#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
local network="0.0.0.0"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

local rootUID="$( shUserId root )"
local rootGID="$( shGroupId root )"
# dhcp server (bootps : 67, bootpc : 68)
local ruleIn="$ruleIn	;dhcp	| -p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW"
local ruleIn="$ruleIn	;dhcp	| -p udp --sport bootps --dport bootpc -m state --state ESTABLISHED"
local ruleOut="$ruleOut	;dhcp	| -p udp --dport bootpc --sport bootps -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner "${rootUID}" --gid-owner "${rootGID}""

local ruleEthIn="$ruleEthIn	;dhcp	| -s 0.0.0.0/32	-d 255.255.255.255/32	-p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW"
#local ruleEthIn="$ruleEthIn	;dhcp	| -s "${net}"	-d 255.255.255.255/32	-p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW"
#local ruleEthIn="$ruleEthIn	;dhcp	| -s "${net}"	-d 255.255.255.255/32	-p udp --sport bootps --dport bootpc -m state --state ESTABLISHED,RELATED,NEW"

# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |

#				-- CLIENT --
#local clients="$clients|TCP	;2200		;root/root;www-data/www-data"
#				-- SERVER --
#local servers="$servers|TCP	;ssh		;root/root"