Initial Commit

source-files/iptables.esv

@@ -0,0 +1,5 @@
+name: iptables
+description: IPv4 Packet Filtering Framework
+type: background
+start_cmd: /etc/esvm/scripts/iptables.sh
+exit_method: kill

source-files/iptables.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+stop() {
+	# Flush iptables (Code from archlinux)
+	iptables=ip$1tables
+	if ! type -p "$iptables" &>/dev/null; then
+	  echo "error: invalid argument"
+	  exit 1
+	fi
+	
+	while read -r table; do
+	  tables+=("/usr/share/iptables/empty-$table.rules")
+	done <"/proc/net/ip$1_tables_names"
+	
+	if (( ${#tables[*]} )); then
+	  cat "${tables[@]}" | "$iptables-restore"
+	fi
+
+	# Clear the trap
+    trap - SIGINT SIGTERM
+    kill -- -$(pgrep iptables.sh)
+}
+
+/usr/sbin/iptables-restore /etc/iptables/iptables.rules
+
+# Run stop function when SIGINT or SIGTERM signals are caught
+trap "stop $1" SIGINT SIGTERM
+sleep infinity
+
+

source-files/rules/empty-filter.rules

@@ -0,0 +1,6 @@
+# Empty iptables filter table rule file
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT

source-files/rules/empty-mangle.rules

@@ -0,0 +1,8 @@
+# Empty iptables mangle table rules file
+*mangle
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT

source-files/rules/empty-nat.rules

@@ -0,0 +1,7 @@
+# Empty iptables nat table rules file
+*nat
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT

source-files/rules/empty-raw.rules

@@ -0,0 +1,5 @@
+# Empty iptables raw table rules file
+*raw
+:PREROUTING ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT

source-files/rules/empty-security.rules

@@ -0,0 +1,6 @@
+# Empty iptables security table rules file
+*security
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT

source-files/rules/empty.rules

@@ -0,0 +1,6 @@
+# Empty iptables rule file
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT

source-files/rules/simple_firewall.rules

@@ -0,0 +1,11 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+-A INPUT -p icmp -j ACCEPT 
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
+-A INPUT -i lo -j ACCEPT 
+-A INPUT -p tcp -j REJECT --reject-with tcp-reset 
+-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable 
+-A INPUT -j REJECT --reject-with icmp-proto-unreachable 
+COMMIT