEPT
 241
 242         iptables -N DHCPOUTPUT
 243         iptables -A DHCPOUTPUT -p udp --sport 67 --dport 68 -j ACCEPT
 244         iptables -A DHCPOUTPUT -p tcp --sport 67 --dport 68 -j ACCEPT
 245
 246         # Allow DHCP on GREEN
 247         iptables -N DHCPGREENINPUT
 248         iptables -N DHCPGREENOUTPUT
 249         if [ -n "${GREEN_DEV}" ]; then
 250                 iptables -A INPUT  -i "${GREEN_DEV}" -j DHCPGREENINPUT
 251                 iptables -A OUTPUT -o "${GREEN_DEV}" -j DHCPGREENOUTPUT
 252         fi
 253
 254         # Allow DHCP on BLUE to be turned on/off
 255         iptables -N DHCPBLUEINPUT
 256         iptables -N DHCPBLUEOUTPUT
 257         if [ -n "${BLUE_DEV}" ]; then
 258                 iptables -A INPUT  -i "${BLUE_DEV}" -j DHCPBLUEINPUT
 259                 iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT
 260         fi
 261
 262         # Chains for networks known as being hostile, posing a technical threat to our users
 263         # (i. e. listed at Spamhaus DROP et al.)
 264         iptables -N HOSTILE
 265         iptables -A INPUT -i $IFACE -j HOSTILE
 266         iptables -A FORWARD -i $IFACE -j HOSTILE
 267         iptables -A FORWARD -o $IFACE -j HOSTILE
 268         iptables -A OUTPUT -o $IFACE -j HOSTILE
 269
 270         # Tor (inbound)
 271         iptables -N TOR_INPUT
 272         iptables -A INPUT -j TOR_INPUT
 273
 274         # Location Block
 275         iptables -N LOCATIONBLOCK
 276         iptables -A INPUT -j LOCATIONBLOCK
 277         iptables -A FORWARD -j LOCATIONBLOCK
 278
 279         # trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
 280         iptables -N IPSECINPUT
 281         iptables -N IPSECFORWARD
 282         iptables -N IPSECOUTPUT
 283         iptables -A INPUT -j IPSECINPUT
 284         iptables -A FORWARD -j IPSECFORWARD
 285         iptables -A OUTPUT -j IPSECOUTPUT
 286         iptables -t nat -N IPSECNAT
 287         iptables -t nat -A POSTROUTING -j IPSECNAT
 288
 289         # localhost and ethernet.
 290         # Always allow accessing the web GUI from GREEN.
 291         iptables -N GUIINPUT
 292         iptables -A INPUT -j GUIINPUT
 293         if [ -n "${GREEN_DEV}" ]; then
 294                 iptables -A GUIINPUT -i "${GREEN_DEV}" -p tcp --dport 444 -j ACCEPT
 295         fi
 296
 297         # WIRELESS chains
 298         iptables -N WIRELESSINPUT
 299         iptables -A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT
 300         iptables -N WIRELESSFORWARD
 301         iptables -A FORWARD -m conntrack --ctstate NEW -j WIRELESSFORWARD
 302
 303         # OpenVPN
 304         iptables -N OVPNINPUT
 305         iptables -A INPUT -j OVPNINPUT
 306
 307         # Tor (outbound)
 308         iptables -N TOR_OUTPUT
 309         iptables -A OUTPUT -j TOR_OUTPUT
 310
 311         # Jump into the actual firewall ruleset.
 312         iptables -N INPUTFW
 313         iptables -A INPUT -j INPUTFW
 314
 315         iptables -N OUTGOINGFW
 316         iptables -A OUTPUT -j OUTGOINGFW
 317
 318         iptables -N FORWARDFW
 319         iptables -A FORWARD -j FORWARDFW
 320
 321         # SNAT rules
 322         iptables -t nat -N NAT_SOURCE
 323         iptables -t nat -A POSTROUTING -j NAT_SOURCE
 324
 325         # Captive Portal
 326         iptables -t nat -N CAPTIVE_PORTAL
 327         iptables -t nat -A PREROUTING -j CAPTIVE_PORTAL
 328
 329         # Custom prerouting chains (for transparent proxy)
 330         iptables -t nat -N SQUID
 331         iptables -t nat -A PREROUTING -j SQUID
 332
 333         # DNAT rules
 334         iptables -t nat -N NAT_DESTINATION
 335         iptables -t nat -A PREROUTING -j NAT_DESTINATION
 336         iptables -t nat -A OUTPUT -j NAT_DESTINATION
 337
 338         iptables -t mangle -N NAT_DESTINATION
 339         iptables -t mangle -A PREROUTING -j NAT_DESTINATION
 340
 341         iptables -t nat -N NAT_DESTINATION_FIX
 342         iptables -t nat -A POSTROUTING -j NAT_DESTINATION_FIX
 343
 344         if [ -n "${GREEN_ADDRESS}" ]; then
 345                 iptables -t nat -A NAT_DESTINATION_FIX \
 346                         -m mark --mark "0x01000000/${NAT_MASK}" -j SNAT --to-source "${GREEN_ADDRESS}"
 347         fi
 348
 349         if [ -n "${BLUE_ADDRESS}" ]; then
 350                 iptables -t nat -A NAT_DESTINATION_FIX \
 351                         -m mark --mark "0x02000000/${NAT_MASK}" -j SNAT --to-source "${BLUE_ADDRESS}"
 352         fi
 353
 354         if [ -n "${ORANGE_ADDRESS}" ]; then
 355                 iptables -t nat -A NAT_DESTINATION_FIX \
 356                         -m mark --mark "0x04000000/${NAT_MASK}" -j SNAT --to-source "${ORANGE_ADDRESS}"
 357         fi
 358
 359         # RED chain, used for the red interface
 360         iptables -N REDINPUT
 361         iptables -A INPUT -j REDINPUT
 362         iptables -N REDFORWARD
 363         iptables -A FORWARD -j REDFORWARD
 364         iptables -t nat -N REDNAT
 365         iptables -t nat -A POSTROUTING -j REDNAT
 366
 367         # Populate IPsec chains
 368         /usr/lib/firewall/ipsec-policy
 369
 370         # Apply OpenVPN firewall rules
 371         /usr/local/bin/openvpnctrl --firewall-rules
 372
 373         # run wirelessctrl
 374         /usr/local/bin/wirelessctrl
 375
 376         # run captivectrl
 377         /usr/local/bin/captivectrl
 378
 379         # POLICY CHAIN
 380         iptables -N POLICYIN
 381         iptables -A INPUT -j POLICYIN
 382         iptables -N POLICYFWD
 383         iptables -A FORWARD -j POLICYFWD
 384         iptables -N POLICYOUT
 385         iptables -A OUTPUT -j POLICYOUT
 386
 387         # Initialize firewall policies.
 388         /usr/sbin/firewall-policy
 389
 390         # Install firewall rules for the red interface.
 391         iptables_red_up
 392
 393         # If red has not been brought up yet, we will
 394         # add the blocking rules for MASQUERADE
 395         if [ ! -e "/var/ipfire/red/active" ]; then
 396                 iptables_red_down
 397         fi
 398 }
 399
 400 iptables_red_up() {
 401         iptables -F REDINPUT
 402         iptables -F REDFORWARD
 403         iptables -t nat -F REDNAT
 404
 405         # Prohibit spoofing our own IP address on RED
 406         if [ -f /var/ipfire/red/active ]; then
 407                 REDIP="$( cat /var/ipfire/red/local-ipaddress )";
 408
 409                 if [ "$IFACE" != "" ]; then
 410                         iptables -A REDINPUT -s $REDIP -i $IFACE -j SPOOFED_MARTIAN
 411                 elif [ "$DEVICE" != "" ]; then
 412                         iptables -A REDINPUT -s $REDIP -i $DEVICE -j SPOOFED_MARTIAN
 413                 fi
 414         fi
 415
 416         # PPPoE / PPTP Device
 417         if [ "$IFACE" != "" ]; then
 418                 # PPPoE / PPTP
 419                 if [ "$DEVICE" != "" ]; then
 420                         iptables -A REDINPUT -i $DEVICE -j ACCEPT
 421                 fi
 422                 if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then
 423                         if [ "$RED_DEV" != "" ]; then
 424                                 iptables -A REDINPUT -i $RED_DEV -j ACCEPT
 425                         fi
 426                 fi
 427         fi
 428
 429         # PPTP over DHCP
 430         if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then
 431                 iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
 432                 iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
 433         fi
 434
 435         if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then
 436                 # DHCP
 437                 if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then
 438                         iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 439                         iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 440                 fi
 441                 if [ "$METHOD" == "DHCP"  -a "$PROTOCOL" == "RFC1483" ]; then
 442                         iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 443                         iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 444                 fi
 445
 446                 # Outgoing masquerading (don't masqerade IPsec)
 447                 iptables -t nat -A REDNAT -m policy --pol ipsec --dir=out -o "${IFACE}" -j RETURN
 448
 449                 if [ "${IFACE}" = "${GREEN_DEV}" ]; then
 450                         iptables -t nat -A REDNAT -i "${GREEN_DEV}" -o "${IFACE}" -j RETURN
 451                 fi
 452
 453                 local NO_MASQ_NETWORKS
 454
 455                 if [ "${MASQUERADE_GREEN}" = "off" ]; then
 456                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${GREEN_NETADDRESS}/${GREEN_NETMASK}"
 457                 fi
 458
 459                 if [ "${MASQUERADE_BLUE}" = "off" ]; then
 460                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${BLUE_NETADDRESS}/${BLUE_NETMASK}"
 461                 fi
 462
 463                 if [ "${MASQUERADE_ORANGE}" = "off" ]; then
 464                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${ORANGE_NETADDRESS}/${ORANGE_NETMASK}"
 465                 fi
 466
 467                 local network
 468                 for network in ${NO_MASQ_NETWORKS}; do
 469                         iptables -t nat -A REDNAT -s "${network}" -o "${IFACE}" -j RETURN
 470                 done
 471
 472                 # Masquerade everything else
 473                 iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
 474         fi
 475
 476         # Reload all rules.
 477         /usr/local/bin/firewallctrl
 478 }
 479
 480 iptables_red_down() {
 481         # Prohibit packets to reach the masquerading rule
 482         # while the WAN interface is down - this is required to
 483         # circumvent udp related NAT issues
 484         # http://forum.ipfire.org/index.php?topic=11127.0
 485         if [ -n "${IFACE}" ]; then
 486                 iptables -F REDFORWARD
 487                 iptables -A REDFORWARD -o "${IFACE}" -j DROP
 488         fi
 489
 490         # Reload all rules.
 491         /usr/local/bin/firewallctrl
 492 }
 493
 494 # See how we were called.
 495 case "$1" in
 496   start)
 497         boot_mesg "Setting up firewall"
 498         iptables_init
 499         evaluate_retval
 500         ;;
 501   reload|up)
 502         boot_mesg "Reloading firewall"
 503         iptables_red_up
 504         evaluate_retval
 505         ;;
 506   down)
 507         boot_mesg "Disabling firewall access to RED"
 508         iptables_red_down
 509         evaluate_retval
 510         ;;
 511   restart)
 512         $0 start
 513         ;;
 514   *)
 515         echo "Usage: $0 {start|reload|restart}"
 516         exit 1
 517         ;;
 518 esac
 519
 520 exit 0