Zapamiętywanie konfiguracji iptables

#!/bin/bash
### BEGIN INIT INFO
# Provides:          iptables
# Required-Start:
# Required-Stop:
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: save/restore iptables rules
# Description:
#                    This script saves and restores iptables on
#                    shutdown and bootup.  On sysv-rc systems: to
#                    disable saving on shutdown, remove
#                    /etc/rc[06].d/K20iptables.  To disable restoring
#                    on bootup, rename the "S20iptables" symbolic link
#                    in /etc/rcS.d/ to "K20iptables".
### END INIT INFO
 
set -e
 
IPTABLES_CFG_DIR='/etc/default/iptables.d'
IPTABLES_CFG_FILE='/etc/default/iptables'
 
IPTABLES='/sbin/iptables'
IPTABLES_SAVE='/sbin/iptables-save'
IPTABLES_RESTORE='/sbin/iptables-restore'
 
IPTABLES6='/sbin/ip6tables'
IPTABLES6_SAVE='/sbin/ip6tables-save'
IPTABLES6_RESTORE='/sbin/ip6tables-restore'
 
 
function setup(){
	if [ ! -d "$IPTABLES_CFG_DIR" ]
	then
		mkdir -p "$IPTABLES_CFG_DIR"
	fi
}
 
function load(){
	if [ -r "${IPTABLES_CFG_FILE}.ipv4" -a -x ${IPTABLES_RESTORE}]
	then
		${IPTABLES_RESTORE} -c < "${IPTABLES_CFG_FILE}.ipv4"
	fi
 
	if [ -r "${IPTABLES_CFG_FILE}.ipv6" -a -x ${IPTABLES6_RESTORE}]
	then
		${IPTABLES6_RESTORE} -c < "${IPTABLES_CFG_FILE}.ipv6"
	fi
}
 
function save(){
	STAMP=`date +'%Y-%m-%d'`
	if [ -x ${IPTABLES_SAVE} ]
	then
		${IPTABLES_SAVE} -c > "${IPTABLES_CFG_DIR}/${STAMP}.ipv4"
		ln -sf "${IPTABLES_CFG_DIR}/${STAMP}.ipv4" "$IPTABLES_CFG_FILE.ipv4"
	fi
	if [ -x ${IPTABLES6_SAVE} ]
	then
		${IPTABLES6_SAVE} -c > "${IPTABLES_CFG_DIR}/${STAMP}.ipv6"
		ln -sf "${IPTABLES_CFG_DIR}/${STAMP}.ipv6" "$IPTABLES_CFG_FILE.ipv6"
	fi
}
 
function stop(){
	if [ -f /proc/net/ip_tables_names ]
	then
		for table in `cat /proc/net/ip_tables_names`
		do
			case $table in
			nat)
				${IPTABLES} -t nat -P PREROUTING ACCEPT
				${IPTABLES} -t nat -P POSTROUTING ACCEPT
				${IPTABLES} -t nat -P OUTPUT ACCEPT
				;;
			raw)
				${IPTABLES} -t raw -P PREROUTING ACCEPT
				${IPTABLES} -t raw -P OUTPUT ACCEPT
				;;
			mangle)
				${IPTABLES} -t mangle -P PREROUTING ACCEPT
				${IPTABLES} -t mangle -P INPUT ACCEPT
				${IPTABLES} -t mangle -P FORWARD ACCEPT
				${IPTABLES} -t mangle -P OUTPUT ACCEPT
				${IPTABLES} -t mangle -P POSTROUTING ACCEPT
				;;
			filter)
				${IPTABLES} -t filter -P INPUT ACCEPT
				${IPTABLES} -t filter -P FORWARD ACCEPT
				${IPTABLES} -t filter -P OUTPUT ACCEPT
				;;
			esac
			${IPTABLES} -t $table -F
			${IPTABLES} -t $table -X
		done
	fi
	if [ -f /proc/net/ip6_tables_names ]
	then
		for table in `cat /proc/net/ip6_tables_names`
		do
			case $table in
			raw)
				${IPTABLES6} -t raw -P PREROUTING ACCEPT
				${IPTABLES6} -t raw -P OUTPUT ACCEPT
				;;
			mangle)
				${IPTABLES6} -t mangle -P PREROUTING ACCEPT
				${IPTABLES6} -t mangle -P INPUT ACCEPT
				${IPTABLES6} -t mangle -P FORWARD ACCEPT
				${IPTABLES6} -t mangle -P OUTPUT ACCEPT
				${IPTABLES6} -t mangle -P POSTROUTING ACCEPT
				;;
			filter)
				${IPTABLES6} -t filter -P INPUT ACCEPT
				${IPTABLES6} -t filter -P FORWARD ACCEPT
				${IPTABLES6} -t filter -P OUTPUT ACCEPT
				;;
			esac
			${IPTABLES6} -t $table -F
			${IPTABLES6} -t $table -X
		done
	fi
}
 
setup
 
case "$1" in
	start|restart|force-reload)
		load
		;;
	stop)
		save
		stop
		;;
	save)
		save
		;;
	*)
		exit 1
		;;
esac