/etc/init.d/iptables-persistent rc.2

#!/bin/sh
#    Written by Simon Richter <sjr@debian.org>
#    Modified by Jonathan Wiltshire <jmw@debian.org>
#        with help from Christoph Anton Mitterer
#    Modified by Konstantin Demin <rockdrilla@gmail.com>
#        with God willing

### BEGIN INIT INFO
# Provides:          iptables-persistent
# Required-Start:    mountkernfs $local_fs
# Required-Stop:     $local_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# X-Start-Before:    $network
# X-Stop-After:      $network
# Short-Description: Set up iptables rules
# Description:       Loads/saves current iptables rules from/to /etc/iptables
#                    to provide a persistent rule set during boot time
### END INIT INFO

export PATH=/sbin:/bin

. /lib/lsb/init-functions

RULES=/etc/iptables/rules
RULES_set=${RULES}.ipset
RULES_v4=${RULES}.ipv4
RULES_v6=${RULES}.ipv6


binary_exist() {
    IFS_BAK=${IFS} IFS=':' notfound=1

    # if PATH ends with ':' then search in current directory too (IFS hack)
    case "${PATH}" in
    *[!:]:) PATH="${PATH}:" ;;
    esac

    case "$1" in
    */*)
        binary_exist_h "$1" && notfound=0
    ;;
    *)
        for location in ${PATH}; do
            test -z "${location}" && location=.
            binary_exist_h "${location}/$1" && notfound=0 && break
        done
    ;;
    esac
    IFS=${IFS_BAK}
    return ${notfound}
}
binary_exist_h() { test -f "$1" && test -x "$1"; }

# keep in sync with test_avail()
init_avail() {
    for subsys in ipset ipv4 ipv6; do
        case "${subsys}" in
        ipset)
            dirs='/sys/module/ip_set '
            files=
            binaries='ipset '
        ;;
        ipv4)
            dirs=
            files='/proc/net/ip_tables_names '
            binaries='iptables iptables-restore iptables-save '
        ;;
        ipv6)
            dirs=
            files='/proc/net/ip6_tables_names '
            binaries='ip6tables ip6tables-restore ip6tables-save '
        ;;
        *) continue ;; # this may not happen at all.
        esac

        for flavour in K U; do
            err=0
            case "${flavour}" in
            K)  for i in ${dirs}; do test -d $i || err=1; done
                for i in ${files}; do test -e $i || err=1; done
            ;;
            U)  for i in ${binaries}; do binary_exist $i || err=1; done
            ;;
            *) continue ;; # this may not happen at all.
            esac

            eval "avail_${subsys}_${flavour}() { return ${err};}"
        done
    done

    return 0
}

test_avail() {
    subsys=$1 flavour=
    case "$2" in
    kernel) flavour=K ;; # kernel-space
    *)      flavour=U ;; # user-space
    esac

    case "${subsys}" in
    ipset) ;;
    ipv4) ;;
    ipv6) ;;
    *) return 2 ;;
    esac

    eval "avail_${subsys}_${flavour}"
}

m_ok=' [ok]'
m_skip=' [skip]'
m_err=' {ERROR}'


load_rules() {
    log_action_begin_msg "Loading iptables rules"

    subsystems='ipset ipv4 ipv6'
    test $# -ne 0 && subsystems=$@

    for i in ${subsystems}; do
        title= cmd= file=
        case "$i" in
        ipset)  title=IPset  cmd=load_rules_ipset  file=${RULES_set} ;;
        ipv4)   title=IPv4   cmd=load_rules_ipv4   file=${RULES_v4}  ;;
        ipv6)   title=IPv6   cmd=load_rules_ipv6   file=${RULES_v6}  ;;
        *)
            # todo: notify user if subsystem isn't recognized or supported
            continue
        ;;
        esac

        test_avail $i user || continue

        log_action_cont_msg " ${title}"

        if test -f ${file}; then
            ${cmd} < ${file} 2> /dev/null

            if test $? -ne 0
            then log_action_cont_msg "${m_err}"
#           else log_action_cont_msg "${m_ok}"
            fi
        else
            log_action_cont_msg "${m_skip}"
        fi
    done

    log_action_end_msg 0
    return 0
}
load_rules_ipset() {
    ipset restore
}
load_rules_ipv4() {
    iptables-restore
}
load_rules_ipv6() {
    ip6tables-restore
}

save_rules() {
    log_action_begin_msg "Saving rules"

    subsystems='ipset ipv4 ipv6'
    test $# -ne 0 && subsystems=$@

    for i in ${subsystems}; do
        title= cmd= file=
        case "$i" in
        ipset)  title=IPset  cmd=save_rules_ipset  file=${RULES_set} ;;
        ipv4)   title=IPv4   cmd=save_rules_ipv4   file=${RULES_v4}  ;;
        ipv6)   title=IPv6   cmd=save_rules_ipv6   file=${RULES_v6}  ;;
        *)
            # todo: notify user if subsystem isn't recognized or supported
            continue
        ;;
        esac

        test_avail $i user || continue

        log_action_cont_msg " ${title}"

        if test -f ${file}; then
            ${cmd} > ${file} 2> /dev/null

            if test $? -ne 0
            then log_action_cont_msg "${m_err}"
#           else log_action_cont_msg "${m_ok}"
            fi
        else
            log_action_cont_msg "${m_skip}"
        fi
    done

    log_action_end_msg 0
    return 0
}
save_rules_ipset() {
    ipset save
}
save_rules_ipv4() {
    iptables-save
}
save_rules_ipv6() {
    ip6tables-save
}

flush_rules() {
    log_action_begin_msg "Flushing rules"

    # reversed order IS correct
    subsystems='ipv6 ipv4 ipset'
    test $# -ne 0 && subsystems=$@

    for i; do
        case "$i" in
        ipset)  title=IPSet  cmd=flush_rules_ipset ;;
        ipv4)   title=IPv4   cmd=flush_rules_ipv4  ;;
        ipv6)   title=IPv6   cmd=flush_rules_ipv6  ;;
        *)
            # todo: notify user if subsystem isn't recognized or supported
            continue
        ;;
        esac

        test_avail $i || continue

        log_action_cont_msg " ${title}"

        if test_avail $i kernel; then
            ${cmd}

            if test $? -ne 0
            then log_action_cont_msg "${m_err}"
#           else log_action_cont_msg "${m_ok}"
            fi
        else
            log_action_cont_msg "${m_skip}"
        fi
    done

    log_action_end_msg 0
    return 0
}
flush_rules_ipset() {
    ipset flush
    ipset destroy
}
flush_rules_ipv4() {
    for chain in INPUT FORWARD OUTPUT; do
        iptables -P ${chain} ACCEPT
    done
    for table in $(cat /proc/net/ip_tables_names); do
        iptables -t ${table} -F
        iptables -t ${table} -X
        iptables -t ${table} -Z
    done
}
flush_rules_ipv6() {
    for chain in INPUT FORWARD OUTPUT; do
        ip6tables -P ${chain} ACCEPT
    done
    for table in $(cat /proc/net/ip6_tables_names); do
        ip6tables -t ${table} -F
        ip6tables -t ${table} -X
        ip6tables -t ${table} -Z
    done
}


act=$1; shift
case "${act}" in
start|reload)
    init_avail
    load_rules "$@"
;;
save)
    init_avail
    save_rules "$@"
;;
flush)
    init_avail
    flush_rules "$@"
;;
restart|force-reload)
    init_avail
    flush_rules "$@"
    load_rules "$@"
;;
stop)
    # Why? because if stop is used, the firewall gets flushed for a variable
    # amount of time during package upgrades, leaving the machine vulnerable
    # It's also not always desirable to flush during purge
    echo 'Automatic flushing disabled, use "flush" instead of "stop"' >&2
;;
*)
    echo "Usage: $0 {start|restart|reload|force-reload|save|flush}" >&2
    exit 1
;;
esac

exit 0