define netif = enp0s3
define lanif = enp0s8
define dmzif = enp0s9

define netip = 192.168.0.130
define lanip = 172.16.0.254
define dmzip = 172.17.0.254

define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254

table ip ipfilter {
    chain prerouting {
        type filter hook prerouting priority filter; policy drop;
        ct state established,related accept
        tcp dport 22 accept
        icmp type echo-request iif $lanif accept
        icmp type echo-reply iif {$lanif, $dmzif} accept
    }
    chain system_in {
        type filter hook input priority filter; policy drop;
        ct state established,related accept
        tcp dport 22 accept
        icmp type echo-request iif $lanif accept
        icmp type echo-reply accept
        udp sport 53 accept  # Ajout pour les réponses DNS
    }
    chain routing {
        type filter hook forward priority filter; policy drop;
        icmp type echo-request iif $lanif oif $dmzif accept
        icmp type echo-reply iif $dmzif oif $lanif accept
        udp sport 53 accept  # Ajout pour les réponses DNS
    }
    chain system_out {
        type filter hook output priority filter; policy drop;
        tcp sport 22 accept
        udp dport 53 accept
        tcp dport {80, 443} accept
        tcp dport {20, 21} accept
        tcp dport 8080 accept
        icmp type echo-request accept
        icmp type echo-reply oif $lanif accept
    }
    chain postrouting {
        type filter hook postrouting priority filter; policy drop;
        tcp sport 22 accept
        udp dport 53 accept
        tcp sport {80, 443} accept
        tcp sport {20, 21} accept
        tcp dport 8080 accept
        icmp type echo-request oif {$lanif, $dmzif} accept
        icmp type echo-reply oif $lanif accept
    }
}