PRIVATE_SUBNET="10.200.100.0/24"

# Reset/Flush iptables
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT


# Make sure ip forwarding is enabled
sysctl -w net.ipv4.ip_forward=1

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow already established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow managment IPs this server via SSH (port 22) over ens192
iptables -A INPUT -i ens192 -p tcp -s x.x.x.x.x/26 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
# Allow Wireguard connections in from anywhere because we don't necessarily know who our peers are in advance
iptables -A INPUT -i ens192 -p udp --dport 51822 -j ACCEPT


# Mark packets coming in from wg0. Example 1.1.1.1.1. no need to mark 10.200.100.0/24 since it will
# already return through wg0. We just want to mark traffic that would otherwise go out the wrong interface
# This works but I haven't gotten the ip routing rules working with it yet
#iptables -t mangle -A PREROUTING -i wg0 -p tcp --dport 4444 -j LOG --log-level 4 --log-prefix "MARKING PKT WITH 4444: "
#iptables -t mangle -A PREROUTING -i wg0 -p tcp --dport 4444 -j MARK --set-mark 4

# Allow traffic coming down from the VPS' into this server on port 4444. 4444 is for testing
# but the production goal is to push ALL traffic from the VPS down.
iptables -A INPUT -i wg0 -p tcp --dport 4444 -j LOG --log-prefix "ALLOWING INPUT 4444: " --log-level 4
iptables -A INPUT -i wg0 -p tcp --dport 4444 -j ACCEPT


# For now allow anything into wg0 and log for debugging
#iptables -A INPUT -i wg0 -j LOG --log-prefix "IPTABLES-ALLOW-WG0-IN: " --log-level 4
iptables -A INPUT -i wg0 -j ACCEPT

# Be explicit allowing forwarded established connections
iptables -A FORWARD -i ens192 -o wg0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i wg0 -o ens192 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ens192 -o wg0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i wg0 -o ens192 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT


# Explicitly allow everything out wg0. this isn't necessary as the default OUTPUT rule is ALLOW
#iptables -A OUTPUT -o wg0 -j LOG --log-prefix "IPTABLES-wg0-OUTPUT ALLOW: " --log-level 4
iptables -A OUTPUT -o wg0 -j ACCEPT
iptables -A OUTPUT -o ens192 -j ACCEPT


iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A INPUT -j DROP
iptables -A OUTPUT -j LOG
iptables -A OUTPUT -o wg0 -j ACCEPT
iptables -A FORWARD -j LOG
iptables -t nat -A PREROUTING -j LOG
iptables -t nat -A POSTROUTING -j LOG
iptables -A LOGGING -m limit --limit 20/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP