r10: - touch inactive rule

[iptables-cn.git] / debian / postinst

diff --git a/debian/postinst b/debian/postinst
index 9293ede..81d185d 100755 (executable)
--- a/debian/postinst
+++ b/debian/postinst
@@ -30,7 +30,7 @@ esac
 # fix problem with permissions from the old package
 if dpkg --compare-versions "$2" lt "2:1.2.11-4"; then
     chown -f -Rh root:root /var/lib/iptables /etc/init.d/iptables \
-               /etc/default/iptables >/dev/null 2>&1
+               /etc/default/iptables >/dev/null 2>&1 || true
 fi
 
 # remove old iptables init script
@@ -48,12 +48,18 @@ fi
 # REJECT recent if there is none..
 # also, save current set of rules into active and inactive configuration
 if [ ! -e /var/lib/iptables/active ]; then
-    . /usr/share/doc/iptables-cn/examples/ssh-bruteforce
+    if ! iptables-save | grep '^-' >/dev/null; then
+        echo "CN: Netfilter rules empty: importing SSH bruteforce rules"
+        . /usr/share/doc/iptables-cn/examples/ssh-bruteforce
+    fi
+    echo "CN: Saving current Netfilter rules to /var/lib/iptables/active"
     iptables-save > /var/lib/iptables/active
 fi
+
+# create inactive
 if [ ! -e /var/lib/iptables/inactive ]; then
-   cp /var/lib/iptables/active /var/lib/iptables/inactive 
-fi 
+    touch /var/lib/iptables/inactive
+fi
 
 # dh_installdeb will replace this with shell code automatically
 # generated by other debhelper scripts.