#!/bin/bash
# ═══════════════════════════════════════════════════════════════════
# Firewall monitoring-uber (185.103.167.138)
# ─────────────────────────────────────────────────────────────────
# INBOUND:
#   • 1514/tcp FROM prod (185.103.166.119) — agents Wazuh
#   • 1514/tcp FROM pre-prod (185.103.166.112) — agents Wazuh
#   • 51820/udp — VPN WireGuard
#   • 10.0.0.0/24 (VPN admins) → 443, 8080, 8090, 9000, 9001
#   • SSH: BLOCKED from prod/pre-prod/s3 (security hardening)
# ─────────────────────────────────────────────────────────────────
# OUTBOUND:
#   • Tout (0.0.0.0/0) — Internet, updates, DNS
#   • VPN vers VPS
# ═══════════════════════════════════════════════════════════════════

set -e

echo "[*] Configurant firewall monitoring-uber..."

# Flush des règles existantes
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X

# Politique par défaut
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# ─── INPUT ────────────────────────────────────────────────────────
# Loopback (services internes)
iptables -A INPUT -i lo -j ACCEPT

# Established/Related
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# SSH (administration locale, bloquer depuis prod/pre-prod/s3)
iptables -A INPUT -p tcp --dport 22 -s 185.103.166.119 -j DROP  # prod
iptables -A INPUT -p tcp --dport 22 -s 185.103.166.112 -j DROP  # pre-prod
iptables -A INPUT -p tcp --dport 22 -s 80.96.58.164 -j DROP     # s3
iptables -A INPUT -p tcp --dport 22 -j ACCEPT                   # allow from other sources

# ─── Agents Wazuh (prod + pre-prod) ────────────────────────────
# Prod: 185.103.166.119
iptables -A INPUT -p tcp --dport 1514 -s 185.103.166.119 -j ACCEPT

# Pre-prod: 185.103.166.112
iptables -A INPUT -p tcp --dport 1514 -s 185.103.166.112 -j ACCEPT

# ─── VPN (WireGuard) ──────────────────────────────────────────
iptables -A INPUT -p udp --dport 51820 -j ACCEPT

# ─── Services (accessibles via VPN seulement) ─────────────────
# Admins via VPN: 10.0.0.0/24

# Wazuh Dashboard (443/https)
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT

# Dozzle (8080/http)
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT

# Beszel (8090/http)
iptables -A INPUT -p tcp --dport 8090 -s 10.0.0.0/24 -j ACCEPT

# S3/RustFS (9000/9001)
iptables -A INPUT -p tcp --dport 9000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9001 -s 10.0.0.0/24 -j ACCEPT

# ─── ICMP ─────────────────────────────────────────────────────
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

# Reject le reste
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

# ─── FORWARD ──────────────────────────────────────────────────
# Blocker forward par défaut (services locaux, pas de transit)
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited

# ─── Sauvegarder ──────────────────────────────────────────────
mkdir -p /etc/iptables
iptables-save > /etc/iptables/rules.v4

echo "[✓] Firewall monitoring-uber configuré"
echo ""
echo "Règles appliquées (ALLOW) :"
echo "  • SSH 22/tcp — from admin IPs only (BLOCKED from prod/pre-prod/s3)"
echo "  • Wazuh 1514/tcp FROM prod (185.103.166.119) — agents Wazuh"
echo "  • Wazuh 1514/tcp FROM pre-prod (185.103.166.112) — agents Wazuh"
echo "  • VPN 51820/udp — WireGuard"
echo "  • Wazuh Dashboard 443/tcp FROM 10.0.0.0/24 (VPN)"
echo "  • Dozzle 8080/tcp FROM 10.0.0.0/24 (VPN)"
echo "  • Beszel 8090/tcp FROM 10.0.0.0/24 (VPN)"
echo "  • S3/RustFS 9000-9001/tcp FROM 10.0.0.0/24 (VPN)"
echo "  • OUTPUT (Internet/DNS)"
echo ""
echo "Règles appliquées (DENY) :"
echo "  • SSH 22/tcp FROM prod (185.103.166.119) — BLOCKED"
echo "  • SSH 22/tcp FROM pre-prod (185.103.166.112) — BLOCKED"
echo "  • SSH 22/tcp FROM s3 (80.96.58.164) — BLOCKED"
echo "  • All other INPUT/FORWARD — default DROP"