#!/bin/sh

set -eu

apply_ipv4() {
  iptables -P INPUT DROP
  iptables -P FORWARD DROP
  iptables -P OUTPUT ACCEPT
  iptables -F
  iptables -A INPUT -i lo -j ACCEPT
  iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  iptables -A INPUT -p udp --sport 67 --dport 68 -j ACCEPT
  iptables -A INPUT -p icmp -j ACCEPT
}

apply_ipv6() {
  ip6tables -P INPUT DROP
  ip6tables -P FORWARD DROP
  ip6tables -P OUTPUT ACCEPT
  ip6tables -F
  ip6tables -A INPUT -i lo -j ACCEPT
  ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  ip6tables -A INPUT -p ipv6-icmp -j ACCEPT
  ip6tables -A INPUT -p udp --sport 547 --dport 546 -j ACCEPT
}

clear_ipv4() {
  iptables -P INPUT ACCEPT
  iptables -P FORWARD ACCEPT
  iptables -P OUTPUT ACCEPT
  iptables -F
}

clear_ipv6() {
  ip6tables -P INPUT ACCEPT
  ip6tables -P FORWARD ACCEPT
  ip6tables -P OUTPUT ACCEPT
  ip6tables -F
}

case "${1:-start}" in
  start)
    command -v iptables >/dev/null 2>&1 && apply_ipv4
    command -v ip6tables >/dev/null 2>&1 && apply_ipv6
    ;;
  stop)
    command -v iptables >/dev/null 2>&1 && clear_ipv4
    command -v ip6tables >/dev/null 2>&1 && clear_ipv6
    ;;
  *)
    echo "usage: $0 {start|stop}" >&2
    exit 2
    ;;
esac
