#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
local network="0.0.0.0/0"

#				-- CLIENT --
# [ WEB / WHOIS ]
local clients="$clients|TCP	;http		;root/root;_apt/nogroup"
local clients="$clients|TCP	;https		;root/root;_apt/nogroup"
local clients="$clients|TCP	;whois		;root/root"
# [ SSH ]
local clients="$clients|TCP	;ssh		;root/root"
# [ DOMAIN ]
local clients="$clients|UDP	;domain		;root/root;root/Debian-exim;systemd-timesync:systemd-timesync;_apt/nogroup"
local clients="$clients|TCP	;domain		;_apt/nogroup"
# [ OPENVPN ]
local clients="$clients|UDP	;openvpn	;root/root"
# [ NTP ]
local clients="$clients|UDP	;ntp		;ntpd/ntpd;root/root"

#				-- SERVER --
# [ SSH ]
#local servers="$servers|TCP	;ssh		;root/root"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

# client ssdp
#local rootUID="$( shUserId root )"
#local rootGID="$( shGroupId root )"
#local dropOut="$dropOut;ssdp_bad_iface	| -d 239.255.255.250 ! -s  "$ip"	-p udp --dport 1900 -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner ${rootUID} --gid-owner ${rootGID}"

# DROP
# drop samba protocole (netbios-dgm:138)
#local  dropIn="$dropIn  ;drop_dhcp	| -d "$net" -s "$net"	-p udp --sport netbios-dgm	--dport netbios-dgm	-m state --state NEW"
#local  dropIn="$dropIn  ;drop_dhcp	| -d "$net" -s "$net"	-p udp --sport netbios-ns	--dport netbios-ns	-m state --state NEW"