#!/bin/sh  
cd ${0%${0##*/}}.
. ./conf.sh


/sbin/iptables -F -t nat
/sbin/iptables -F -t filter

/sbin/iptables -P PREROUTING DROP -t nat


#external interface ##################################################################################### 
#ssh 
/sbin/iptables -A PREROUTING -s ! $WIFI_NET -t nat -p tcp --dport 22 -d  $EXTERNAL_IP -j ACCEPT
#drop others from external interface
/sbin/iptables -A PREROUTING -s ! $WIFI_NET -t nat -j DROP
#end of external interface ################################################################# 



#internal interface ################################################################################################### 

#before wifi chain we must add redirects for authorized users  
/sbin/iptables -A PREROUTING  -t nat -p tcp --dport 80 -d $EXTERNAL_IP -j REDIRECT --to-ports $PORTAL_HTTP_PORT 
/sbin/iptables -A PREROUTING  -t nat -p tcp --dport 443 -d $EXTERNAL_IP -j REDIRECT --to-ports $PORTAL_HTTPS_PORT 


#chain for  WiFi  (accept rules for authorized users) 

/sbin/iptables --delete-chain $WIFI_CHAIN_NAME -t nat
/sbin/iptables -N $WIFI_CHAIN_NAME -t nat
/sbin/iptables -A PREROUTING  -j $WIFI_CHAIN_NAME -t nat

#below is rules for internal not authorized users : 

#dns   
/sbin/iptables -A PREROUTING  -t nat -p udp --dport 53 -j ACCEPT

#http  
/sbin/iptables -A PREROUTING  -t nat -p tcp --dport 80 -j REDIRECT --to-ports $PORTAL_HTTP_PORT 
/sbin/iptables -A PREROUTING  -t nat -p tcp --dport $PORTAL_HTTP_PORT -j ACCEPT

#https  
/sbin/iptables -A PREROUTING -t nat -p tcp --dport 443 -j REDIRECT --to-ports $PORTAL_HTTPS_PORT 
/sbin/iptables -A PREROUTING -t nat -p tcp --dport $PORTAL_HTTPS_PORT -j ACCEPT

#statistics 
/sbin/iptables -A PREROUTING  -t nat -p tcp --dport 8080 -d $EXTERNAL_IP -j ACCEPT


# NAT 
iptables -A POSTROUTING -o $EXTERNAL_INTERFACE  -s $WIFI_NET -j SNAT -t nat --to-source $EXTERNAL_IP

#RST packets for dropping estblished connections  
/sbin/iptables -A FORWARD -p tcp  -j REJECT --reject-with tcp-reset
