#!/bin/sh
set -eu

/bin/sh /root/stopblock.sh >/dev/null 2>&1 || true
sleep 1
#grep -q "block" /etc/rc.local || cat /root/rc.local-with > /etc/rc.local
grep -qi "block" /etc/rc.local || sed -i '/^exit 0$/i\/root/startblock.sh' /etc/rc.local

sleep 1
echo 10 > /proc/sys/net/netfilter/nf_conntrack_max ; sleep 4 ; echo 7000 > /proc/sys/net/netfilter/nf_conntrack_max

LAN_IF="br-lan"
LAN_NET="192.168.2.0/24"
EXCLUDE_IP="13.244.149.112/32"

PORTAL_IP="102.38.126.180"
PORTAL_HTTP_PORT="8082"
PORTAL_HTTPS_PORT="8083"

# -------------------------
# NAT CAPTURE
# -------------------------

iptables -t nat -N CAPTIVE 2>/dev/null || true
iptables -t nat -F CAPTIVE

while iptables -t nat -C PREROUTING -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE 2>/dev/null; do
  iptables -t nat -D PREROUTING -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE
done
iptables -t nat -I PREROUTING 1 -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE

iptables -t nat -A CAPTIVE -d "$EXCLUDE_IP" -j RETURN

iptables -t nat -A CAPTIVE -p udp --dport 53 -j REDIRECT --to-ports 53
iptables -t nat -A CAPTIVE -p tcp --dport 53 -j REDIRECT --to-ports 53

iptables -t nat -A CAPTIVE -p tcp --dport 80  -j DNAT --to-destination ${PORTAL_IP}:${PORTAL_HTTP_PORT}
iptables -t nat -A CAPTIVE -p tcp --dport 443 -j DNAT --to-destination ${PORTAL_IP}:${PORTAL_HTTPS_PORT}

# -------------------------
# FILTER ENFORCEMENT (BLOCK EVERYTHING ELSE)
# -------------------------

iptables -N CAPTIVE_BLOCK 2>/dev/null || true
iptables -F CAPTIVE_BLOCK

# Allow established traffic
iptables -A CAPTIVE_BLOCK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow DNS to router itself (client -> router)
iptables -A CAPTIVE_BLOCK -p udp -d 192.168.2.1 --dport 53 -j ACCEPT
iptables -A CAPTIVE_BLOCK -p tcp -d 192.168.2.1 --dport 53 -j ACCEPT

# Allow access to captive portal server (after DNAT)
iptables -A CAPTIVE_BLOCK -p tcp -d "$PORTAL_IP" --dport "$PORTAL_HTTP_PORT" -j ACCEPT
iptables -A CAPTIVE_BLOCK -p tcp -d "$PORTAL_IP" --dport "$PORTAL_HTTPS_PORT" -j ACCEPT

# Allow bypass destination fully (optional but usually desired)
iptables -A CAPTIVE_BLOCK -d "$EXCLUDE_IP" -j ACCEPT

# Block everything else from LAN clients
iptables -A CAPTIVE_BLOCK -j REJECT --reject-with icmp-admin-prohibited

# Hook CAPTIVE_BLOCK into FORWARD (ensure single jump)
while iptables -C FORWARD -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE_BLOCK 2>/dev/null; do
  iptables -D FORWARD -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE_BLOCK
done
iptables -I FORWARD 1 -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE_BLOCK

echo "OK: filter rules applied"