rc.d firewall for iptables with IPv6

firewall.sh

### BEGIN INIT INFO
# Provides:          firewall
# Required-Start:    $local_fs $network
# Required-Stop:     $local_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
### END INIT INFO

#!/bin/sh

if [ `id -u` -ne 0 ]; then
	echo "You are not root"
	exit 1
fi

LOG_DROP=false

IP4TABLES=/sbin/iptables
IP6TABLES=/sbin/ip6tables
IPv4=true
IPv6=true

BANIP=/usr/local/bin/banip
FAIL2BAN=/etc/init.d/fail2ban

fw4() {
	$IPv4 && $IP4TABLES $*
}

fw6() {
	$IPV6 && $IP6TABLES $*
}

fw() {
	fw4 $*
	fw6 $*
}

start() {
	# Init FILTER table
	fw -t filter -F
	fw -t filter -X

	fw -t filter -P INPUT   DROP
	fw -t filter -P OUTPUT  DROP
	fw -t filter -P FORWARD DROP

	# Init NAT table
	fw4 -t nat -F
	fw4 -t nat -X
	fw4 -t nat -P PREROUTING  ACCEPT
	fw4 -t nat -P POSTROUTING ACCEPT
	fw4 -t nat -P OUTPUT      ACCEPT

	# Init MANGLE table
	fw -t mangle -F
	fw -t mangle -X
	fw -t mangle -P PREROUTING  ACCEPT
	fw -t mangle -P INPUT       ACCEPT
	fw -t mangle -P OUTPUT      ACCEPT
	fw -t mangle -P FORWARD     ACCEPT
	fw -t mangle -P POSTROUTING ACCEPT

	# Allow loop connections
	fw -A OUTPUT -o lo -j ACCEPT
	fw -A INPUT  -i lo -j ACCEPT

	# Allow ICMP
	fw4 -A INPUT  -p icmp   -j ACCEPT
	fw4 -A OUTPUT -p icmp   -j ACCEPT
	# Allow ICMPv6
	fw6 -A OUTPUT -p icmpv6 -j ACCEPT
	fw6 -A INPUT  -p icmpv6 -j ACCEPT

	# Allow RELATED connections
	fw -A OUTPUT  -m state --state NEW,RELATED,ESTABLISHED  -j ACCEPT
	fw -A INPUT   -m state --state RELATED,ESTABLISHED      -j ACCEPT
	fw -A FORWARD  -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

	# SSH 
	fw -A INPUT -p tcp --dport ssh -j ACCEPT

	# Web
	fw -A INPUT -p tcp --dport http  -j ACCEPT
	fw -A INPUT -p tcp --dport https -j ACCEPT

	# Log DROP 
	if ${LOG_DROP}; then
		fw -A INPUT   -j LOG --log-prefix "INPUT "
		fw -A OUTPUT  -j LOG --log-prefix "OUTPUT "
		fw -A FORWARD -j LOG --log-prefix "FORWARD "
	fi

	[ -e "$BANIP" ] && "$BANIP" install
}

stop() {
	# Initialisation de la table FILTER
	fw -t filter -F
	fw -t filter -X
	fw -t filter -P INPUT   ACCEPT
	fw -t filter -P OUTPUT  ACCEPT
	fw -t filter -P FORWARD ACCEPT

	# Initialisation de la table NAT
	fw4 -t nat -F
	fw4 -t nat -X
	fw4 -t nat -P PREROUTING  ACCEPT
	fw4 -t nat -P POSTROUTING ACCEPT
	fw4 -t nat -P OUTPUT      ACCEPT

	# Initialisation de la table MANGLE
	fw -t mangle -F
	fw -t mangle -X
	fw -t mangle -P PREROUTING  ACCEPT
	fw -t mangle -P INPUT       ACCEPT
	fw -t mangle -P OUTPUT      ACCEPT
	fw -t mangle -P FORWARD     ACCEPT
	fw -t mangle -P POSTROUTING ACCEPT
}

case "$1" in
start)
	start
	exit 0
	;;
stop)
	stop
	exit 0
	;;
restart)
	stop
	start
	[ -e "$FAIL2BAN" ] && "$FAIL2BAN" reload
	exit 0
	;;
open)
	fw -A INPUT -p tcp --dport $2 -j ACCEPT
	;;
*)
	echo "Usage: $0 {start|stop|restart}"
	exit 1
	;;
esac