#!/bin/bash
# =====================================================================
# VM LOCAL FIREWALL & PORT REDIRECTION SCRIPT
# VM IP: 172.16.9.10 | Internal Interface: eth0 (or similar)
# Redirects inbound 80/443 to non-root Caddy on 8080/8443
# =====================================================================

# 1. CLEAN SLATE
# Flush all rules and delete custom chains across filter and NAT tables
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -F
iptables -X
iptables -t nat -X

# 2. LOCAL PORT REDIRECTION (Caddy Non-Root Helper)
# ---------------------------------------------------------------------
# A. Inbound traffic coming from outside the VM (e.g., forwarded from Proxmox)
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443

# B. Local traffic generated inside the VM aimed strictly at localhost/127.0.0.1
# Note: By specifying '-o lo', you leave your outbound internet (GitHub, Google) untouched!
iptables -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -A OUTPUT -o lo -p tcp --dport 443 -j REDIRECT --to-ports 8443

# 3. VM INPUT FIREWALL RULES
# ---------------------------------------------------------------------
# Allow everything on loopback
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections (allows responses to your outbound traffic like curl)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH (Port 22) - Important for your Proxmox port forward (22910 -> 22)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow the actual redirected Caddy ports from outside (just in case)
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j ACCEPT

# Allow alternative app ports (like the 8000 you have forwarded in Proxmox)
iptables -A INPUT -p tcp --dport 8000 -j ACCEPT

# 4. GLOBAL SECURITY DROP RULE
# Drop all other unsolicited inbound traffic targeting this VM
iptables -A INPUT -j DROP

echo "VM Firewall and Caddy Redirection Applied Successfully."