#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
#local network="$( iptoolsGetIps | $cmdTr -s '[[:blank:]]' ';' );"
#local network="${ip}/32;"
#local network="${ip}/32;127.0.1.1/32"
local network="127.0.0.1/32;127.0.1.1/32"

# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |

#				-- CLIENT --
local clients="$clients|UDP	;5545		;root/root"
local clients="$clients|TCP	;5545		;root/root"
local clients="$clients|UDP	;10000:20000	;root/root"
local clients="$clients|UDP	;20001:30000	;root/root"
local clients="$clients|UDP	;30001:40000	;root/root"

#				-- SERVER --
local servers="$servers|UDP	;5545		;root/root"
local servers="$servers|TCP	;5545		;root/root"
local servers="$servers|UDP	;10000:20000	;root/root"
local servers="$servers|UDP	;20001:30000	;root/root"
local servers="$servers|UDP	;30001:40000	;root/root"

#local servers="$servers|TCP	;domain		;1000/1000"

# client
local ruleIn="$ruleIn	;5rtsp	| -p tcp --sport 5545 -m state --state NEW --tcp-flags ACK,PSH,FIN ACK,PSH,FIN"
local ruleOut="$ruleOut	;5rtsp	| -p tcp --dport 5545 -m state --state NEW --tcp-flags RST RST"
local ruleOut="$ruleOut	;5rtsp	| -p tcp --dport 5545 -m state --state NEW --tcp-flags SYN SYN"

# server
#NETFILTER_INPUTIN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
# DST=127.0.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=17563 DF PROTO=TCP SPT=51402 DPT=5545 WINDOW=65495 RES=0x00 SYN URGP=0 OPT (0204FFD70402080A3EECCD510000000001030307) MARK=0x11
local ruleIn="$ruleIn	;5rtsp	| -p tcp --dport 5545 -m state --state NEW --tcp-flags SYN SYN"
local ruleIn="$ruleIn	;5rtsp	| -p tcp --dport 5545 -m state --state NEW --tcp-flags RST RST"
local ruleOut="$ruleOut	;5rtsp	| -p tcp --sport 5545 -m state --state NEW --tcp-flags ACK,PSH,FIN ACK,PSH,FIN"

local ruleOut="$ruleOut	;5rtsp	| -p tcp --sport 5545 -m state --state NEW --tcp-flags ACK ACK"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -s ${ip}/32 -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -d ${ip}/32 -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -s ${ip}/32 -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -d ${ip}/32 -j ""$rulesIn""

# DROP
# client dhcp (bootps : 67, bootpc : 68)
#local  dropIn="$dropIn  ;drop_dhcp	| -d 255.255.255.255	-s 0.0.0.0	-p udp --sport ${bootpcPort} --dport ${bootpsPort} -m state --state NEW"
#local  dropIn="$dropIn  ;drop_igmp	| -d 224.0.0.1		-s 0.0.0.0	-p igmp"