#!/usr/bin/env bash
set -euo pipefail

/usr/sbin/ip netns del allowed 2>/dev/null || true
/usr/sbin/ip netns del denied 2>/dev/null || true
/usr/sbin/ip netns del server 2>/dev/null || true
/usr/sbin/ip link del br-public 2>/dev/null || true
/usr/sbin/ip link del fw-lan 2>/dev/null || true
/usr/sbin/ip link del pub-allowed 2>/dev/null || true
/usr/sbin/ip link del pub-denied 2>/dev/null || true

/usr/sbin/ip netns add allowed
/usr/sbin/ip netns add denied
/usr/sbin/ip netns add server

/usr/sbin/ip link add br-public type bridge
/usr/sbin/ip addr add 203.0.113.2/24 dev br-public
/usr/sbin/ip link set br-public up
/usr/sbin/ip link set lo up

/usr/sbin/ip link add pub-allowed type veth peer name allowed-eth
/usr/sbin/ip link add pub-denied type veth peer name denied-eth
/usr/sbin/ip link set allowed-eth netns allowed
/usr/sbin/ip link set denied-eth netns denied
/usr/sbin/ip link set pub-allowed master br-public
/usr/sbin/ip link set pub-denied master br-public
/usr/sbin/ip link set pub-allowed up
/usr/sbin/ip link set pub-denied up

/usr/sbin/ip -n allowed link set lo up
/usr/sbin/ip -n allowed addr add 203.0.113.6/24 dev allowed-eth
/usr/sbin/ip -n allowed link set allowed-eth up
/usr/sbin/ip -n allowed route add default via 203.0.113.2

/usr/sbin/ip -n denied link set lo up
/usr/sbin/ip -n denied addr add 203.0.113.7/24 dev denied-eth
/usr/sbin/ip -n denied link set denied-eth up
/usr/sbin/ip -n denied route add default via 203.0.113.2

/usr/sbin/ip link add fw-lan type veth peer name server-eth
/usr/sbin/ip link set server-eth netns server
/usr/sbin/ip addr add 192.168.10.1/24 dev fw-lan
/usr/sbin/ip link set fw-lan up

/usr/sbin/ip -n server link set lo up
/usr/sbin/ip -n server addr add 192.168.10.10/24 dev server-eth
/usr/sbin/ip -n server link set server-eth up
/usr/sbin/ip -n server route add default via 192.168.10.1

sysctl -w net.ipv4.ip_forward=1 >/dev/null

/usr/sbin/iptables-legacy -t filter -F
/usr/sbin/iptables-legacy -t filter -X
/usr/sbin/iptables-legacy -t nat -F
/usr/sbin/iptables-legacy -t nat -X
/usr/sbin/iptables-legacy -t raw -F
/usr/sbin/iptables-legacy -t raw -X
/usr/sbin/iptables-legacy -t mangle -F
/usr/sbin/iptables-legacy -t mangle -X

/usr/sbin/iptables-legacy -t filter -P INPUT ACCEPT
/usr/sbin/iptables-legacy -t filter -P OUTPUT ACCEPT
/usr/sbin/iptables-legacy -t filter -P FORWARD DROP
/usr/sbin/iptables-legacy -t filter -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/iptables-legacy -t filter -A FORWARD -p tcp -s 203.0.113.6/32 -d 192.168.10.10 --dport 443 -m conntrack --ctstate NEW -j ACCEPT

/usr/sbin/ip netns exec server python3 /opt/router/server_services.py >/var/log/server_services.log 2>&1 &
python3 /opt/router/router_api.py >/var/log/router_api.log 2>&1 &

cat >/etc/issue.net <<'BANNER'
network-10 проверка iptables

Топология:
разрешенный источник (203.0.113.6) и запрещенный источник (203.0.113.7) -> R3 (203.0.113.2) -> SRV1 (192.168.10.10)

Задача:
- опубликовать HTTPS SRV1 через 203.0.113.2:443
- разрешить только источник 203.0.113.6/32
- остальные новые подключения к 203.0.113.2:443 должны оставаться заблокированными

Базовое состояние firewall:
- FORWARD policy DROP
- ESTABLISHED,RELATED уже разрешен
- перенаправление к 192.168.10.10:443 от 203.0.113.6 уже преднастроено
- тебе нужно добавить правило DNAT

После настройки firewall запусти:
  python3 /opt/router/check_rule.py
BANNER

exec /usr/sbin/sshd -D -e
