#!/bin/bash

# 刪除 MySQL 轉發規則 (192.168.42.123 已不存在)

ROUTER_IP="192.168.42.10"
ROUTER_USER="root"

echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "🗑️  刪除 MySQL 轉發規則工具"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "目標規則："
echo "  - TCP 13306 → 192.168.42.123:3306"
echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""

# 方式一：使用 UCI 刪除設定（推薦）
echo "方式一：使用 UCI 指令刪除設定"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "執行以下指令："
echo ""
echo "  # 找出 MySQL forwarding 規則的索引"
echo "  ssh ${ROUTER_USER}@${ROUTER_IP} \"uci show firewall | grep 13306\""
echo ""
echo "  # 刪除該規則 (假設是 @forwarding[12])"
echo "  ssh ${ROUTER_USER}@${ROUTER_IP} \"uci delete firewall.\$(uci show firewall | grep -B1 '13306' | head -1 | sed 's/firewall\.//;s/=.*//')\""
echo ""
echo "  # 或直接刪除包含 13306 的規則"
ssh ${ROUTER_USER}@${ROUTER_IP} "
idx=\$(uci show firewall | grep 13306 | head -1 | sed 's/firewall\.//;s/=.*//')
if [ -n \"\$idx\" ]; then
  echo \"找到規則: \$idx\"
  uci delete firewall.\$idx
  uci commit firewall
  echo \"✓ 已刪除並提交設定\"
else
  echo \"⚠ 找不到包含 13306 的規則\"
fi
"

echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "方式二：直接編輯設定檔"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "手動編輯 /etc/config/firewall："
echo ""
echo "  ssh ${ROUTER_USER}@${ROUTER_IP}"
echo "  vi /etc/config/firewall"
echo ""
echo "找到並刪除類似以下的 config forwarding 區塊："
echo ""
echo "  config redirect"
echo "      option name 'MySQL_Forward'"
echo "      option src 'wan'"
echo "      option src_dport '13306'"
echo "      option dest 'lan'"
echo "      option dest_ip '192.168.42.123'"
echo "      option dest_port '3306'"
echo ""
echo "以及 reflection 規則："
echo ""
echo "  config redirect"
echo "      option name 'MySQL_Forward (reflection)'"
echo "      option src 'lan'"
echo "      option src_dport '13306'"
echo "      option src_ip '192.168.42.0/24'"
echo "      option src_dip '125.229.110.50'"
echo "      option dest 'lan'"
echo "      option dest_ip '192.168.42.123'"
echo "      option dest_port '3306'"
echo ""

echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "重載防火牆"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "修改完成後執行："
echo ""
echo "  ssh ${ROUTER_USER}@${ROUTER_IP} \"fw4 restart\""
echo ""
echo "或："
echo ""
echo "  ssh ${ROUTER_USER}@${ROUTER_IP} \"/etc/init.d/firewall restart\""
echo ""

echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "驗證規則已刪除"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "執行："
echo ""
echo "  ssh ${ROUTER_USER}@${ROUTER_IP} \"nft list chain inet fw4 dstnat_wan | grep 13306\""
echo ""
echo "如果沒有輸出，表示規則已成功刪除。"
echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"