#!/bin/bash

GUESTBR=brguest
GUESTDEV=ens10
INTBR=brint
INTDEV=ens3
INETDEV=ens9

GUESTNET=10.0.6.0/24
INTNET=10.0.0.0/24

#          leela             fry               hermes            tim (ess/wohn)    url (küche)       cubert (schlafz)  panucci (dusche)
APDEVICES="c8:69:cd:**:**:** 08:66:98:**:**:** 00:22:4d:**:**:** b8:27:eb:**:**:** b8:27:eb:**:**:** b8:27:eb:**:**:** c0:4a:00:**:**:**"

iptables=/sbin/iptables
ip6tables=/sbin/ip6tables
ebtables=/sbin/ebtables

comment="-m comment --comment"

$iptables -P INPUT DROP
$iptables -P FORWARD DROP
$iptables -P OUTPUT ACCEPT
$iptables -X
$iptables -N AIRPLAY
$iptables -F
$iptables -t nat -P PREROUTING ACCEPT
$iptables -t nat -P INPUT ACCEPT
$iptables -t nat -P OUTPUT ACCEPT
$iptables -t nat -P POSTROUTING ACCEPT
$iptables -t nat -F

$iptables -t nat -A POSTROUTING -s $GUESTNET -o $INETDEV -j MASQUERADE

for dev in $APDEVICES; do
	$iptables -A INPUT -d 224.0.0.0/8 -i $INTBR -m mac --mac-source $dev -j ACCEPT
done
$iptables -A INPUT -d 224.0.0.0/8 -i $INTBR -j DROP

$iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$iptables -A INPUT -i lo -j ACCEPT
$iptables -A INPUT -i $INTBR -j ACCEPT
$iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT $comment "PING" 

$iptables -A INPUT -i $GUESTBR -p udp --dport 67:68 --sport 67:68 -j ACCEPT $comment "DHCP"
$iptables -A INPUT -i $GUESTBR -p udp --dport 53 -j ACCEPT $comment "DNS"
$iptables -A INPUT -i $GUESTBR -d 224.0.0.0/8 -j ACCEPT $comment "Multicast"

$iptables -A INPUT -j LOG --log-prefix="[iptables IN] "

$iptables -A FORWARD -i $INETDEV -o $GUESTBR -m state --state RELATED,ESTABLISHED -j ACCEPT
$iptables -A FORWARD -i $GUESTBR -o $INETDEV -j ACCEPT

$iptables -A FORWARD -i $INTBR -o $GUESTBR -m state --state RELATED,ESTABLISHED -j ACCEPT

$iptables -A FORWARD -i $GUESTBR -o $INTBR -m tcp -p tcp --dport 631 -j ACCEPT         $comment "Print"
$iptables -A FORWARD -i $GUESTBR -o $INTBR -m tcp -p tcp --dport 5000:5100 -j ACCEPT   $comment "AirPlay"
$iptables -A FORWARD -i $GUESTBR -o $INTBR -m udp -p udp --dport 6000:6100 -j ACCEPT   $comment "AirPlay"
$iptables -A FORWARD -i $GUESTBR -o $INTBR -m tcp -p tcp --dport 7000:7100 -j ACCEPT   $comment "AirPlay"
$iptables -A FORWARD -i $GUESTBR -o $INTBR -m tcp -p tcp --dport 49152:65535 -j ACCEPT $comment "AppleTV Status Magic"

$iptables -A FORWARD -j LOG --log-prefix="[iptables FW] "

##################################################

$ip6tables -P INPUT DROP
$ip6tables -P FORWARD DROP
$ip6tables -P OUTPUT ACCEPT
$ip6tables -X
$ip6tables -F
$ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$ip6tables -A INPUT -i lo -j ACCEPT
$ip6tables -A INPUT -i $INTBR -j ACCEPT
$ip6tables -A INPUT -j LOG --log-prefix="[ip6tables IN] "
$ip6tables -A FORWARD -j LOG --log-prefix="[ip6tables FW] "

##################################################

$ebtables -P INPUT ACCEPT
$ebtables -P FORWARD DROP
$ebtables -P OUTPUT ACCEPT
$ebtables -F
$ebtables -X

for dev in $APDEVICES; do
	$ebtables -A OUTPUT -o $INTDEV -d $dev -j ACCEPT
	$ebtables -A INPUT -i $INTDEV -s $dev -j ACCEPT
done

$ebtables -A OUTPUT -o $INTDEV -p IPv4 --ip-src $GUESTNET --log-level info --log-ip --log-prefix "[ebtables OUT] "
$ebtables -A OUTPUT -o $INTDEV -p IPv4 --ip-src $GUESTNET -j DROP

$ebtables -A INPUT -i $INTDEV -p IPv4 --ip-dst $GUESTNET --log-level info --log-ip --log-prefix "[ebtables IN] "
$ebtables -A INPUT -i $INTDEV -p IPv4 --ip-dst $GUESTNET -j DROP

$ebtables -A FORWARD --log-level info --log-ip --log-prefix "[ebtables FW] "