###############################
####### SEGURANÇA REFORÇADA #######
###############################

#iptables -F
#iptables -X
#iptables -t nat -F
#iptables -t nat -X

# Proteção básica contra SYN Flood
iptables -N SYN_FLOOD
iptables -A SYN_FLOOD -m limit --limit 10/sec --limit-burst 24 -j RETURN
iptables -A SYN_FLOOD -j LOG --log-prefix "SYN Flood: "
iptables -A SYN_FLOOD -j DROP
iptables -A INPUT -p tcp --syn -j SYN_FLOOD

# Proteção contra port scanners (detecção de tentativas de conexão em portas fechadas)
iptables -N PORTSCAN
iptables -A PORTSCAN -m recent --set --name PORTSCAN
iptables -A PORTSCAN -j DROP
iptables -A INPUT -m recent --update --seconds 60 --hitcount 1 --name PORTSCAN -j DROP

# Bloqueio de IPs suspeitos após 5 tentativas de conexão inválidas
iptables -N BAD_PACKETS
iptables -A BAD_PACKETS -m recent --set --name BAD_IPS
#iptables -A BAD_PACKETS -m recent --update --seconds 300 --hitcount 5 --name BAD_IPS -j LOG --log-prefix "IP Bloqueado: "
iptables -A BAD_PACKETS -m recent --update --seconds 300 --hitcount 5 --name BAD_IPS -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j BAD_PACKETS    # Pacotes inválidos
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j BAD_PACKETS  # NULL packets

# Rate limiting para prevenção de brute force (exemplo para SSH - ajuste a porta)
iptables -A INPUT -p tcp --dport 8117 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 8117 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --name SSH -j DROP

###############################
####### OTIMIZAÇÃO DE PERFORMANCE #######
###############################

# Ordenação estratégica das regras (mais usadas primeiro)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT  # Mover para início

# Agrupamento de portas com multiport
iptables -A INPUT -i enp0s6 -p tcp -m multiport --dports 80,443,8117 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp -m multiport --dports 32100,32400 -j ACCEPT

# Compactação de regras NAT
iptables -t nat -A PREROUTING -i enp0s6 -p tcp -m multiport --dports 80,443 -j DNAT --to-destination 10.15.0.45

###############################
####### AJUSTES DE SISTEMA #######
###############################

# Melhor tratamento de pacotes fragmentados
iptables -A INPUT -f -j DROP

# Prevenção de spoofing
#iptables -A INPUT -s 10.0.0.0/8 -j DROP
#iptables -A INPUT -s 172.16.0.0/12 -j DROP
iptables -A INPUT -s 192.168.0.0/16 -j DROP

# Logging de tráfego bloqueado (use com moderação)
#iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4

###############################
####### POLÍTICAS SEGURAS #######
###############################

# Política mais restritiva para FORWARD
iptables -P FORWARD ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

iptables -I INPUT -i wg0 -j ACCEPT
iptables -I FORWARD -i wg0 -j ACCEPT


# Limpar todas as regras IPv6
ip6tables -F
ip6tables -X
ip6tables -t mangle -F
ip6tables -t mangle -X
ip6tables -t nat -F
ip6tables -t nat -X

# Definir políticas padrão
ip6tables -P INPUT DROP
ip6tables -P FORWARD ACCEPT
ip6tables -P OUTPUT ACCEPT

# Habilitar redirecionamento IPv6
echo 1 > /proc/sys/net/ipv6/conf/all/forwarding

# --- REGRAS BÁSICAS ---
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Permitir ICMPv6 (essencial para funcionamento do IPv6)
ip6tables -A INPUT -p ipv6-icmp -j ACCEPT

# Portas abertas (ajuste a interface)
ip6tables -A INPUT -i enp0s6 -p udp --dport 32100 -j ACCEPT
ip6tables -A INPUT -i enp0s6 -p udp --dport 32400 -j ACCEPT
ip6tables -A INPUT -i enp0s6 -p tcp --dport 8117 -j ACCEPT
ip6tables -A INPUT -i enp0s6 -p tcp --dport 80 -j ACCEPT
ip6tables -A INPUT -i enp0s6 -p tcp --dport 443 -j ACCEPT

# WireGuard
ip6tables -A INPUT -i wg0 -j ACCEPT
ip6tables -A FORWARD -i wg0 -j ACCEPT

# --- NAT IPv6 ---
ip6tables -t nat -A POSTROUTING -s 2001:db8:15::/48 -j MASQUERADE

# --- REGRAS DE SEGURANÇA ---
# Proteção contra SYN Flood (mesma configuração)
ip6tables -N SYN_FLOOD
ip6tables -A SYN_FLOOD -m limit --limit 10/sec --limit-burst 24 -j RETURN
#ip6tables -A SYN_FLOOD -j LOG --log-prefix "IPv6 SYN Flood: "
ip6tables -A SYN_FLOOD -j DROP
ip6tables -A INPUT -p tcp --syn -j SYN_FLOOD

# Prevenção de port scanners
ip6tables -N PORTSCAN
ip6tables -A PORTSCAN -m recent --set --name PORTSCAN6
ip6tables -A PORTSCAN -j DROP
ip6tables -A INPUT -m recent --update --seconds 60 --hitcount 1 --name PORTSCAN6 -j DROP

# Bloqueio de IPs suspeitos
ip6tables -N BAD_PACKETS
ip6tables -A BAD_PACKETS -m recent --set --name BAD_IPS6
#ip6tables -A BAD_PACKETS -m recent --update --seconds 300 --hitcount 5 --name BAD_IPS6 -j LOG --log-prefix "IPv6 IP Bloqueado: "
ip6tables -A BAD_PACKETS -m recent --update --seconds 300 --hitcount 5 --name BAD_IPS6 -j DROP
ip6tables -A INPUT -p tcp --tcp-flags ALL ALL -j BAD_PACKETS
ip6tables -A INPUT -p tcp --tcp-flags ALL NONE -j BAD_PACKETS

# Rate limiting SSH
ip6tables -A INPUT -p tcp --dport 8117 -m state --state NEW -m recent --set --name SSH6
ip6tables -A INPUT -p tcp --dport 8117 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --name SSH6 -j DROP

# --- OTIMIZAÇÕES ---
ip6tables -A INPUT -i enp0s6 -p tcp -m multiport --dports 80,443,8117 -j ACCEPT
ip6tables -A INPUT -i enp0s6 -p udp -m multiport --dports 32100,32400 -j ACCEPT

# --- AJUSTES IPv6 ESPECÍFICOS ---
# Bloquear pacotes IPv6 inválidos
ip6tables -A INPUT -m rpfilter --validmark -j ACCEPT
ip6tables -A INPUT -j DROP

# Prevenção de spoofing IPv6
ip6tables -A INPUT -s fe80::/10 -i enp0s6 -j DROP                  # Bloqueia link-local na WAN
ip6tables -A INPUT -s fd00::/8 -i enp0s6 -j DROP                  # Bloqueia ULA na WAN
ip6tables -A INPUT -d ff00::/8 -j DROP                            # Bloqueia multicast

# --- LOGGING ---
#ip6tables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "IPv6 Dropped: " --log-level 4


ip6tables -A INPUT -p ipv6-icmp -j ACCEPT  # Permite vizinhação, descoberta de roteador, etc.
ip6tables -A INPUT -m rpfilter --validmark -j ACCEPT  # Reverse Path Filtering

###############################
####### TUNING DE KERNEL #######
###############################

# Otimização de parâmetros de rede
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "net.ipv4.tcp_max_syn_backlog = 2048" >> /etc/sysctl.conf
echo "net.ipv4.tcp_synack_retries = 3" >> /etc/sysctl.conf
sysctl -p

# Criação da cadeia ICMPv4
iptables -N ICMPv4

# Permitir Echo Reply (tipo 0) sem limitação
iptables -A ICMPv4 -p icmp --icmp-type 0 -j ACCEPT

# Limitar Echo Request (tipo 8) para 1/s com burst de 3
iptables -A ICMPv4 -p icmp --icmp-type 8 -m limit --limit 1/s --limit-burst 3 -j ACCEPT

# Bloquear e registrar excesso de Echo Request
#iptables -A ICMPv4 -p icmp --icmp-type 8 -j LOG --log-prefix "Ping flood bloqueado: "
iptables -A ICMPv4 -p icmp --icmp-type 8 -j DROP

# Bloquear todos os outros tipos de ICMP
iptables -A ICMPv4 -p icmp -j DROP

# Aplicar cadeia ICMPv4 à entrada
iptables -A INPUT -p icmp -j ICMPv4


# Criação da cadeia ICMPv6
ip6tables -N ICMPv6

# Tipos essenciais para funcionamento básico (permitir sem limitação)
ip6tables -A ICMPv6 -p ipv6-icmp --icmpv6-type 1 -j ACCEPT   # Destino inalcançável
ip6tables -A ICMPv6 -p ipv6-icmp --icmpv6-type 128 -m limit --limit 1/s --limit-burst 3 -j ACCEPT  # Echo Request
ip6tables -A ICMPv6 -p ipv6-icmp --icmpv6-type 129 -j ACCEPT  # Echo Reply
ip6tables -A ICMPv6 -p ipv6-icmp --icmpv6-type 133/135/136 -j ACCEPT  # Descoberta de vizinhança

# Limitar outros tipos importantes
ip6tables -A ICMPv6 -p ipv6-icmp --icmpv6-type 2 -m limit --limit 5/min -j ACCEPT   # Packet Too Big
ip6tables -A ICMPv6 -p ipv6-icmp --icmpv6-type 3 -m limit --limit 5/min -j ACCEPT   # Time Exceeded

# Bloquear e registrar excesso de Echo Request
#ip6tables -A ICMPv6 -p ipv6-icmp --icmpv6-type 128 -j LOG --log-prefix "Ping6 flood bloqueado: "
ip6tables -A ICMPv6 -p ipv6-icmp --icmpv6-type 128 -j DROP

# Bloquear todos os outros tipos
ip6tables -A ICMPv6 -p ipv6-icmp -j DROP

# Aplicar cadeia ICMPv6 à entrada
ip6tables -A INPUT -p ipv6-icmp -j ICMPv6