#!/bin/bash

cat <<EOT >> /opt/proxy.sh
#!/bin/bash
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
EOT

chmod +x /opt/proxy.sh
echo /opt/proxy.sh >> /etc/rc.d/rc.local
chmod +x /etc/rc.d/rc.local

echo > /etc/firewalld/zones/internal.xml
cat <<EOT > /etc/firewalld/zones/internal.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Internal</short>
  <port port="8085" protocol="tcp"/>
  <port port="1999" protocol="tcp"/>
  <port port="9101" protocol="tcp"/>
  <port port="9090" protocol="tcp"/>
  <port port="5000" protocol="tcp"/>
  <port port="22" protocol="tcp"/>
  <interface name="ens192"/>
</zone>
EOT
echo > /etc/firewalld/zones/public.xml
cat <<EOT > /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="ssh"/>
  <port port="8085" protocol="tcp"/>
  <port port="1999" protocol="tcp"/>
  <port port="10000" protocol="tcp"/>
  <port port="5622" protocol="tcp"/>
  <port port="6661-6668" protocol="tcp"/>
  <port port="9101" protocol="tcp"/> 
  <port port="9090" protocol="tcp"/>
  <port port="5000" protocol="tcp"/>
  <masquerade/>
</zone>
EOT

firewall-cmd --permanent --direct --add-chain ipv4 mangle DIVERT
firewall-cmd --permanent --direct --add-rule ipv4 mangle PREROUTING 0 -p tcp -m socket -j DIVERT
firewall-cmd --permanent --direct --add-rule ipv4 mangle DIVERT 0 -j MARK --set-mark 1
firewall-cmd --permanent --direct --add-rule ipv4 mangle DIVERT 1 -j ACCEPT
#firewall-cmd --permanent --zone=public --remove-interface=ens192
#firewall-cmd --permanent --zone=internal --add-interface=ens192
firewall-cmd --reload
