define netif = enp0s3
define lanif = enp0s8
define dmzif = enp0s9
 
define netip = 192.168.0.140
define iplan = 172.16.0.254
define ipdmz = 172.17.0.254

define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254

define internal-dns-ip = 172.16.0.2
define dns-forwarder-ip = 10.121.38.7

table ip ipfilter {
    chain prerouting {
        type filter hook prerouting priority filter; policy drop;
            # Communication déjà établies
        ct state established,related accept
            # SSH
        tcp dport 22 accept
            # requête HTTP et HTTPS depuis LAN
        tcp dport {80,443} iif $lanif accept
            # requête externe du serveur DNS
        ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
            # Pings
        icmp type echo-request iif $lanif accept
        icmp type echo-reply iif {$lanif, $dmzif} accept
    }
	chain system_in {
        type filter hook input priority filter; policy drop;
            # Communication déjà établies
        ct state established,related accept
            # SSH
        tcp dport 22 accept
            # Pings
        icmp type echo-request iif $lanif accept
        icmp type echo-reply accept
    }
 	chain routing {
        type filter hook forward priority filter; policy drop;
            # Communication déjà établies
        ct state established,related accept
            # requête DNS (UDP et TCP)
        udp dport 53 accept
            # requête HTTP et HTTPS depuis LAN
        tcp dport {80,443} iif $lanif accept
            # requête externe du serveur DNS
        ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
            # Pings
        icmp type echo-request iif $lanif oif $dmzif accept
        icmp type echo-reply iif $dmzif oif $lanif accept
    }
 	chain system_out {
        type filter hook output priority filter; policy drop;
            # Communication déjà établies   
        ct state established,related accept 
            # SSH
        tcp sport 22 accept
            # Proxy
        tcp dport 8080 accept
            # requête DNS (UDP et TCP)
        udp dport 53 accept
            # requête HTTP, HTTPS
        tcp dport {80,443} accept
            # requête FTP
        tcp dport {20,21} accept
            # Pings
        icmp type echo-request accept
        icmp type echo-reply oif $lanif accept
            
    }
	chain postrouting {
        type filter hook postrouting priority filter; policy drop;
            # Communication déjà établies   
        ct state established,related accept
            # SSH
        tcp sport 22 accept
            # Proxy
        tcp dport 8080 accept
            # requête DNS (UDP et TCP)
        udp dport 53 accept
            # requête HTTP, HTTPS
        tcp dport {80,443} accept
            # requête FTP
        tcp dport {20,21} accept
            # requête externe du serveur DNS
        ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
            # Pings
        icmp type echo-request oif {$lanif, $dmzif} accept
        icmp type echo-reply oif $lanif accept
    }
    chain nat_prerouting {
        type nat hook prerouting priority filter; policy accept;

    }
    chain nat_postrouting {
        type nat hook postrouting priority filter; policy accept;
        ip saddr $lan-ntw oif $netif snat $netip
    }
}