#!/bin/bash
IPTABLES=/usr/sbin/iptables
#wan="eth0"
#lan="eth1"
#LANIF=`route -n | gawk '/172.18.96/{ print $8 }'`
#WANIF=`route -n | gawk '/UG/{ print $8 }'`
LANIF=`cat /etc/sysconfig/xs_lan_device`
WANIF=`cat /etc/sysconfig/xs_wan_device`

if [  "x$WANIF" == "x" ]; then
    exit 1
fi
if [  "x$LANIF" == "x" ]; then
    exit 1
fi
	lan=$LANIF
	wan=$WANIF
echo "Lan is $lan and WAN is $wan"
#
# delete all existing rules.
#
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -X
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_nat
# Always accept loopback traffic
$IPTABLES -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -m state --state NEW -i  $lan -j ACCEPT

if [ -f /etc/sysconfig/xs_httpcache_on -o -f /etc/sysconfig/olpc-scripts/setup.d/installed/gateway ] ; then
    $IPTABLES -A INPUT -p tcp --dport ssh -m state --state NEW -i $wan -j ACCEPT
fi

if [ -f /etc/sysconfig/olpc-scripts/setup.d/installed/gateway ] ; then
    $IPTABLES -A POSTROUTING -t nat -o $wan -j MASQUERADE
    $IPTABLES -A FORWARD -i $wan -o $lan -m state --state ESTABLISHED,RELATED -j ACCEPT

    # Allow outgoing connections from the LAN side.
    $IPTABLES -A FORWARD -i $lan -o $wan -j ACCEPT

    # Don't forward from the outside to the inside.
    $IPTABLES -A FORWARD -i $wan -o $lan -j DROP
    $IPTABLES -A INPUT -i $wan -j DROP
fi
if [ -f /etc/sysconfig/xs_httpcache_on ]; then
    $IPTABLES  -t nat  -A PREROUTING -i $lan -p tcp --dport 80 ! -d 172.18.96.1 -j DNAT --to 172.18.96.1:3128
fi

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward
exit 0
