Jak vynulovat pravidla v iptables.

[Michal Weinfurtner]

Dalibor Straka wrote:

>>A nebo /etc/init.d/iptables clear ci podobne dle pouzite distribuce, jak
>>    
>>
U RH a Fedora presne tohle dela
# service iptables stop
Vsechny chainy vyprazdni ve vsech tabulkach a smaze ty definovane 
uzivatelem. Pokud je kernel modularni, odstrani i prislusne moduly. Pak 
je jistota ze jsou iptables vynulovana bezezbytku a spojeni pres NAT by 
mela padnout.

Funkce z /etc/init.d/iptables vymaze veskera pravidla ze vsech tabulek.

flush_n_delete() {

    # Flush firewall rules and delete chains.

    [ -e "$PROC_IPTABLES_NAMES" ] || return 1

    # Check if firewall is configured (has tables)

    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`

    [ -z "$tables" ] && return 1

    echo -n $"Flushing firewall rules: "

    ret=0

    # For all tables

    for i in $tables; do

        # Flush firewall rules.

        $IPTABLES -t $i -F;

        let ret+=$?;

        # Delete firewall chains.

        $IPTABLES -t $i -X;

        let ret+=$?;

        # Set counter to zero.

        $IPTABLES -t $i -Z;

        let ret+=$?;

    done

    [ $ret -eq 0 ] && success || failure

    echo

    return $ret

}


Funkce stop z /etc/init.d/iptables uplne zastavi iptables, vymaze 
pravidla a vymaze moduly iptables z jadra, pokud je jadro modularni.

stop() {

    # Do not stop if iptables module is not loaded.

    [ -e "$PROC_IPTABLES_NAMES" ] || return 1

    flush_n_delete

    set_policy ACCEPT

    if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then

        echo -n $"Unloading $IPTABLES modules: "

        ret=0

        rmmod_r ${IPV}_tables

        let ret+=$?;

        rmmod_r ${IPV}_conntrack

        let ret+=$?;

        [ $ret -eq 0 ] && success || failure

        echo

    fi

    rm -f $VAR_SUBSYS_IPTABLES

    return $ret

}


Funkce panic z /etc/init.d/iptables nejprve vymaze vsechny pravidla a 
pak zastavi veskery provoz nastaveni default pravidla DROP na vsech 
chainech.

    panic)

        flush_n_delete

        set_policy DROP

        RETVAL=$?

    ;;


    *)

      echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save}"


Zdroj /etc/init.d/iptables z Fedora Core 2

M.