#!/bin/bash

echo "🧹 清除所有規則並重設策略..."
iptables -F
iptables -t nat -F
iptables -X

# 設定預設策略
# iptables -P INPUT DROP
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
# iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

echo "✅ 設定 INPUT 安全規則..."

# 允許已建立與相關的連線（像是回應封包）
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow established/related"

# 允許 loopback
iptables -A INPUT -i lo -j ACCEPT -m comment --comment "Allow loopback"

# 允許 ICMP (ping)
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT -m comment --comment "Allow ping"

# 允許 SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT -m comment --comment "Allow SSH"

# 可選：允許 HTTP/HTTPS（如果有 Web 應用）
iptables -A INPUT -p tcp --dport 80 -j ACCEPT -m comment --comment "Allow HTTP"
iptables -A INPUT -p tcp --dport 443 -j ACCEPT -m comment --comment "Allow HTTPS"

echo "🔧 設定 Tailscale 出口 NAT（MASQUERADE）"
iptables -t nat -A POSTROUTING -s 100.64.0.0/10 -o eth0 -j MASQUERADE -m comment --comment "Tailscale NAT"

echo "🔧 允許 Tailscale → LAN 轉送"
iptables -A FORWARD -i tailscale0 -o eth0 -j ACCEPT -m comment --comment "Tailscale → LAN"
iptables -A FORWARD -i eth0 -o tailscale0 -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment "LAN → Tailscale return"

echo "📦 儲存規則（iptables-persistent）"
iptables-save > /etc/iptables/rules.v4

echo "✅ 防火牆與 NAT 重設完成！"