#!/bin/bash
# ═══════════════════════════════════════════════════════════════════
# Firewall VPS VPN Server (WireGuard) — vpn-uber (45.150.111.158)
# Allow: WireGuard (51820/udp), SSH (22/tcp), Beszel agent (10001/tcp from VPN)
# Reject: tout le reste
# NAT: masquerade pour routage VPN
# ═══════════════════════════════════════════════════════════════════

set -e

echo "[*] Configurant firewall VPS VPN Server..."

# Flush des règles existantes
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X

# Politique par défaut
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

# ─── INPUT ────────────────────────────────────────────────────────
# Loopback
iptables -A INPUT -i lo -j ACCEPT

# Established/Related
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# SSH (administration)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# WireGuard
iptables -A INPUT -p udp --dport 51820 -j ACCEPT

# Beszel Agent (10001/tcp) — accessible depuis VPN uniquement
iptables -A INPUT -p tcp --dport 10001 -s 10.0.0.0/24 -j ACCEPT

# ICMP (ping, MTU discovery)
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

# Reject le reste
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

# ─── FORWARD ──────────────────────────────────────────────────────
# VPN ↔ Internet
iptables -A FORWARD -i wg0 -j ACCEPT
iptables -A FORWARD -o wg0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# ─── NAT ──────────────────────────────────────────────────────────
# Masquerade pour routage VPN
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# ─── Sauvegarder ──────────────────────────────────────────────────
mkdir -p /etc/iptables
iptables-save > /etc/iptables/rules.v4

# ─── IP Forwarding ────────────────────────────────────────────────
sysctl -w net.ipv4.ip_forward=1
grep -q "net.ipv4.ip_forward" /etc/sysctl.conf || echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

echo "[✓] Firewall VPS VPN Server configuré"
echo ""
echo "Règles appliquées (ALLOW) :"
echo "  • SSH 22/tcp — administration"
echo "  • WireGuard 51820/udp — VPN peers"
echo "  • Beszel Agent 10001/tcp FROM 10.0.0.0/24 — monitoring dashboard"
echo "  • ICMP (ping, MTU discovery)"
echo ""
echo "Configuration :"
echo "  • FORWARD ACCEPT (VPN ↔ Internet routing)"
echo "  • NAT masquerade activé (eth0)"
echo "  • IP forwarding activé (net.ipv4.ip_forward=1)"
echo "  • Default INPUT policy: DROP"