#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |
local network="${net}"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -s ${ip}/32 -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -d ${ip}/32 -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -s ${ip}/32 -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -d ${ip}/32 -j ""$rulesIn""
#				-- CLIENT --
# [ TCP/SSH ]
#local clients="$clients|TCP	;ssh		;root/root"
local ruleOut="$ruleOut	;ssh-clt	| -p tcp --dport ssh"
local ruleIn="$ruleIn	;ssh-clt	| -p tcp --sport ssh"
# [ UDP/DOMAIN ]
#local clients="$clients|UDP	;domain		;root/root"
local ruleOut="$ruleOut	;dom-clt	| -p tcp --dport domain"
local ruleIn="$ruleIn	;dom-clt	| -p tcp --sport domain"
#local clients="$clients|TCP	;domain		;root/root;Debian-exim/Debian-exim"
local ruleOut="$ruleOut	;dom-clt	| -p udp --dport domain"
local ruleIn="$ruleIn	;dom-clt	| -p udp --sport domain"

#				-- SERVER --
#local servers="$servers|TCP	;ssh		;root/root"
local ruleOut="$ruleOut	;ssh-srv	| -p tcp --sport ssh"
local ruleIn="$ruleIn	;ssh-srv	| -p tcp --dport ssh"

# icmp (echo-reply:0/0, echo-request:8/0)
local  icmpIn="$icmpIn	;icmp	| -p icmp --icmp-type 8/0"
local icmpOut="$icmpOut	;icmp	| -p icmp --icmp-type 0/0"
local  icmpIn="$icmpIn	;icmp	| -p icmp --icmp-type 0/0"
local icmpOut="$icmpOut	;icmp	| -p icmp --icmp-type 8/0"
# icmp (host-unreachable:3/1, port-unreachable:3/3, fragmentation-needed:3/4)
local icmpOut="$icmpOut	;icmp	| -p icmp --icmp-type 3/1"
local  icmpIn="$icmpIn	;icmp	| -p icmp --icmp-type 3/1"
local icmpOut="$icmpOut	;icmp	| -p icmp --icmp-type 3/3"
local  icmpIn="$icmpIn	;icmp	| -p icmp --icmp-type 3/3"
local icmpOut="$icmpOut	;icmp	| -p icmp --icmp-type 3/4"
local  icmpIn="$icmpIn	;icmp	| -p icmp --icmp-type 3/4"
# icmp redirect gateway
local icmpOut="$icmpOut;icmp	| -p icmp --icmp-type 5/1"

# client dhcp (bootps : 67, bootpc : 68)
#local bootpcPort="$( iptoolsServicesGetPort udp bootpc )"
#local bootpsPort="$( iptoolsServicesGetPort udp bootps )"
#local rootUID="$( shUserId root )"
#local rootGID="$( shGroupId root )"
#
#local  ruleIn="$ruleIn ;clt_dhcp	| -s "$net"	-p udp --sport ${bootpsPort} --dport ${bootpcPort}"
#local ruleOut="$ruleOut;clt_dhcp	| -d "$net"	-p udp --sport ${bootpcPort} --dport ${bootpsPort} -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner ${rootUID} --gid-owner ${rootGID}"
#
#local ruleEthOut="$ruleEthOut;clt_dhcp	| -d 255.255.255.255 -s 0.0.0.0	-p udp --sport ${bootpcPort} --dport ${bootpsPort} -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner ${rootUID} --gid-owner ${rootGID}"
# really needed ???
#local  ruleEthIn="$ruleEthIn ;clt_dhcp	| -s "$net" -d 255.255.255.255	-p udp --sport ${bootpcPort} --dport ${bootpsPort} -m state --state NEW"
#local  ruleEthIn="$ruleEthIn ;clt_dhcp	| -s "$net" -d 255.255.255.255	-p udp --sport ${bootpsPort} --dport ${bootpcPort} -m state --state NEW"
#
# DROP
# client dhcp (bootps : 67, bootpc : 68)
#local  dropEthIn="$dropIn  ;drop_dhcp	| -d 255.255.255.255	-s 0.0.0.0	-p udp --sport ${bootpcPort} --dport ${bootpsPort} -m state --state NEW"
#local  dropEthIn="$dropIn  ;drop_igmp	| -d 224.0.0.1		-s 0.0.0.0	-p igmp"