#!/bin/sh

#Reset firewall
/sbin/iptables -t nat -F
/sbin/iptables -t mangle -F
/sbin/iptables -F
/sbin/iptables -X

#Reset IP6
/sbin/ip6tables -t nat -F
/sbin/ip6tables -t mangle -F
/sbin/ip6tables -F
/sbin/ip6tables -X

# Default policy to drop all incoming packets
/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P OUTPUT ACCEPT
/sbin/ip6tables -P INPUT DROP
/sbin/ip6tables -P FORWARD DROP
/sbin/ip6tables -P OUTPUT DROP

# Accept incoming/outgoing packets from localhost
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT

#Allow Plex
/sbin/iptables -A INPUT -p tcp --dport 32400 -j ACCEPT

#Accept local traffic
/sbin/iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
/sbin/iptables -A OUTPUT -d 192.168.1.0/24 -j ACCEPT

#Accept VPN Server traffic
/sbin/iptables -A INPUT -s 192.168.181.0/24 -j ACCEPT
/sbin/iptables -A OUTPUT -d 192.168.181.0/24 -j ACCEPT

# Accept INPUT if initiated the connection
/sbin/iptables -A INPUT -m conntrack \
    --ctstate ESTABLISHED,RELATED -j ACCEPT

# Forward LAN packets to the WAN
/sbin/iptables -A FORWARD -o tun0 -j ACCEPT

# Forward WAN packets to the LAN if the LAN initiated the
# connection
/sbin/iptables -A FORWARD -i tun0 -m conntrack \
    --ctstate ESTABLISHED,RELATED -j ACCEPT

# NAT traffic going out the WAN interface
/sbin/iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE


#Start VPN
cd /firewall/
/usr/sbin/openvpn con.ovpn