#!/bin/bash

NETIF=$1
if [ "$1" != "eth0" ] && [ "$1" != "all" ] && [ "$1" != "wlan0" ] && [ "$1" != "bond0" ] && [ "$1" != "IF" ]; then
	printf "Wrong NETIF: $NETIF\neth0, wlan0 or all\n"
	exit 0
fi
if [ "$1" == "all" ] || [ "$1" == "bond0" ] || [ "$1" == "IF" ]; then
	NETIF="eth0"
fi
if [ "$1" == "wlan0" ] || [ "$1" == "all" ] || [ "$1" == "bond0" ] || [ "$1" == "IF" ]; then
	echo "wlan power & txpower on"
	iwconfig wlan0 power on
	iwconfig wlan0 txpower auto
	if [ "$(ifconfig | grep wlan0)" == "" ]; then 
		ifup wlan0 
	fi
elif [ "$1" == "eth0" ]; then
		echo "wlan power & txpower off"
	if [ "$(ifconfig | grep wlan0)" != "" ]; then
		sudo ifdown wlan0
	fi
	iwconfig wlan0 txpower off
	iwconfig wlan0 power off
fi

echo Flush existing rules
ufw disable 

echo Flush
iptables -F

echo Delete
iptables -X

echo Make Rules

echo Allen verkehr blockieren 
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

echo loopback $NETIF
iptables -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

for i in 1 2 3
do  

echo Datenverkehr akzeptieren der zu einer bereits geoeffneten Verbindung gehoert $NETIF
iptables -A INPUT -i $NETIF -m state --state ESTABLISHED,RELATED -j ACCEPT
#if [ "$NETIF" != "bond0" ]; then  
echo Incoming SSH p1160 $NETIF
iptables -A INPUT -i $NETIF -p tcp -m state --state NEW -m tcp --dport 1160 -j ACCEPT
iptables -A OUTPUT -o $NETIF -p tcp --sport 1160 -m state --state ESTABLISHED -j ACCEPT 
#else
#echo Reject Incoming SSH p1160 $NETIF
#iptables -A INPUT -i $NETIF -p tcp -m state --state NEW -m tcp --dport 1160 -j REJECT
#iptables -A OUTPUT -o $NETIF -p tcp --sport 1160 -m state --state ESTABLISHED -j REJECT 
#fi
#echo Outgoing SSh P1160 $NETIF
#iptables -A OUTPUT -o $NETIF -p tcp --dport 1160 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A INPUT -i $NETIF -p tcp --sport 1160 -m state --state ESTABLISHED -j ACCEPT

#echo Outgoing SSH p3032 $NETIF
#iptables -A OUTPUT -o $NETIF -p tcp --dport 3032 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A INPUT -i $NETIF -p tcp --sport 3032 -m state --state ESTABLISHED -j ACCEPT

#echo Updates - Outgoing Network Traffic $NETIF
#iptables -A OUTPUT -o $NETIF -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o $NETIF -p tcp --dport 80 -m state --state NEW -j ACCEPT
#iptables -A OUTPUT -o $NETIF -p tcp --dport 53 -m state --state NEW -j ACCEPT
#iptables -A OUTPUT -o $NETIF -p udp --dport 53 -m state --state NEW -j ACCEPT

echo Ping $NETIF
iptables -A INPUT -i $NETIF -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -o $NETIF -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A OUTPUT -o $NETIF -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -i $NETIF -p icmp --icmp-type echo-reply -j ACCEPT

if [ "$1" == "IF" ] || [ "$1" == "all" ] || [ "$1" == "bond0" ] && [ $i -eq 1 ]; then 
	NETIF="wlan0"
elif [ "$1" == "bond0" ] && [ $i -eq 2 ]; then
	NETIF="bond0"
else
	break
fi
done

echo Logging
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
iptables -A LOGGING -j DROP