redhat iptables 脚本移植给ubuntu

Ubuntu 提供的ufw我个人觉得使用比较复杂，上篇我提供了redhat ipables 脚本到suse, 这篇就到ubuntu时间紧迫，没有太多测试，如果有错误请指正，脚本如下

#!/bin/bash
#
# iptables Start iptables firewall
#
# Author: devil <guxing1841@gmail.com>
# chkconfig: 2345 08 92
# description: Starts, stops and saves iptables firewall
#
# config: /etc/sysconfig/iptables
# config: /etc/sysconfig/iptables-config

# Source function library.

IPTABLES=iptables
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES

. /lib/lsb/init-functions

# our configuration file
DEFAULT=/etc/default/iptables

# default settings...
ENABLED="false"
SA1_OPTIONS=""

# ...overriden in the configuration file
test -r "$DEFAULT" && . "$DEFAULT"

if [ ! -x /sbin/$IPTABLES ]; then
    log_failure_msg $"/sbin/$IPTABLES does not exist."
    exit 0
fi

if lsmod 2>/dev/null | grep -q ipchains ; then
    log_failure_msg $"ipchains and $IPTABLES can not be used together."
    exit 0
fi

# Old or new modutils
/sbin/modprobe --version 2>&1 | grep -q module-init-tools \
    && NEW_MODUTILS=1 \
    || NEW_MODUTILS=0

# Default firewall configuration:
IPTABLES_MODULES=""
IPTABLES_MODULES_UNLOAD="yes"
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
IPTABLES_STATUS_NUMERIC="yes"

# Load firewall configuration.
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"

rmmod_r() {
    # Unload module with all referring modules.
    # At first all referring modules will be unloaded, then the module itself.
    local mod=$1
    local ret=0
    local ref=

    # Get referring modules.
    # New modutils have another output format.
    [ $NEW_MODUTILS = 1 ] \
&& ref=`lsmod | awk "/^${mod}/ { print \\\$4; }" | tr ',' ' '` \
|| ref=`lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1`

    # recursive call for all referring modules
    for i in $ref; do
rmmod_r $i
let ret+=$?;
    done

    # Unload module.
    # The extra test is for 2.6: The module might have autocleaned,
    # after all referring modules are unloaded.
    if grep -q "^${mod}" /proc/modules ; then
modprobe -r $mod > /dev/null 2>&1
let ret+=$?;
    fi

    return $ret
}

flush_n_delete() {
    # Flush firewall rules and delete chains.
    [ -e "$PROC_IPTABLES_NAMES" ] || return 1

    # Check if firewall is configured (has tables)
    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
    [ -z "$tables" ] && return 1

    log_daemon_msg $"Flushing firewall rules: "
    ret=0

    # For all tables
    for i in $tables; do
        # Flush firewall rules.
$IPTABLES -t $i -F;
let ret+=$?;

        # Delete firewall chains.
$IPTABLES -t $i -X;
let ret+=$?;

# Set counter to zero.
$IPTABLES -t $i -Z;
let ret+=$?;
    done

    [ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1
    echo
    return $ret
}

set_policy() {
    # Set policy for configured tables.
    policy=$1

    # Check if iptable module is loaded
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1

    # Check if firewall is configured (has tables)
    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
    [ -z "$tables" ] && return 1

    log_daemon_msg $"Setting chains to policy $policy: "
    ret=0
    for i in $tables; do
log_daemon_msg "$i "
case "$i" in
   raw)
$IPTABLES -t raw -P PREROUTING $policy \
   && $IPTABLES -t raw -P OUTPUT $policy \
   || let ret+=1
;;
   filter)
                $IPTABLES -t filter -P INPUT $policy \
   && $IPTABLES -t filter -P OUTPUT $policy \
   && $IPTABLES -t filter -P FORWARD $policy \
   || let ret+=1
;;
   nat)
$IPTABLES -t nat -P PREROUTING $policy \
   && $IPTABLES -t nat -P POSTROUTING $policy \
   && $IPTABLES -t nat -P OUTPUT $policy \
   || let ret+=1
;;
   mangle)
       $IPTABLES -t mangle -P PREROUTING $policy \
   && $IPTABLES -t mangle -P POSTROUTING $policy \
   && $IPTABLES -t mangle -P INPUT $policy \
   && $IPTABLES -t mangle -P OUTPUT $policy \
   && $IPTABLES -t mangle -P FORWARD $policy \
   || let ret+=1
;;
   *)
       let ret+=1
;;
        esac
    done