#!/usr/bin/env bash

set -eo pipefail

SSH="-p tcp -m tcp --dport 22 -j ACCEPT"


alias iptables='iptables -n -w'
alias ip6tables='ip6tables -n -w'


insert_rule() {
    if ! iptables -t "${1}" -C "${2}" ${3} &> /dev/null; then
        iptables -t "${1}" -I "${2}" ${3}
    fi
    if ! ip6tables -t "${1}" -C "${2}" ${3} &> /dev/null; then
        ip6tables -t "${1}" -I "${2}" ${3}
    fi
}

remove_rule() {
    if iptables -t "${1}" -C "${2}" ${3} &> /dev/null; then
        iptables -t "${1}" -D "${2}" ${3}
    fi
    if ip6tables -t "${1}" -C "${2}" ${3} &> /dev/null; then
        ip6tables -t "${1}" -D "${2}" ${3}
    fi
}


case "${1}" in
    "")
        insert_rule nat PREROUTING "${SSH}"
        insert_rule filter INPUT "${SSH}"
        ;;
    off)
        remove_rule nat PREROUTING "${SSH}"
        remove_rule filter INPUT "${SSH}"
        ;;
    *)
        echo "Bypass the 22/TCP (SSH) port block during client IP blacklisting"
        echo "usage: service $(basename $(dirname $0)) $(basename $0) [off]"
        ;;
esac

