etc/rc.d/ipfw

   1 #!/bin/sh
   2 #
   3 # $FreeBSD$
   4 #
   5
   6 # PROVIDE: ipfw
   7 # REQUIRE: ppp
   8 # BEFORE: NETWORKING
   9 # KEYWORD: nojail
  10
  11 . /etc/rc.subr
  12 . /etc/network.subr
  13
  14 name="ipfw"
  15 rcvar="firewall_enable"
  16 start_cmd="ipfw_start"
  17 start_precmd="ipfw_precmd"
  18 stop_cmd="ipfw_stop"
  19
  20 ipfw_precmd()
  21 {
  22         if ! ${SYSCTL} net.inet.ip.fw.enable > /dev/null 2>&1; then
  23                 if ! kldload ipfw; then
  24                         warn unable to load firewall module.
  25                         return 1
  26                 fi
  27         fi
  28
  29         return 0
  30 }
  31
  32 ipfw_start()
  33 {
  34         # set the firewall rules script if none was specified
  35         [ -z "${firewall_script}" ] && firewall_script=/etc/rc.firewall
  36
  37         if [ -r "${firewall_script}" ]; then
  38                 if [ -f /etc/rc.d/natd ] ; then
  39                         /etc/rc.d/natd start
  40                 fi
  41                 . "${firewall_script}"
  42                 echo 'Firewall rules loaded.'
  43         elif [ "`ipfw list 65535`" = "65535 deny ip from any to any" ]; then
  44                 echo 'Warning: kernel has firewall functionality, but' \
  45                     ' firewall rules are not enabled.'
  46                 echo '           All ip services are disabled.'
  47         fi
  48
  49         # Firewall logging
  50         #
  51         if checkyesno firewall_logging; then
  52                 echo 'Firewall logging enabled.'
  53                 sysctl net.inet.ip.fw.verbose=1 >/dev/null
  54         fi
  55
  56         # Enable the firewall
  57         #
  58         ${SYSCTL_W} net.inet.ip.fw.enable=1
  59 }
  60
  61 ipfw_stop()
  62 {
  63         # Disable the firewall
  64         #
  65         ${SYSCTL_W} net.inet.ip.fw.enable=0
  66         if [ -f /etc/rc.d/natd ] ; then
  67                 /etc/rc.d/natd stop
  68         fi
  69 }
  70
  71 load_rc_config $name
  72 run_rc_command "$1"