#!/usr/bin/lua

dofile("/data/config.lua")
 -- correct some config Settings
if(config.struct_Box.struct_DChannel[1]==nil)then
    local t = {}
    t = config.struct_Box.struct_DChannel
    config.struct_Box.struct_DChannel = nil
    config.struct_Box.struct_DChannel = {}
    config.struct_Box.struct_DChannel[1]=t
    for k,v in ipairs(config.struct_Box.struct_DChannel) do
        if(config.struct_Box.struct_DChannel[k].struct_GateParams ~= nil) then
            if(config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTable ~= nil) then
                if(config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTable[1] == nil) then
                    t = config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTable
                    config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTable = nil
                    config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTable = {}
                    config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTable[1]=t
                end
            end
            if(config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTableOut ~= nil) then
                if(config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTableOut[1] == nil) then
                    t = config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTableOut
                    config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTableOut = nil
                    config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTableOut = {}
                    config.struct_Box.struct_DChannel[k].struct_GateParams.struct_CallProcTableOut[1]=t
                end
            end
        end
    end
end

ip="/sbin/iptables "
ip6="/sbin/ip6tables "

local f
if io ~= nil and io.open ~= nil then
    f = io.open("/data/ipconfig.lua","r")
end
if f then
    io.close(f)
    dofile("/data/ipconfig.lua")

    --flush
    os.execute(ip .. "-F")
    os.execute(ip .. "-X")
    os.execute(ip .. "-Z")
    os.execute(ip .. "-t nat -F")

    --set default policies
    os.execute(ip .. "-P INPUT DROP")
    os.execute(ip .. "-P OUTPUT DROP")
    os.execute(ip .. "-P FORWARD DROP")

    --keep established connections
    os.execute(ip .. "-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT")
    --allow loopback
    os.execute(ip .. "-A INPUT -i lo -j ACCEPT")
    --allow outbound traffic
    os.execute(ip .. "-A OUTPUT -j ACCEPT")

    --allow certain inbound connections
    for k,v in pairs(my_ip_address_table) do
        local src
        local additional

        src=nil
        additional=nil

        if v.src then
            src=" -s " .. v.src
        end

        if v.additional then
            additional=" " .. v.additional
        end

        if v.tlsSip then
            os.execute(ip .. "-A INPUT -d " .. v.ip .. " -p tcp --dport " .. config.struct_Box.string_SipTlsBindPort .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.tcpSip then
            os.execute(ip .. "-A INPUT -d " .. v.ip .. " -p tcp --dport " .. config.struct_Box.string_SipBindPort .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.udpSip then
            os.execute(ip .. "-A INPUT -d " .. v.ip .. " -p udp --dport " .. config.struct_Box.string_SipBindPort .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.tlsSip or v.tcpSip or v.udpSip then 
            os.execute(ip .. "-A INPUT -d " .. v.ip .. " -p udp --dport " .. "7004:7124" .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.website then
            os.execute(ip .. "-A INPUT -d " .. v.ip .. " -p udp --dport " .. "80" .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.messagingServer then
            os.execute(ip .. "-A INPUT -d " .. v.ip .. " -p tcp --dport " .. "3217:3233" .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.snfs or v.management or v.messagingServer then
            os.execute(ip .. "-A INPUT -d " .. v.ip .. " -p tcp --dport " .. "3215" .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.license or v.management or v.messagingServer then
            os.execute(ip .. "-A INPUT -d " .. v.ip .. " -p tcp --dport " .. "3214" .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.management then
            --Allows SSH connections (only 16 attempts by an IP every 1 minute, drop the rest)
            os.execute(ip .. "-A INPUT -d " .. v.ip .. " -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource" .. (src or "") .. (additional or ""))
            os.execute(ip .. "-A INPUT -d " .. v.ip .. " -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 16 --name DEFAULT --rsource -j DROP" .. (src or "") .. (additional or ""))
            os.execute(ip .. "-A INPUT -d " .. v.ip .. " -p tcp -m state --state NEW --dport 22 -j ACCEPT" .. (src or "") .. (additional or ""))
        end
    end
    --Allow ping
    os.execute(ip .. "-A INPUT -p icmp -m icmp --icmp-type 58 -j ACCEPT")
    -- Reject all other inbound - default deny unless explicitly allowed policy
    os.execute(ip .. "-A INPUT -j DROP")
    os.execute(ip .. "-A FORWARD -j DROP")


    --flush
    os.execute(ip6 .. "-F")
    os.execute(ip6 .. "-X")
    os.execute(ip6 .. "-Z")

    --set default policies
    os.execute(ip6 .. "-P INPUT DROP")
    os.execute(ip6 .. "-P OUTPUT DROP")
    os.execute(ip6 .. "-P FORWARD DROP")

    --keep established connections
    os.execute(ip6 .. "-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT")
    --allow loopback
    os.execute(ip6 .. "-A INPUT -i lo -j ACCEPT")
    --allow outbound traffic
    os.execute(ip6 .. "-A OUTPUT -j ACCEPT")

    for k,v in pairs(my_ip_address6_table) do
        local src
        local additional

        src=nil
        additional=nil

        if v.src then
            src=" -s " .. v.src
        end

        if v.additional then
            additional=" " .. v.additional
        end

        if v.tlsSip then
            os.execute(ip6 .. "-A INPUT -d " .. v.ip .. " -p tcp --dport " .. config.struct_Box.string_SipTlsBindPort .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.tcpSip then
            os.execute(ip6 .. "-A INPUT -d " .. v.ip .. " -p tcp --dport " .. config.struct_Box.string_SipBindPort .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.udpSip then
            os.execute(ip6 .. "-A INPUT -d " .. v.ip .. " -p udp --dport " .. config.struct_Box.string_SipBindPort .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.tlsSip or v.tcpSip or v.udpSip then 
            os.execute(ip6 .. "-A INPUT -d " .. v.ip .. " -p udp --dport " .. "7004:7124" .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.website then
            os.execute(ip6 .. "-A INPUT -d " .. v.ip .. " -p udp --dport " .. "80" .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.messagingServer then
            os.execute(ip6 .. "-A INPUT -d " .. v.ip .. " -p tcp --dport " .. "3217:3233" .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.snfs or v.management or v.messagingServer then
            os.execute(ip6 .. "-A INPUT -d " .. v.ip .. " -p tcp --dport " .. "3215" .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.license or v.management or v.messagingServer then
            os.execute(ip6 .. "-A INPUT -d " .. v.ip .. " -p tcp --dport " .. "3214" .. " -j ACCEPT" .. (src or "") .. (additional or ""))
        end

        if v.management then
            --Allows SSH connections (only 16 attempts by an IP every 1 minute, drop the rest)
            os.execute(ip6 .. "-A INPUT -d " .. v.ip .. " -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource" .. (src or "") .. (additional or ""))
            os.execute(ip6 .. "-A INPUT -d " .. v.ip .. " -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 16 --name DEFAULT --rsource -j DROP" .. (src or "") .. (additional or ""))
            os.execute(ip6 .. "-A INPUT -d " .. v.ip .. " -p tcp -m state --state NEW --dport 22 -j ACCEPT" .. (src or "") .. (additional or ""))
        end
    end

    --Allow ping
    os.execute(ip6 .. "-A INPUT -p icmpv6 -m ipv6-icmp --icmpv6-type 58 -j ACCEPT")
    -- Reject all other inbound - default deny unless explicitly allowed policy
    os.execute(ip6 .. "-A INPUT -j DROP")
    os.execute(ip6 .. "-A FORWARD -j DROP")
end
