#!/bin/bash

TYPE=bridge
#TYPE=server

IPT="/usr/sbin/iptables"
SPAMLIST="blockedip"
SPAMDROPMSG="BLOCKED IP DROP"

# public interface to network/internet
BR_IF="br0"
BR_NET="10.0.0.0/8"
GW="10.0.0.1"
DNS="10.0.0.254"

PUB_IP="10.0.0.254"
PUB_IF="enp8s0"

# private interface for virtual/internal
#PRIV_IF="wlp7s0"
#PRIV_NET="192.168.1.0/24"

#$IPT -A netconf_in -p icmp -s ${BR_NET} -j ACCEPT

#$IPT -A netconf_out -p icmp -d ${BR_NET} -j ACCEPT

source iptables-conf.sh

iptables_clear
# Unlimited on loopback
$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
$IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT
$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT

iptables_tables

case $TYPE in
    bridge)

        echo "Setting bridge network..."
        echo 1 > /proc/sys/net/ipv4/ip_forward

        
        ####### NAT Prerouting Chain  ######
        #PREROUTING: IN=br0 OUT= PHYSIN=tap2 MAC=ff:ff:ff:ff:ff:ff:54:60:be:ef:5c:14:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=377 TOS=0x00 PREC=0x00 TTL=64 ID=37544 PROTO=UDP SPT=68 DPT=67 LEN=357

        ####### Forward Chain  ######
        $IPT -A FORWARD -j blocker
        $IPT -A FORWARD -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
        $IPT -A FORWARD -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT

        $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_in
        $IPT -A FORWARD -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_out

        $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} --physdev-out tap2 -j srv_rip

        $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 --physdev-out ${PUB_IF} -j srv_dhcp
        $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} --physdev-out tap2 -j srv_dhcp

        $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in tap2 --physdev-out ${PUB_IF} -j cli_https_out
        $IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -m physdev --physdev-in ${PUB_IF} --physdev-out tap2 -j cli_https_in

        ####### Input Chain ######
        $IPT -A INPUT -j blocker
        #Less noise
        $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -p tcp  --sport 3030 --dport 1024:65535 -j DROP

        $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_dns_in
        $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_https_in
        $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -j cli_git_in

        $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -j cli_ssh_in

        $IPT -A INPUT -i ${BR_IF} -d ${PUB_IP} -s ${BR_NET} -m physdev --physdev-in tap2 -j srv_dns_in

        $IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in tap2 -j srv_dhcp
        $IPT -A INPUT -i ${BR_IF} -m physdev --physdev-in ${PUB_IF} -s ${GW} -d ${PUB_IP}  -j srv_dhcp

        ####### Output Chain ######
        $IPT -A OUTPUT -j blocker
        #Less noise
        $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 3030 --sport 1024:65535 -j DROP
        $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -p tcp --dport 80 --sport 1024:65535 -j DROP

        $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_dns_out
        $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -j cli_https_out
        $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_ssh_out
        $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j cli_git_out

        $IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${BR_NET} -j srv_dhcp
        $IPT -A OUTPUT -o ${BR_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_dns_out

        ####### PostRouting Chain ######
        $IPT -t nat -A POSTROUTING -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT

        #$IPT -t nat -A POSTROUTING -o ${PRIV_IF} -j MASQUERADE

        ## log everything else and drop
        iptables_log

	$IPT -t nat -A POSTROUTING -j LOG --log-level 7 --log-prefix "iptables: POSTROUTING: "
	$IPT -t nat -A PREROUTING -j LOG --log-level 7 --log-prefix "iptables: PREROUTING: "

        iptables-save > /etc/iptables/net.v4
        exit 0
        ;;
    server)

        echo "Setting server network..."
        ####### Input Chain ######
        $IPT -A INPUT -j blocker

	$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${DNS} -j cli_dns_in
	$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_https_in
	$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_ssh_in
	$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -s ${BR_NET} -j srv_git_in
	$IPT -A INPUT -i ${PUB_IF} -d ${PUB_IP} -j cli_https_in

        ####### Output Chain ######
        $IPT -A OUTPUT -j blocker

	$IPT -A OUTPUT -o ${PUB_IF} -d ${DNS} -s ${PUB_IP} -j cli_dns_out
	$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_https_out
	$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_ssh_out
	$IPT -A OUTPUT -o ${PUB_IF} -d ${BR_NET} -s ${PUB_IP} -j srv_git_out
	$IPT -A OUTPUT -o ${PUB_IF} -s ${PUB_IP} -j cli_https_out

        ## log everything else and drop
        iptables_log

        iptables-save > /etc/iptables/net.v4
        exit 0

        ;;
    *)

        echo "usage: $0 [start|stop|restart]"
        ;;
esac