#!/bin/bash

echo Flush existing rules
iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -F -t filter
echo Delete all
iptables -X

DELUGE_MODE=false

if [ "$1" == "-d" ]; then
	echo Input -d open all traffic
	iptables -P INPUT ACCEPT
	iptables -P FORWARD ACCEPT
	exit 0
elif [ "$1" == "-deluge-mode" ]; then
	echo "Iptables Deluge Mode"
	DELUGE_MODE=true
else
	echo "Set up Firewall"
fi

echo Set Variables
HOST="$(hostname)"
SSHPORT=$(cat /etc/ssh/sshd_config | grep Port | grep -v "#" | cut -f2 -d' ')

echo Make Rules

echo Drop incoming traffic and accept outgoing 
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT 

echo "Established Connections"
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
echo "DHCP"
iptables -A OUTPUT -p udp --dport 67 --sport 68 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --sport 67 --dport 68 -m state --state RELATED,ESTABLISHED -j ACCEPT
if [ "${HOST}" == "quiethost" ]; then
	SD_PORT=7860
	echo Incoming SD Port ${SD_PORT}
	iptables -A INPUT -p tcp --dport ${SD_PORT} -m state --state NEW,ESTABLISHED -j ACCEPT
	iptables -A OUTPUT -p tcp --sport ${SD_PORT} -m state --state ESTABLISHED -j ACCEPT
	echo Incoming SD Port 9170 
	iptables -A INPUT -p tcp --dport 9170 -m state --state NEW,ESTABLISHED -j ACCEPT
	iptables -A OUTPUT -p tcp --sport 9170 -m state --state ESTABLISHED -j ACCEPT
elif [ "${HOST}" == "serverhost" ]; then
	DELUGE_PORT=58846
	echo Incoming https Port 8123 
	iptables -A INPUT -p tcp --dport 8123 -m state --state NEW,ESTABLISHED -j ACCEPT
	iptables -A OUTPUT -p tcp --sport 8123 -m state --state ESTABLISHED -j ACCEPT
	echo Incoming https Port 80
	iptables -A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
	iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
	echo Incoming https Port 443
	iptables -A INPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
	iptables -A OUTPUT -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
	echo Incoming https Port 444
	iptables -A INPUT -p tcp --dport 444 -m state --state NEW,ESTABLISHED -j ACCEPT
	iptables -A OUTPUT -p tcp --sport 444 -m state --state ESTABLISHED -j ACCEPT
	echo Deluge Daemon
	iptables -A INPUT -p tcp --dport ${DELUGE_PORT} -m state --state NEW,ESTABLISHED -j ACCEPT
	iptables -A OUTPUT -p tcp --sport ${DELUGE_PORT} -m state --state ESTABLISHED -j ACCEPT
    iptables -A INPUT -p tcp --dport 8096 -j ACCEPT
    iptables -A INPUT -p udp --dport 8096 -j ACCEPT
    iptables -A INPUT -p tcp --dport 4533 -j ACCEPT
    iptables -A INPUT -p udp --dport 4533 -j ACCEPT
    iptables -A INPUT -p tcp --dport 13378 -j ACCEPT
    iptables -A INPUT -p udp --dport 13378 -j ACCEPT
fi
echo "Incoming SSH -P $SSHPORT"
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport $SSHPORT -j ACCEPT
iptables -A OUTPUT -p tcp --sport $SSHPORT -m state --state ESTABLISHED -j ACCEPT
echo "Incoming XRDP Port"
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 3389 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 3389 -m state --state ESTABLISHED -j ACCEPT
echo "Ping Reply"
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
echo "Send Mail"
iptables -A INPUT -p 25 -j ACCEPT
iptables -A OUTPUT -p 25 -j ACCEPT
echo "loopback"
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
if [[ "$(grep -E "no-internet:" /etc/group)" == "" ]]; then
	echo "Add no-internet group"
	sudo addgroup no-internet
fi
echo "Add No Internet Group Rule"
sudo iptables -A OUTPUT -m owner --gid-owner no-internet -j DROP
# On Fail:
# sudo addgroup no-internet
# sudo adduser lucas no-internet


if [ "${HOST}" == "raspberry" ]; then
	iptables -A FORWARD -i ${NETIF} -o wlan0 -j ACCEPT
	iptables -A FORWARD -i wlan0 -o ${NETIF} -m state --state RELATED,ESTABLISHED -j ACCEPT
	sysctl -w net.ipv4.ip_forward=1
	iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
fi
if [ "$(cat /etc/passwd | grep -E "deluge-user:x:[0-9]{4}:[0-9]{4}")" != "" ]; then
	echo "deluge-user Settings"
	if [ "${VPNUSER}" == "" ]; then 
		VPNUSER="deluge-user"
	fi
	if [ "${LOCALIP}" == "" ]; then
		NETIF="$(lshw -class network | grep -A6 "Ethernet interface" | grep name | awk -F': ' '{print $2}')"
		LOCALIP=$(ip addr show ${NETIF} | grep -Po '(?<= inet )([0-9\.]+)')
	fi
	if [ "${MARK_ID}" == "" ]; then 
		MARK_ID="0x32"
	fi

	if [[ $(ip rule list | grep -c $MARK_ID) == 0 ]]; then
		ip rule add from all fwmark $MARK_ID lookup $VPNUSER
	fi

	echo Interface $NETIF 
	echo IP: $LOCALIP
	echo "mark packets from ${VPNUSER} to ${LOCALIP} with ${MARK_ID}"
	iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
	iptables -t mangle -A OUTPUT ! --dest ${LOCALIP} -m owner --uid-owner ${VPNUSER}  -j MARK --set-mark ${MARK_ID}
	iptables -t mangle -A OUTPUT --dest ${LOCALIP} -p udp --dport 53 -m owner --uid-owner ${VPNUSER} -j MARK --set-mark ${MARK_ID}
	iptables -t mangle -A OUTPUT --dest ${LOCALIP} -p tcp --dport 53 -m owner --uid-owner ${VPNUSER} -j MARK --set-mark ${MARK_ID}
	iptables -t mangle -A OUTPUT ! --src ${LOCALIP} -j MARK --set-mark ${MARK_ID}
	iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

	echo "Set DNS for ${VPNUSER}"
	iptables -t nat -A OUTPUT --dest ${LOCALIP} -p udp --dport 53 -m owner --uid-owner ${VPNUSER} -j DNAT --to-destination 8.8.4.4
	iptables -t nat -A OUTPUT --dest ${LOCALIP} -p tcp --dport 53 -m owner --uid-owner ${VPNUSER} -j DNAT --to-destination 8.8.8.8

	echo "let ${VPNUSER} access lo"
	iptables -A OUTPUT -o lo -m owner --uid-owner ${VPNUSER} -j ACCEPT

	iptables -A INPUT -i ${NETIF} -s 192.168.0.0/24 -p udp --dport 137:138 -m state --state NEW,ESTABLISHED -j ACCEPT
	iptables -A OUTPUT -o ${NETIF} -d 192.168.0.0/24 -p udp --sport 137:138 -m state --state ESTABLISHED -j ACCEPT
	iptables -A INPUT -i ${NETIF} -s 192.168.0.0/24 -p tcp --dport 139 -m state --state NEW,ESTABLISHED -j ACCEPT
	iptables -A OUTPUT -o ${NETIF} -d 192.168.0.0/24 -p tcp --sport 139 -m state --state ESTABLISHED -j ACCEPT
	iptables -A INPUT -i ${NETIF} -s 192.168.0.0/24 -p tcp --dport 445 -m state --state NEW,ESTABLISHED -j ACCEPT
    # qbittorrent
    iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
    # nfs to radarr/sonarr
    iptables -A INPUT -p tcp -s 192.168.0.4 --dport 2049 -j ACCEPT

	if [ "${DELUGE_MODE}" == "true" ]; then
		printf "Local IP: ${LOCALIP}\nInterface: $NETIF\nVPN IP: $VPNIP\nVPN Interface: $VPNIF\nP2P IP: $P2PIP\nVPN User: ${VPNUSER}\nMarkID: ${MARK_ID}\n"
		echo "Deluge and VPN Settings"

		echo Established VPN connections
		iptables -A INPUT -i $VPNIF -m conntrack --ctstate ESTABLISHED -j ACCEPT

		echo "block everything incoming on $VPNIF"
		iptables -A INPUT -i $VPNIF -j REJECT

		echo "let ${VPNUSER} access $VPNIF"
		iptables -A OUTPUT -o $VPNIF -m owner --uid-owner ${VPNUSER} -j ACCEPT
		
		echo all packets on $VPNIF needs to be masqueraded
		iptables -t nat -A POSTROUTING -o $VPNIF -j MASQUERADE

		echo "reject connections from predator IP going over $NETIF"
		iptables -A OUTPUT ! --src ${LOCALIP} -o $NETIF -j REJECT
	fi
fi
LOG=false
if $LOG; then
	echo Logging
	iptables -N LOGGING
	iptables -A INPUT -j LOGGING
	iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
	iptables -A LOGGING -j DROP
fi