#!/sbin/openrc-run
# Custom shell script to up/down network interface
# No dhcp used

interfaces='eno1'
link=`cat /proc/net/dev_mcast | awk '{ printf $2 }'`

start() {
	
	if [[ -z "$link" ]]; then

		# Settings iptables rules
		# Useful documentation : https://wiki.gentoo.org/wiki/Security_Handbook/Firewalls
		#		         https://wiki.gentoo.org/wiki/Tor
		#

		# Redirect DNS to tor port 
		iptables -t nat -A OUTPUT -p UDP --dport 53 -j DNAT --to-destination 127.0.0.1:9053 

		# Accept local interface
		iptables -I INPUT -i lo -j ACCEPT           

		# Default input rules, accept new and established
		iptables -I INPUT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

		# Default output, accept established and related 
		iptables -I OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

		# Block direct connection (ISP)
		iptables -I INPUT -s 192.168.1.1 -j DROP
		iptables -I OUTPUT -s 192.168.1.1 -j DROP
		iptables -I INPUT -s xxx.xx.x.x/16  -j DROP
		iptables -I OUTPUT -s xxx.xx.x.x/16 -j DROP

		# Block any direct connection to local network devices
		iptables -I INPUT -s 192.168.2.3 -j DROP
		iptables -I INPUT -s 192.168.2.4 -j DROP
		iptables -I INPUT -s 192.168.2.5 -j DROP
		iptables -I INPUT -s 192.168.2.6 -j DROP
		iptables -I OUTPUT -s 192.168.2.3 -j DROP
		iptables -I OUTPUT -s 192.168.2.4 -j DROP
		iptables -I OUTPUT -s 192.168.2.5 -j DROP
		iptables -I OUTPUT -s 192.168.2.6 -j DROP

		# Port allowed
		iptables -I OUTPUT -p tcp --dport 80 -j ACCEPT # HTTP
		iptables -I OUTPUT -p tcp --dport 443 -j ACCEPT # HTTPS
		iptables -I OUTPUT -p tcp --dport 9001 -j ACCEPT # Tor default port
		iptables -I OUTPUT -p tcp --dport 9050 -j ACCEPT # Tor default port
		iptables -I OUTPUT -p udp --dport 9053 -j ACCEPT # Tor DNS
		iptables -I OUTPUT -p tcp --dport 9060 -j ACCEPT # Tor isolation
		iptables -I OUTPUT -p tcp --dport 9061 -j ACCEPT # Tor isolation
		iptables -I OUTPUT -p tcp --dport 9065 -j ACCEPT # Tor isolation
		iptables -I OUTPUT -p tcp --dport 9070 -j ACCEPT # Tor isolation 
		iptables -I OUTPUT -p udp --dport 58855 -j ACCEPT # Wireguard VPN
		iptables -I OUTPUT -p tcp --dport 873 -j ACCEPT # Portage rsync
		
		# Drop everything else (catch the log rsyslog)
		iptables -A INPUT -j  LOG --log-prefix "DROP IN : "
		iptables -A INPUT -j DROP
		iptables -A OUTPUT -j LOG --log-prefix "DROP OUT : "
		iptables -A OUTPUT -j DROP
		iptables -A FORWARD -j DROP     

		# Make sure DNS always resolv locally 
		echo "nameserver 127.0.0.1" > /etc/resolv.conf
 
		# Generate a random mac addr
		if [[ $EINFO_VERBOSE ]]; then
		  macchanger -r $interfaces 
		else
		  macchanger -r $interfaces &>/dev/null
		fi

		# Set local ip for the network interface
		ifconfig $interfaces 192.168.2.2 up

		# Add the gateway route
		route add default gw 192.168.2.1

		einfo "Network interface up"
	fi

}

stop() {
	
	if [[ ! -z "$link" ]]; then

		# Delete any previous route, connection settings
		route del default  || true
		ifconfig $interfaces down || true
	
		# Delete any previous iptables rules
		iptables -F
		iptables -X
		iptables -t nat -F
		iptables -Z

		einfo  "Network interface down"		
	fi
}

restart() {

	if [[ ! -z "$link" ]]; then
		stop
		start
	else
		start
	fi
}

status() {

	if [[ ! -z "$link" ]]; then

		einfo "Network interface up"
	else
		einfo "Network interface down"
	fi
}