etc/rc.d/ipfw

   1 #!/bin/sh
   2 #
   3 # $FreeBSD$
   4 #
   5
   6 # PROVIDE: ipfw
   7 # REQUIRE: ppp
   8 # KEYWORD: nojailvnet
   9
  10 . /etc/rc.subr
  11 . /etc/network.subr
  12
  13 name="ipfw"
  14 desc="Firewall, traffic shaper, packet scheduler, in-kernel NAT"
  15 rcvar="firewall_enable"
  16 start_cmd="ipfw_start"
  17 start_precmd="ipfw_prestart"
  18 start_postcmd="ipfw_poststart"
  19 stop_cmd="ipfw_stop"
  20 required_modules="ipfw"
  21
  22 set_rcvar_obsolete ipv6_firewall_enable
  23
  24 ipfw_prestart()
  25 {
  26         if checkyesno dummynet_enable; then
  27                 required_modules="$required_modules dummynet"
  28         fi
  29         if checkyesno natd_enable; then
  30                 required_modules="$required_modules ipdivert"
  31         fi
  32         if checkyesno firewall_nat_enable; then
  33                 required_modules="$required_modules ipfw_nat"
  34         fi
  35 }
  36
  37 ipfw_start()
  38 {
  39         local   _firewall_type
  40
  41         _firewall_type=$1
  42
  43         # set the firewall rules script if none was specified
  44         [ -z "${firewall_script}" ] && firewall_script=/etc/rc.firewall
  45
  46         if [ -r "${firewall_script}" ]; then
  47                 /bin/sh "${firewall_script}" "${_firewall_type}"
  48                 echo 'Firewall rules loaded.'
  49         elif [ "`ipfw list 65535`" = "65535 deny ip from any to any" ]; then
  50                 echo 'Warning: kernel has firewall functionality, but' \
  51                     ' firewall rules are not enabled.'
  52                 echo '           All ip services are disabled.'
  53         fi
  54
  55         # Firewall logging
  56         #
  57         if checkyesno firewall_logging; then
  58                 echo 'Firewall logging enabled.'
  59                 ${SYSCTL} net.inet.ip.fw.verbose=1 >/dev/null
  60         fi
  61         if checkyesno firewall_logif; then
  62                 ifconfig ipfw0 create
  63                 echo 'Firewall logging pseudo-interface (ipfw0) created.'
  64         fi
  65 }
  66
  67 ipfw_poststart()
  68 {
  69         local   _coscript
  70
  71         # Start firewall coscripts
  72         #
  73         for _coscript in ${firewall_coscripts} ; do
  74                 if [ -f "${_coscript}" ]; then
  75                         ${_coscript} quietstart
  76                 fi
  77         done
  78
  79         # Enable the firewall
  80         #
  81         if ! ${SYSCTL} net.inet.ip.fw.enable=1 >/dev/null 2>&1; then
  82                 warn "failed to enable IPv4 firewall"
  83         fi
  84         if afexists inet6; then
  85                 if ! ${SYSCTL} net.inet6.ip6.fw.enable=1 >/dev/null 2>&1
  86                 then
  87                         warn "failed to enable IPv6 firewall"
  88                 fi
  89         fi
  90 }
  91
  92 ipfw_stop()
  93 {
  94         local   _coscript
  95
  96         # Disable the firewall
  97         #
  98         ${SYSCTL} net.inet.ip.fw.enable=0 >/dev/null
  99         if afexists inet6; then
 100                 ${SYSCTL} net.inet6.ip6.fw.enable=0 >/dev/null
 101         fi
 102
 103         # Stop firewall coscripts
 104         #
 105         for _coscript in `reverse_list ${firewall_coscripts}` ; do
 106                 if [ -f "${_coscript}" ]; then
 107                         ${_coscript} quietstop
 108                 fi
 109         done
 110 }
 111
 112 load_rc_config $name
 113 firewall_coscripts="/etc/rc.d/natd ${firewall_coscripts}"
 114
 115 run_rc_command $*