#!/bin/bash

# Flush current nftables configuration
nft flush ruleset

# Define table and chains
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; }
nft add chain inet filter forward { type filter hook forward priority 0 \; }
nft add chain inet filter output { type filter hook output priority 0 \; policy drop \; }

# Allow all loopback traffic
nft add rule inet filter output oifname "lo" accept

# Essential outbound traffic
# DNS - restrict to your DNS server's IP
nft add rule inet filter output ip daddr x.x.x.x udp dport 53 accept
nft add rule inet filter output ip daddr x.x.x.x tcp dport 53 accept

# HTTP and HTTPS
nft add rule inet filter output tcp dport { 80, 443 } accept

# SMTP - consider limiting to specific mail server IPs
nft add rule inet filter output tcp dport 25 accept

# Allow ICMP (ping)
nft add rule inet filter output icmp type echo-request accept

# Anti-spoofing: block outgoing packets with non-allocated source IP
nft add rule inet filter output oifname "eth0" ip saddr != YOUR.PUBLIC.IP.RANGE counter drop

# Allow outgoing traffic from public IP range (Modify or remove according to your network policy)
nft add rule inet filter output oifname "eth0" ip saddr YOUR.PUBLIC.IP.RANGE accept

# Log other outbound traffic (for auditing purposes)
nft add rule inet filter output log prefix "Dropped Outbound: " drop

echo "Egress filtering rules with nftables applied."

# Define the network interface connected to the Internet
INTERNET_IFACE="eth0"

# Define your public IP range (replace with your actual IP range)
YOUR_PUBLIC_IP_RANGE="YOUR.PUBLIC.IP.RANGE"

# Flush current iptables rules
iptables -F
iptables -t nat -F
iptables -t mangle -F

# Default policies
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT DROP # Default deny for outbound traffic

# Allow essential outbound traffic for specific services by enabling the necessary ports
# Update or add rules as per your organizational needs

# DNS (Allow only to known DNS servers, replace x.x.x.x with your DNS server IP)
iptables -A OUTPUT -p udp --dport 53 -d x.x.x.x -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -d x.x.x.x -j ACCEPT

# HTTP and HTTPS (Consider restricting to known IPs if possible)
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

# SMTP (Consider limiting to mail server IPs)
iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT

# Allow outbound ICMP (ping)
iptables -A OUTPUT -p icmp -j ACCEPT

# Anti-spoofing rule: Block outgoing packets with non-allocated source IP
iptables -A OUTPUT -o $INTERNET_IFACE ! -s $YOUR_PUBLIC_IP_RANGE -j DROP

# Allow all traffic on the loopback interface
iptables -A OUTPUT -o lo -j ACCEPT

# Log and drop other outbound traffic for auditing
iptables -A OUTPUT -j LOG --log-prefix "Dropped Outbound: "
iptables -A OUTPUT -j DROP

echo "Egress filtering rules applied."