#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
local network="${net}"

# [ NTP ]
#local clients="$clients|UDP	;ntp		;systemd-timesync/systemd-timesync"
#local clients="$clients|TCP	;ntp		;"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

#NETFILTER_INPUTIN=enp9s0 OUT= MAC=01:00:5e:00:00:fb:dc:4a:3e:e6:8d:2d:08:00 SRC=10.90.6.103 DST=224.0.0.251
# LEN=67 TOS=0x00 PREC=0x00 TTL=1 ID=57851 PROTO=UDP SPT=5353 DPT=5353 LEN=47 UID=113 GID=119 MARK=0x10
local mdnsPort="$( iptoolsServicesGetPort udp mdns )"
local  ruleEthIn="$ruleEthIn	;mdns_clt	| -s "${net}" -d 224.0.0.251/32	-p udp --sport "${mdnsPort}"	--dport "${mdnsPort}"	-m state --state NEW,RELATED,ESTABLISHED"
local  ruleEthOut="$ruleEthOut	;mdns_clt	| -s "${ip}" -d 224.0.0.251/32	-p udp --sport "${mdnsPort}"	--dport "${mdnsPort}"	-m state --state NEW,RELATED,ESTABLISHED"
#NETFILTER_INPUTIN=enp9s0 OUT= MAC=01:00:5e:00:00:fb:70:85:c2:4d:42:68:08:00
# SRC=192.168.1.155 DST=224.0.0.251 LEN=67 TOS=0x00 PREC=0x00 TTL=1 ID=15105 PROTO=UDP SPT=5353 DPT=5353 LEN=47 UID=113 GID=119 MARK=0x10

# DROP
# client dhcp (bootps : 67, bootpc : 68)
#local  dropIn="$dropIn  ;drop_dhcp	| -d 255.255.255.255	-s 0.0.0.0	-p udp --sport bootpc --dport bootps -m state --state NEW"
#local  dropIn="$dropIn  ;drop_dhcp	| -d 255.255.255.255	! -s "$gw"	-p udp --sport bootpc --dport bootps -m state --state NEW"
# drop samba protocole (netbios-dgm:138)
#local  dropIn="$dropIn  ;drop_dhcp	| -d "$net" -s "$net"	-p udp --sport netbios-dgm	--dport netbios-dgm	-m state --state NEW"
#local  dropIn="$dropIn  ;drop_dhcp	| -d "$net" -s "$net"	-p udp --sport netbios-ns	--dport netbios-ns	-m state --state NEW"