#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |
local network="${net}"

#				-- CLIENT --
#local clients="$clients|UDP	;domain		;root/root"

#				-- SERVER --
#local servers="$servers|TCP	;ssh		;root/root"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -s ${ip}/32 -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -d ${ip}/32 -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -s ${ip}/32 -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -d ${ip}/32 -j ""$rulesIn""

echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

#NETFILTER_INPUTIN=eth0 OUT= MAC=01:00:5e:00:00:01:00:13:20:16:6a:85:08:00 SRC=10.90.6.2 DST=224.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=46331 DF PROTO=47 MARK=0xc
local  ruleEthIn="$ruleEthIn ;gre_in	| -s "$net"		-d "$ip"	-p gre"
local ruleEthOut="$ruleEthOut;gre_out	| -d "$net"		-s "$ip"	-p gre"

local icmpEthOut="$icmpEthOut	;icmp	| -d "$net" -s "$ip"		-p icmp --icmp-type 0/0"
local  icmpEthIn="$icmpEthIn	;icmp	| -s "$net" -d "$ip"		-p icmp --icmp-type 0/0"

# 224.0.0.1/32
#local  ruleEthIn="$ruleEthIn ;gre_in	| -s "$net"		-d "$broadcast"	-p gre"
#local ruleEthOut="$ruleEthOut;gre_out	| -d "$broadcast"	-s "$ip"	-p gre"
#local dropEthIn="$dropEthIn ;gre_in	| -s "$ip"		-d "$broadcast"	-p gre"

#NETFILTER_OUTPUTIN= OUT=eth0 SRC=10.90.6.206 DST=225.1.54.2 LEN=70 TOS=0x00 PREC=0x00 TTL=64 ID=44741 DF PROTO=47 MARK=0xc
# 224.0.0.1/32
# vx354:225.3.54.1 gre354:224.3.54.1 vx383:225.3.83.1 gre383:224.3.83.1 vx390:225.3.90.1 gre390:224.3.90.1
# vx254:225.2.54.1 gre254:224.2.54.1 vx283:225.2.83.1 gre254:224.2.83.1 vx290:225.2.90.1 gre290:224.2.90.1
# vx154:225.1.54.1 gre154:224.1.54.1 vx183:225.1.83.1 gre154:224.1.83.1 vx190:225.1.90.1 gre190:224.1.90.1
#for brdAddr in 224.0.0.54/32 224.0.0.83/32 224.0.0.90/32;do
#for brdAddr in 224.3.54.1/32 224.3.83.1/32 224.3.90.1/32 224.2.54.1/32 224.2.83.1/32 224.2.90.1/32 224.1.54.1/32 224.1.83.1/32 224.1.90.1/32;do
for brdAddr in 224.0.0.1/32 ${broadcast}/32;do
 # NETFILTER_OUTPUTIN= OUT=eth1 SRC=10.90.6.2 DST=224.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=1554 DF PROTO=47 MARK=0xb
 local dropEthIn="$dropEthIn ;gre_in	| -s "$ip"	-d "$brdAddr"	-p gre"

 local  ruleEthIn="$ruleEthIn ;gre_in	| -s "$net"	-d "$brdAddr"	-p gre"
 local ruleEthOut="$ruleEthOut;gre_out	| -d "$brdAddr"	-s "$ip"	-p gre"

 # icmp (echo-reply:0/0, echo-request:8/0)
 local  icmpEthIn="$icmpEthIn	;icmp	| -s "$net" -d "$brdAddr"	-p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpEthOut="$icmpEthOut	;icmp	| -d "$brdAddr" -s "$ip"	-p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
 # icmp (host-unreachable:3/1, port-unreachable:3/3, fragmentation-needed:3/4)
 local  icmpEthIn="$icmpEthIn	;icmp	| -s "$net" -d "$brdAddr"	-p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpEthOut="$icmpEthOut	;icmp	| -d "$brdAddr" -s "$ip"	-p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
 local  icmpEthIn="$icmpEthIn	;icmp	| -s "$net" -d "$brdAddr"	-p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpEthOut="$icmpEthOut	;icmp	| -d "$brdAddr" -s "$ip"	-p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
 local  icmpEthIn="$icmpEthIn	;icmp	| -s "$net" -d "$brdAddr"	-p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpEthOut="$icmpEthOut	;icmp	| -d "$brdAddr" -s "$ip"	-p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
done

#local ruleEthOut="$ruleEthOut;clt_dhcp	| -d 255.255.255.255 -s 0.0.0.0	-p udp --sport ${bootpcPort} --dport ${bootpsPort} -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner ${rootUID} --gid-owner ${rootGID}"
#local  ruleEthIn="$ruleEthIn ;clt_dhcp	| -s "$net" -d 255.255.255.255	-p udp --sport ${bootpcPort} --dport ${bootpsPort} -m state --state NEW"
#local  ruleEthIn="$ruleEthIn ;clt_dhcp	| -s "$net" -d 255.255.255.255	-p udp --sport ${bootpsPort} --dport ${bootpcPort} -m state --state NEW"

# DROP
# client dhcp (bootps : 67, bootpc : 68)
#local  dropEthIn="$dropIn  ;drop_dhcp	| -d 255.255.255.255	-s 0.0.0.0	-p udp --sport ${bootpcPort} --dport ${bootpsPort} -m state --state NEW"
#local  dropEthIn="$dropIn  ;drop_igmp	| -d 224.0.0.1		-s 0.0.0.0	-p igmp"