Firewall watchdog - Reset and flush firewall if watchdog file is not updated while testing rules.

fw-failsafe

#!/bin/bash
# reset.fw - Reset firewall
# set x to 0 - No reset
# set x to 1 - Reset firewall
# ---------------------------------------------------------------------------------------------------------------
# Added support for IPV6 Firewall
# ---------------------------------------------------------------------------------------------------------------
# Written by Vivek Gite <vivek@nixcraft.com>
# ---------------------------------------------------------------------------------------------------------------
# Modified by Dave Carlton <davec@polymicro.net> to use watchdog file
# https://gist.github.com/tgunr/5139101
#
# You can copy / paste / redistribute this script under GPL version 2.0 or above
# =============================================================

# set this to where ever you want to watch
WATCHDOG=/root/watchdog
WAIT_TIME=120 # wait 2 minutes

# On the remote machine startup watchdog task like so
# while true; do ssh root@remote.com 'date +%s > /root/watchdog'; sleep 30; done
# This will update time on file being watched, if you stop updating it, then
# WAIT_TIME later this script will reset firewall
#
# Put this script into a cron job and fire it off once a minute

# set to true if it is CentOS / RHEL / Fedora box
RHEL=true
 
### no need to edit below  ###
IPT=/sbin/iptables
IPT6=/sbin/ip6tables
 
if [ -e $WATCHDOG ] ; then
	WD_MOD_TIME=$(date -r $WATCHDOG +%s)
	let RESET_TIME=$[$WD_MOD_TIME + $WAIT_TIME]
	let NOW=$(date +%s)
	if test $NOW -gt $RESET_TIME ; then
		if [ "$RHEL" == "true" ];
		then
			if ! [ -e $WATCHDOG.reset ] ; then
				echo "Resetting firewall"
				# reset firewall using redhat script
				/etc/init.d/iptables stop
				/etc/init.d/ip6tables stop
				touch $WATCHDOG.reset
			fi
		else
			# for all other Linux distro use following rules to reset firewall
			### reset ipv4 iptales ###
			$IPT -F
			$IPT -X
			$IPT -Z
			for table in $(</proc/net/ip_tables_names)
			do
				$IPT -t $table -F
				$IPT -t $table -X
				$IPT -t $table -Z
			done
			$IPT -P INPUT ACCEPT
			$IPT -P OUTPUT ACCEPT
			$IPT -P FORWARD ACCEPT
			### reset ipv6 iptales ###
			$IPT6 -F
			$IPT6 -X
			$IPT6 -Z
			for table in $(</proc/net/ip6_tables_names)
			do
				$IPT6 -t $table -F
				$IPT6 -t $table -X
				$IPT6 -t $table -Z
			done
			$IPT6 -P INPUT ACCEPT
			$IPT6 -P OUTPUT ACCEPT
			$IPT6 -P FORWARD ACCEPT
		fi
	else
		echo "Checking firewall failsafe"
    	:
	fi
fi