#!/bin/bash

# Set defaults if settings are missing
IPTABLES=/usr/sbin/iptables
IPTABLES_CONF=/etc/iptables/iptables.rules

case "$1" in
	start)
		if [ ! -f $IPTABLES_CONF ]; then
			echo "Cannot load iptables rules: $IPTABLES_CONF is missing!" >&2
			exit 1
		fi
		/usr/sbin/iptables-restore < $IPTABLES_CONF
	;;
	stop)
		for table in $(cat /proc/net/ip_tables_names); do
			$IPTABLES -t $table -F &>/dev/null
			$IPTABLES -t $table -X &>/dev/null
			$IPTABLES -t $table -Z &>/dev/null
		done
		for table in filter nat mangle raw; do
			if grep -qw $table /proc/net/ip_tables_names; then
				$IPTABLES -t $table -P OUTPUT ACCEPT
			fi
		done
		for table in filter mangle; do
			if grep -qw $table /proc/net/ip_tables_names; then
				$IPTABLES -t $table -P INPUT ACCEPT
				$IPTABLES -t $table -P FORWARD ACCEPT
			fi
		done
		for table in nat mangle raw; do
			if grep -qw $table /proc/net/ip_tables_names; then
				$IPTABLES -t $table -P PREROUTING ACCEPT
			fi
		done
		for table in nat mangle; do
			if grep -qw $table /proc/net/ip_tables_names; then
				$IPTABLES -t $table -P POSTROUTING ACCEPT
			fi
	done
	;;
	restart)
		$0 stop
		sleep 2
		$0 start
	;;
	save)
		/usr/sbin/iptables-save > $IPTABLES_CONF
	;;
	*)
		echo "usage: $0 {start|stop|restart|save}"
	;;
esac
exit 0