#!/bin/bash
set -euo pipefail

MASQ_TARGET_NET4=$(echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network":/ { print $2 }' | sed 's/[",]//g;s/\/[0-9]*//g')
# @WARNING below may not grab public IP of interface
ETH_INTF_IP4=($(ip addr show | grep inet | awk '/enp[0-9]+s[0-9]+|eth[0-9]+$/{print$2}' | sed 's/\/[0-9]*//'))
ETH_INTF=($(ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -E "enp[0-9]+s[0-9]+|eth[0-9]+" | sed 's/://g'))
{% if (vpn.server.forwards is defined and vpn.server.forwards != None) and (vpn.server.forwards | length) > 0 %}
PORT_DESTS=(<% vpn.server.forwards | map('string') | join(" ") %>)
{% endif %}

# sudo sysctl -w net.ipv4.ip_forward=1
# sudo sysctl -w net.ipv4.conf.all.src_valid_mark=1
sudo sysctl -p

if [[ "$1" == "up" ]]; then
    CLIENT_IP4=<% vpn_client_ip.stdout %>
    for portdest in ${PORT_DESTS[@]}; do
        sudo iptables -t nat -A PREROUTING -d <% ipify_public_ip %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP4}:${portdest}"
    done
    sudo iptables -t nat -A POSTROUTING -s <% masq_target_net_ip.stdout %> -j MASQUERADE
elif [[ "$1" == "down" ]]; then
    CLIENT_IP4=<% vpn_client_ip.stdout %>
    for portdest in ${PORT_DESTS[@]}; do
        sudo iptables -t nat -D PREROUTING -d <% ipify_public_ip %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP4}:${portdest}"
    done
    sudo iptables -t nat -D POSTROUTING -s <% masq_target_net_ip.stdout %> -j MASQUERADE
fi