#!/bin/sh

# iss noch nicht fertig,
# lasst es mal hier

UNI_NET="141.54.0.0/16"		# SCC weimar
UNI_PROXY_IP="141.54.1.2"
UNI_PROXY_PORT="8080"
FW_MARK="0x23"

case "$1" in
	start)
		iptables -t mangle -I FORWARD -p tcp -s 192.168.1.0/24 ! -d 192.168.1.0/24 --dport 80 -j MARK --set-mark $FW_MARK
		iptables -t mangle -I FORWARD -s 192.168.1.0/24 -d $UNI_NET -j ACCEPT

		iptables -t nat -I PREROUTING -p tcp -m mark --mark $FW_MARK/0xff -j DNAT --to-destination $UNI_PROXY_IP:$UNI_PROXY_PORT
		iptables -t nat -I POSTROUTING -d $UNI_PROXY_IP -j MASQUERADE
	;;
	stop)
		iptables -t nat -D POSTROUTING -d $UNI_PROXY_IP -j MASQUERADE
		iptables -t nat -D PREROUTING -p tcp -m mark --mark $FW_MARK/0xff -j DNAT --to-destination $UNI_PROXY_IP:$UNI_PROXY_PORT

		iptables -t mangle -D FORWARD -s 192.168.1.0/24 -d $UNI_NET -j ACCEPT
		iptables -t mangle -D FORWARD -p tcp -s 192.168.1.0/24 ! -d 192.168.1.0/24 --dport 80 -j MARK --set-mark $FW_MARK
	;;
	list)
		echo "[mangle]"
		iptables -t mangle -nxvL FORWARD 1
		iptables -t mangle -nxvL FORWARD 2
		echo "[nat-pre]"
		iptables -t nat -nxvL PREROUTING 1
		echo "[net-post]"
		iptables -t nat -nxvL POSTROUTING 1
	;;
	*)
		echo "Usage: $0 <start|stop|list>"
	;;
esac

