#!/bin/bash

TYPE=bridge

IPT="/usr/sbin/iptables"
SPAMLIST="blockedip"
SPAMDROPMSG="BLOCKED IP DROP"

# public interface to network/internet
BR_IF="br0"
BR_NET="10.0.0.0/8"
GW="10.0.0.1"

PUB_IP="10.0.0.254"
PUB_IF="enp8s0"

# private interface for virtual/internal
PRIV_IF="wlp7s0"
PRIV_NET="192.168.1.0/24"

#$IPT -A netconf_in -p icmp -s ${BR_NET} -j ACCEPT

#$IPT -A netconf_out -p icmp -d ${BR_NET} -j ACCEPT

source iptables-conf.sh

iptables_clear
# Unlimited on loopback
$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
$IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT
$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT


iptables_tables

case $TYPE in
    bridge)

        echo "Setting bridge network..."

        echo 1 > /proc/sys/net/ipv4/ip_forward

        ####### Forward Chain  ######
        $IPT -A FORWARD -j blocker
        #$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d ${NET_ADDR} -m physdev --physdev-in ${PUB_IF} --physdev-out tap2 -j ACCEPT
        #$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap0 --physdev-out ${PUB_IF} -j srv_ssh_out
        $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_in
        $IPT -A FORWARD -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_out

        ####### Input Chain ######
        $IPT -A INPUT -j blocker
        $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_dns_in
        $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_https_in

        $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_ssh_in

        $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -p tcp  --sport 3030 --dport 1024:65535 -j DROP

        ####### Output Chain ######
        $IPT -A OUTPUT -j blocker
        $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_dns_out
        $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_https_out
        $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_out

        #Less noise
        $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 3030 --sport 1024:65535 -j DROP

        ####### PostRouting Chain ######
        $IPT -t nat -A POSTROUTING -o ${PRIV_IF} -j MASQUERADE

        ## log everything else and drop
        iptables_log

        iptables-save > /etc/iptables/net.v4
        exit 0
        ;;
    server)

        echo "Setting server network..."
        ####### Input Chain ######
        $IPT -A INPUT -j blocker

        ####### Output Chain ######
        $IPT -A OUTPUT -j blocker

        ## log everything else and drop
        iptables_log

        iptables-save > /etc/iptables/net.v4
        exit 0

        ;;
    *)

        echo "usage: $0 [start|stop|restart]"
        ;;
esac