3 # $NetBSD: ipfilter,v 1.10 2001/02/28 17:03:50 lukem Exp $
8 # REQUIRE: root mountcritlocal
17 stop_precmd="test -f ${ipfilter_rules} -o -f ${ipv6_ipfilter_rules}"
19 start_precmd="ipfilter_prestart"
20 start_cmd="ipfilter_start"
21 stop_cmd="ipfilter_stop"
22 reload_precmd="$stop_precmd"
23 reload_cmd="ipfilter_reload"
24 resync_precmd="$stop_precmd"
25 resync_cmd="ipfilter_resync"
26 status_precmd="$stop_precmd"
27 status_cmd="ipfilter_status"
28 extra_commands="reload resync status"
32 if ! kldstat -v | grep "IP Filter" > /dev/null 2>&1; then
41 # load ipfilter kernel module if needed
42 if ! ipfilter_loaded; then
44 info 'IP-filter module loaded.'
46 err 1 'IP-filter module failed to load.'
50 # check for ipfilter rules
51 if [ ! -r "${ipfilter_rules}" ] && [ ! -r "${ipv6_ipfilter_rules}" ]
53 warn 'IP-filter: NO IPF RULES'
61 echo "Enabling ipfilter."
62 if [ `sysctl -n net.inet.ipf.fr_running` -eq 0 ]; then
63 ${ipfilter_program:-/sbin/ipf} -E
65 ${ipfilter_program:-/sbin/ipf} -Fa
66 if [ -r "${ipfilter_rules}" ]; then
67 ${ipfilter_program:-/sbin/ipf} \
68 -f "${ipfilter_rules}" ${ipfilter_flags}
70 ${ipfilter_program:-/sbin/ipf} -6 -Fa
71 if [ -r "${ipv6_ipfilter_rules}" ]; then
72 ${ipfilter_program:-/sbin/ipf} -6 \
73 -f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
79 # XXX - The ipf -D command is not effective for 'lkm's
80 if [ `sysctl -n net.inet.ipf.fr_running` -eq 1 ]; then
81 echo "Saving firewall state tables"
82 ${ipfs_program:-/sbin/ipfs} -W ${ipfs_flags}
83 echo "Disabling ipfilter."
84 ${ipfilter_program:-/sbin/ipf} -D
90 echo "Reloading ipfilter rules."
92 ${ipfilter_program:-/sbin/ipf} -I -Fa
93 if [ -r "${ipfilter_rules}" ]; then
94 ${ipfilter_program:-/sbin/ipf} -I \
95 -f "${ipfilter_rules}" ${ipfilter_flags}
97 ${ipfilter_program:-/sbin/ipf} -I -6 -Fa
98 if [ -r "${ipv6_ipfilter_rules}" ]; then
99 ${ipfilter_program:-/sbin/ipf} -I -6 \
100 -f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
102 ${ipfilter_program:-/sbin/ipf} -s
108 # Don't resync if ipfilter is not loaded
109 if ! ipfilter_loaded; then
112 ${ipfilter_program:-/sbin/ipf} -y ${ipfilter_flags}
117 ${ipfilter_program:-/sbin/ipf} -V