define netif = enp0s3
define lanif = enp0s8
define dmzif = enp0s9

define netip = 192.168.0.160
define dmzip = 172.17.0.254
define lanip = 172.16.0.254

define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254

define internal-dns-ip = 172.16.0.2
define dns-forwarder-ip = 10.121.38.7

table ip ipfilter{
	chain prerouting {
                type filter hook prerouting priority filter; policy drop;
				ct state established,related accept
					#SSH
		tcp dport 22 accept
					#Requêtes HTTP/HTTPS depuis LAN
		tcp dport {80,443} iif $lanif accept
					#Requêtes externe du serveur DNS
		ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
					#Pings
		icmp type echo-request iif $lanif accept
		icmp type echo-reply iif {$lanif, $dmzif} accept
        }

	chain system_in {
                type filter hook input priority filter; policy drop;
			#Communication déjà établies
		ct state established,related accept
			#SSH
		tcp dport 22 accept
			#Pings
		icmp type echo-request iif $lanif accept
		icmp type echo-reply accept
        }

 	chain routing {
                type filter hook forward priority filter; policy drop;
			#Communication déjà établies
		ct state established,related accept
			#Requêtes HTTP/HTTPS depuis LAN
		tcp dport {80,443} iif $lanif accept
					#Requêtes externe du serveur DNS
		ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
					#Pings
		icmp type echo-request iif $lanif oif $dmzif accept
		icmp type echo-reply iif $dmzif oif $lanif accept
        }

 	chain system_out {
                type filter hook output priority filter; policy drop;
				ct state established,related accept
		tcp dport 8080 accept		#Proxy du lycee
		tcp sport 22 accept 		#SSH
		tcp dport {20,21} accept	#FTP
		udp dport 53 accept			#DNS
		tcp dport {80,443} accept	#HTTP,HTTPS
		icmp type echo-request accept
		icmp type echo-request oif $lanif accept
        }

	chain postrouting {
                type filter hook postrouting priority filter; policy drop;
				ct state established,related accept
		tcp dport 8080 accept		#Proxy du lycee
		tcp sport 22 accept 		#SSH
		tcp dport {20,21} accept	#FTP
		udp dport 53 accept			#DNS
		tcp dport {80, 443} accept	#HTTP,HTTPS
		icmp type echo-request oif {$lanif, $dmzif} accept
		icmp type echo-reply oif $lanif accept
					#Requêtes externe du serveur DNS
		ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
        }
		
	chain nat_prerouting {
				type nat hook prerouting priority filter; policy accept
	}

	chain nat_postrouting {
		type nat hook postrouting priority filter; policy accept;
				#Masquage des IP de la LAN sortant sur Internet
			ip saddr $lan-ntw oif $netif snat $netip
	}
}