#!/bin/sh

. /lib/functions.sh


delete_firewall()
{
	while [ true ];do
		[ ! -f /var/run/fw3.lock ] && break
		sleep 1
	done
	touch /var/run/fw3.lock

	iptables -t mangle  -D PREROUTING -j VPN_SER_POLICY
	iptables -t mangle  -F VPN_SER_POLICY
	iptables -t mangle  -X VPN_SER_POLICY

	rm /var/run/fw3.lock
}

make_firewall()
{
	while [ true ];do
		[ ! -f /var/run/fw3.lock ] && break
		sleep 1
	done
	touch /var/run/fw3.lock

	iptables -t mangle -N VPN_SER_POLICY
	iptables -t mangle -A PREROUTING -j VPN_SER_POLICY

	rm /var/run/fw3.lock
}

set_vpn_server_policy_firewall()
{
	local wgserver_disable="$(uci -q get network.wgserver.disabled)"
	local ovpnserver_disable="$(uci -q get network.ovpnserver.disabled)"

	local vpn_server_policy_wan="$(uci -q get vpnpolicy.global.vpn_server_policy)"

	#echo "===> call set_vpn_server_policy_firewall"

	if [ "${vpn_server_policy_wan}" == "1" ];then
		#vpn server through wan
		while [ true ];do
			[ ! -f /var/run/fw3.lock ] && break
			sleep 1
		done
		touch /var/run/fw3.lock

		if [ "${wgserver_disable}" == "0" ];then

				iptables -t mangle -I VPN_SER_POLICY -i wgserver  -j MARK --set-mark 0x80000/0x80000


				iptables -t mangle -I VPN_SER_POLICY -i wgserver -p tcp --dport 53  -j MARK --set-mark 0x100000/0x100000
				iptables -t mangle -I VPN_SER_POLICY -i wgserver -p udp --dport 53  -j MARK --set-mark 0x100000/0x100000
				iptables -t mangle -A VPN_SER_POLICY -i wgserver -j CONNMARK --save-mark --nfmask 0x1c0000 --ctmask 0x1c0000
		fi


		if [ "${ovpnserver_disable}" == "0" ];then

				iptables -t mangle -I VPN_SER_POLICY -i ovpnserver  -j MARK --set-mark 0x80000/0x80000

				iptables -t mangle -I VPN_SER_POLICY -i ovpnserver -p tcp --dport 53  -j MARK --set-mark 0x100000/0x100000
				iptables -t mangle -I VPN_SER_POLICY -i ovpnserver -p udp --dport 53  -j MARK --set-mark 0x100000/0x100000
				iptables -t mangle -A VPN_SER_POLICY -i ovpnserver -j CONNMARK --save-mark --nfmask 0x1c0000 --ctmask 0x1c0000
		fi

		rm /var/run/fw3.lock

	fi

	#vpn server not through wan, in the firewall clear VPN_SER_POLICY

}



#call func
delete_firewall
make_firewall
set_vpn_server_policy_firewall



