#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |
#local network="${net}"

#				-- CLIENT --
# [ TCP/SSH ]
#local clients="$clients|TCP	;ssh		;root/root"
# [ UDP/DOMAIN ]
#local clients="$clients|UDP	;domain		;root/root"
#local clients="$clients|TCP	;domain		;root/root;Debian-exim/Debian-exim"
#				-- SERVER --
#local servers="$servers|TCP	;ssh		;root/root"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -s ${ip}/32 -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -d ${ip}/32 -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -s ${ip}/32 -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -d ${ip}/32 -j ""$rulesIn""

# icmp (echo-reply:0/0, echo-request:8/0)
local  icmpIn="$icmpIn	;icmp	| -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
local icmpOut="$icmpOut	;icmp	| -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED"
local  icmpIn="$icmpIn	;icmp	| -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED"
local icmpOut="$icmpOut	;icmp	| -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
# icmp (host-unreachable:3/1, port-unreachable:3/3, fragmentation-needed:3/4)
local icmpOut="$icmpOut	;icmp	| -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
local  icmpIn="$icmpIn	;icmp	| -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
local icmpOut="$icmpOut	;icmp	| -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
local  icmpIn="$icmpIn	;icmp	| -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
local icmpOut="$icmpOut	;icmp	| -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
local  icmpIn="$icmpIn	;icmp	| -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
# icmp redirect gateway
local icmpOut="$icmpOut;icmp	| -p icmp --icmp-type 5/1"

#local  icmpIn="$icmpIn	;icmp	| -s "${net}" -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
#local icmpOut="$icmpOut	;icmp	| -d "${net}" -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED"
#local  icmpIn="$icmpIn	;icmp	| -s "${net}" -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED"
#local icmpOut="$icmpOut	;icmp	| -d "${net}" -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
## icmp (host-unreachable:3/1, port-unreachable:3/3, fragmentation-needed:3/4)
#local icmpOut="$icmpOut	;icmp	| -d "${net}" -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
#local  icmpIn="$icmpIn	;icmp	| -s "${net}" -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
#local icmpOut="$icmpOut	;icmp	| -d "${net}" -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
#local  icmpIn="$icmpIn	;icmp	| -s "${net}" -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
#local icmpOut="$icmpOut	;icmp	| -d "${net}" -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
#local  icmpIn="$icmpIn	;icmp	| -s "${net}" -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
## icmp redirect gateway
#local icmpOut="$icmpOut;icmp	| -d "${net}" -p icmp --icmp-type 5/1"