#!/bin/bash
# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
#
# It is highly advisable to create own systemd services or udev rules
# to run scripts during boot instead of using this file.
#
# In contrast to previous versions due to parallel execution during boot
# this script will NOT be run after all other services.
#
# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
# that this script will be executed during boot.
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

iptables -A INPUT -i enp0s6 -p udp --dport 32101 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 32110 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 32100 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 32400 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 8117 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i enp0s6 -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A INPUT -i wg0 -j ACCEPT

# Permitir SIP (UDP/TCP 5060/5061), IAX2 (UDP 4569), RTP (UDP 18000:19000) para FreePBX
iptables -A INPUT -i enp0s6 -p udp --dport 5060 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 5060 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 5061 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 5061 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 5160 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 5161 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 4569 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 18000:19000 -j ACCEPT

# Permitir tráfego de retorno (deve estar antes do DROP final)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A POSTROUTING -s 10.15.0.0/16 -j MASQUERADE
ip6tables -t nat -A POSTROUTING -s 2001:db8:15::/48 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 172.17.0.0/16 -j MASQUERADE


# Habilitar redirecionamento de pacotes no kernel
echo 1 > /proc/sys/net/ipv4/ip_forward
# 1. DNAT APENAS para tráfego entrando na interface enp0s6 (WAN) com destino ao IP público
iptables -t nat -A PREROUTING -i enp0s6 -p tcp --dport 80 -j DNAT --to-destination 10.15.0.45:80
iptables -t nat -A PREROUTING -i enp0s6 -p tcp --dport 443 -j DNAT --to-destination 10.15.0.45:443

# 2. SNAT (Hairpinning) para clientes locais acessarem via IP público
iptables -t nat -A POSTROUTING -o enp0s6 -p tcp -d 10.15.0.45 --dport 80 -j MASQUERADE
iptables -t nat -A POSTROUTING -o enp0s6 -p tcp -d 10.15.0.45 --dport 443 -j MASQUERADE



# Permitir o tráfego na cadeia FORWARD
iptables -A FORWARD -p tcp -d 10.15.0.45 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.15.0.45 --dport 443 -j ACCEPT

sh /root/test.sh


echo deadline > /sys/block/sda/queue/scheduler

touch /var/lock/subsys/local
#echo "bfq" > /sys/block/sda/queue/scheduler
#echo "1500" > /sys/block/sda/queue/iosched/read_expire
echo 64 > /sys/block/sda/queue/max_sectors_kb # Melhor para SSD virtual
echo deadline > /sys/block/sda/queue/scheduler # Alternativa ao BFQ
echo 0 > /proc/sys/vm/zone_reclaim_mode

tc qdisc add dev enp0s6 root cake bandwidth 1000mbit besteffort
tc qdisc add dev wg0 root cake bandwidth 500mbit besteffort dual-dsthost

echo f > /sys/class/net/enp0s6/queues/tx-0/xps_cpus


echo f > /sys/class/net/enp0s6/queues/rx-0/rps_cpus

# XPS para núcleos 4-7 (máscara 0xf0)

# Aumentar buffer de entrada/saída fixo
echo 4096 > /sys/class/net/enp0s6/queues/rx-0/rps_flow_cnt
echo 4096 > /proc/sys/net/core/rps_sock_flow_entries

sh /root/qos.sh

#cd /root/xdp_new && \
cd /home/rodrigo/xdp && \
ip link set enp0s6 mtu 1500
ip link set dev enp0s6 xdp obj xdp_ddos_filter.o sec xdp

sleep 20

ip link set dev br-02f7820020b4 xdp obj bridge_xdp.o sec xdp

ip link delete br-8b341d0f5c20
iptables -t nat -A POSTROUTING -o wg3 -j MASQUERADE