#!/usr/bin/env bash
set -euo pipefail

/usr/sbin/ip netns del r3 2>/dev/null || true
/usr/sbin/ip netns del outpost 2>/dev/null || true
/usr/sbin/ip netns del dmz 2>/dev/null || true
/usr/sbin/ip link del tun0 2>/dev/null || true
/usr/sbin/ip link del dmz0 2>/dev/null || true
/usr/sbin/ip link del r3-lan0 2>/dev/null || true

/usr/sbin/ip netns add r3
/usr/sbin/ip netns add outpost
/usr/sbin/ip netns add dmz

/usr/sbin/ip link add tun0 type veth peer name r3-tun
/usr/sbin/ip link set r3-tun netns r3
/usr/sbin/ip addr add 10.8.0.1/30 dev tun0
/usr/sbin/ip link set tun0 up
/usr/sbin/ip link set lo up

/usr/sbin/ip link add dmz0 type veth peer name dmz-eth
/usr/sbin/ip link set dmz-eth netns dmz
/usr/sbin/ip addr add 192.168.30.1/24 dev dmz0
/usr/sbin/ip link set dmz0 up

/usr/sbin/ip link add r3-lan0 type veth peer name outpost-eth
/usr/sbin/ip link set r3-lan0 netns r3
/usr/sbin/ip link set outpost-eth netns outpost

/usr/sbin/ip -n r3 link set lo up
/usr/sbin/ip -n r3 addr add 10.8.0.2/30 dev r3-tun
/usr/sbin/ip -n r3 link set r3-tun up
/usr/sbin/ip -n r3 addr add 192.168.40.1/24 dev r3-lan0
/usr/sbin/ip -n r3 link set r3-lan0 up
/usr/sbin/ip -n r3 route add 192.168.30.0/24 via 10.8.0.1 dev r3-tun
/usr/sbin/ip netns exec r3 sysctl -w net.ipv4.ip_forward=1 >/dev/null

/usr/sbin/ip -n outpost link set lo up
/usr/sbin/ip -n outpost addr add 192.168.40.10/24 dev outpost-eth
/usr/sbin/ip -n outpost link set outpost-eth up
/usr/sbin/ip -n outpost route add default via 192.168.40.1

/usr/sbin/ip -n dmz link set lo up
/usr/sbin/ip -n dmz addr add 192.168.30.10/24 dev dmz-eth
/usr/sbin/ip -n dmz addr add 192.168.30.20/24 dev dmz-eth
/usr/sbin/ip -n dmz link set dmz-eth up
/usr/sbin/ip -n dmz route add default via 192.168.30.1

/usr/sbin/ip route add 192.168.40.0/24 via 10.8.0.2 dev tun0
sysctl -w net.ipv4.ip_forward=1 >/dev/null

/usr/sbin/iptables-legacy -t filter -F
/usr/sbin/iptables-legacy -t filter -X
/usr/sbin/iptables-legacy -t nat -F
/usr/sbin/iptables-legacy -t nat -X
/usr/sbin/iptables-legacy -t raw -F
/usr/sbin/iptables-legacy -t raw -X
/usr/sbin/iptables-legacy -t mangle -F
/usr/sbin/iptables-legacy -t mangle -X

/usr/sbin/iptables-legacy -t filter -P INPUT ACCEPT
/usr/sbin/iptables-legacy -t filter -P OUTPUT ACCEPT
/usr/sbin/iptables-legacy -t filter -P FORWARD DROP
/usr/sbin/iptables-legacy -t filter -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

/usr/sbin/ip netns exec dmz python3 /opt/router/server_services.py >/var/log/server_services.log 2>&1 &
python3 /opt/router/router_api.py >/var/log/router_api.log 2>&1 &

cat >/etc/issue.net <<'BANNER'
network-11 проверка iptables

Топология:
форпост (192.168.40.10) -> R3 -> VPN (tun0) -> R2 -> DMZ (192.168.30.10, 192.168.30.20)

Задача:
- разрешить только 192.168.40.0/24 -> 192.168.30.10:22/tcp по пути через VPN
- остальной новый трафик из сети форпоста в DMZ должен оставаться заблокированным

Базовое состояние firewall:
- FORWARD policy DROP
- ESTABLISHED,RELATED уже разрешен
- маршрутизация VPN уже преднастроена

После настройки firewall запусти:
  python3 /opt/router/check_rule.py
BANNER

exec /usr/sbin/sshd -D -e
