---

# ======= [МОДУЛЬ 1] ISP (Маршрутизатор провайдера - ALT Linux) =======
# Задания 1, 2, 11:
# - Интерфейс к магистральному провайдеру (ens18) по DHCP
# - Интерфейс к HQ-RTR (ens19): 192.168.1.1/28 (сеть 192.168.1.0/28)
# - Интерфейс к BR-RTR (ens20): 192.168.2.1/28 (сеть 192.168.2.0/28)
# - Динамическая трансляция портов (NAT/PAT) для доступа в Интернет HQ-RTR и BR-RTR
# - Часовой пояс (Europe/Moscow)

hostnamectl set-hostname isp
sed -i "s/^HOSTNAME=.*/HOSTNAME=isp/" /etc/sysconfig/network 2>/dev/null || echo "HOSTNAME=isp" > /etc/sysconfig/network

mkdir -p /etc/net/ifaces/{ens18,ens19,ens20}
cat << 'EOF' > /etc/net/ifaces/ens18/options
TYPE=eth
BOOTPROTO=dhcp
ONBOOT=yes
CONFIG_IPV4=yes
EOF

cat << 'EOF' > /etc/net/ifaces/ens19/options
TYPE=eth
BOOTPROTO=static
ONBOOT=yes
CONFIG_IPV4=yes
EOF
echo '192.168.1.1/28' > /etc/net/ifaces/ens19/ipv4address

cat << 'EOF' > /etc/net/ifaces/ens20/options
TYPE=eth
BOOTPROTO=static
ONBOOT=yes
CONFIG_IPV4=yes
EOF
echo '192.168.2.1/28' > /etc/net/ifaces/ens20/ipv4address

systemctl restart network

sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/net/sysctl.conf
sysctl -p /etc/net/sysctl.conf

apt-get update && apt-get install -y iptables nftables tzdata
timedatectl set-timezone Europe/Moscow

# Динамическая трансляция портов (PAT / Masquerade)
iptables -t nat -F
iptables -t nat -A POSTROUTING -s 192.168.1.0/28 -o ens18 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.2.0/28 -o ens18 -j MASQUERADE
iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE
iptables-save > /etc/sysconfig/iptables
systemctl enable --now iptables

# ======= [МОДУЛЬ 2] ISP: Служба сетевого времени Chrony (Пункт 4) =======
# - Вышестоящий NTP сервер: ntp0.ntp-servers.net
# - Стратум сервера: 5
# - Разрешено обслуживание клиентов HQ-SRV, HQ-CLI, BR-RTR, BR-SRV

apt-get update && apt-get install -y chrony

cat << 'EOF' > /etc/chrony.conf
server ntp0.ntp-servers.net iburst prefer
pool pool.ntp.org iburst
local stratum 5
allow 0.0.0.0/0
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
logdir /var/log/chrony
EOF

systemctl enable --now chronyd
systemctl restart chronyd
chronyc tracking
chronyc sources -v


# ======= [МОДУЛЬ 1] HQ-RTR (Маршрутизатор HQ - ALT Linux) =======
# Задания 1, 2, 3, 4, 6, 7, 8, 9, 11

hostnamectl set-hostname hq-rtr.au-team.irpo
sed -i "s/^HOSTNAME=.*/HOSTNAME=hq-rtr.au-team.irpo/" /etc/sysconfig/network 2>/dev/null || echo "HOSTNAME=hq-rtr.au-team.irpo" > /etc/sysconfig/network

useradd -m -s /bin/bash net_admin 2>/dev/null || true
echo "net_admin:P@ssw0rd" | chpasswd
usermod -aG wheel net_admin
echo "net_admin ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/net_admin
chmod 440 /etc/sudoers.d/net_admin

mkdir -p /etc/net/ifaces/{ens18,ens19,ens19.100,ens19.200,ens19.999,gre1}
cat << 'EOF' > /etc/net/ifaces/ens18/options
BOOTPROTO=static
TYPE=eth
ONBOOT=yes
EOF
echo '192.168.1.2/28' > /etc/net/ifaces/ens18/ipv4address
echo 'default via 192.168.1.1' > /etc/net/ifaces/ens18/ipv4route
echo -e "nameserver 192.168.100.2
nameserver 77.88.8.7" > /etc/net/ifaces/ens18/resolv.conf

cat << 'EOF' > /etc/net/ifaces/ens19/options
BOOTPROTO=static
TYPE=eth
ONBOOT=yes
EOF

cat << 'EOF' > /etc/net/ifaces/ens19.100/options
BOOTPROTO=static
TYPE=vlan
VID=100
HOST=ens19
ONBOOT=yes
EOF
echo '192.168.100.1/27' > /etc/net/ifaces/ens19.100/ipv4address

cat << 'EOF' > /etc/net/ifaces/ens19.200/options
BOOTPROTO=static
TYPE=vlan
VID=200
HOST=ens19
ONBOOT=yes
EOF
echo '192.168.200.1/28' > /etc/net/ifaces/ens19.200/ipv4address

cat << 'EOF' > /etc/net/ifaces/ens19.999/options
BOOTPROTO=static
TYPE=vlan
VID=999
HOST=ens19
ONBOOT=yes
EOF
echo '192.168.99.1/29' > /etc/net/ifaces/ens19.999/ipv4address

cat << 'EOF' > /etc/net/ifaces/gre1/options
TYPE=iptun
TUNTYPE=gre
TUNLOCAL=192.168.1.2
TUNREMOTE=192.168.2.2
TUNTTL=64
TUNOPTIONS='ttl 64'
ONBOOT=yes
EOF
echo "192.168.10.1/30" > /etc/net/ifaces/gre1/ipv4address

apt-get update && apt-get install -y sudo nftables iptables tzdata frr dhcp-server
timedatectl set-timezone Europe/Moscow

sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/net/sysctl.conf
sysctl -p /etc/net/sysctl.conf

cat << 'EOF' > /etc/nftables/nftables.nft
#!/usr/sbin/nft -f
flush ruleset
table ip nat {
    chain postrouting {
        type nat hook postrouting priority srcnat;
        oifname "ens18" masquerade
    }
}
EOF
systemctl enable --now nftables

sed -i 's/ospfd=no/ospfd=yes/' /etc/frr/daemons
cat << 'EOF' > /etc/frr/frr.conf
interface gre1
 ip ospf area 0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 P@ssw0rd
 no ip ospf passive
exit
interface ens19.100
 ip ospf area 0
exit
interface ens19.200
 ip ospf area 0
exit
interface ens19.999
 ip ospf area 0
exit
router ospf
 ospf router-id 192.168.10.1
 passive-interface default
 no passive-interface gre1
exit
EOF
systemctl enable --now frr

cat << 'EOF' > /etc/dhcp/dhcpd.conf
subnet 192.168.200.0 netmask 255.255.255.240 {
    range 192.168.200.2 192.168.200.14;
    option routers 192.168.200.1;
    option domain-name-servers 192.168.100.2, 192.168.4.2;
    option domain-name "au-team.irpo";
    option domain-search "au-team.irpo";
    default-lease-time 600;
    max-lease-time 7200;
}
EOF
sed -i 's/DHCPDARGS=.*/DHCPDARGS=ens19.200/g' /etc/sysconfig/dhcpd
systemctl restart network
systemctl enable --now dhcpd
systemctl restart frr dhcpd

# ======= [МОДУЛЬ 2] HQ-RTR (ALT Linux): Проброс портов DNAT (Пункт 8) =======
# - Порт 8080 (192.168.1.2:8080) -> Веб-приложение HQ-SRV (192.168.100.2:80)
# - Порт 2027 (192.168.1.2:2027) -> SSH HQ-SRV (192.168.100.2:2027)

cat << 'EOF' > /etc/nftables/nftables.nft
#!/usr/sbin/nft -f
flush ruleset
table ip nat {
    chain prerouting {
        type nat hook prerouting priority dstnat;
        ip daddr 192.168.1.2 tcp dport 8080 dnat to 192.168.100.2:80
        ip daddr 192.168.1.2 tcp dport 2027 dnat to 192.168.100.2:2027
    }
    chain postrouting {
        type nat hook postrouting priority srcnat;
        oifname "ens18" masquerade
    }
}
EOF
systemctl enable --now nftables
systemctl restart nftables
nft list ruleset

# ======= [МОДУЛЬ 1] BR-RTR (Маршрутизатор филиала BR - ALT Linux) =======
# Задания 1, 2, 3, 6, 7, 8, 11

hostnamectl set-hostname br-rtr.au-team.irpo
sed -i "s/^HOSTNAME=.*/HOSTNAME=br-rtr.au-team.irpo/" /etc/sysconfig/network 2>/dev/null || echo "HOSTNAME=br-rtr.au-team.irpo" > /etc/sysconfig/network

useradd -m -s /bin/bash net_admin 2>/dev/null || true
echo "net_admin:P@ssw0rd" | chpasswd
usermod -aG wheel net_admin
echo "net_admin ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/net_admin
chmod 440 /etc/sudoers.d/net_admin

mkdir -p /etc/net/ifaces/{ens18,ens19,gre1}
cat << 'EOF' > /etc/net/ifaces/ens18/options
BOOTPROTO=static
TYPE=eth
ONBOOT=yes
EOF
echo '192.168.2.2/28' > /etc/net/ifaces/ens18/ipv4address
echo 'default via 192.168.2.1' > /etc/net/ifaces/ens18/ipv4route
echo -e "nameserver 192.168.100.2
nameserver 77.88.8.7" > /etc/net/ifaces/ens18/resolv.conf

cat << 'EOF' > /etc/net/ifaces/ens19/options
BOOTPROTO=static
TYPE=eth
ONBOOT=yes
EOF
echo '192.168.3.1/30' > /etc/net/ifaces/ens19/ipv4address

cat << 'EOF' > /etc/net/ifaces/gre1/options
TYPE=iptun
TUNTYPE=gre
TUNLOCAL=192.168.2.2
TUNREMOTE=192.168.1.2
TUNTTL=64
TUNOPTIONS='ttl 64'
ONBOOT=yes
EOF
echo "192.168.10.2/30" > /etc/net/ifaces/gre1/ipv4address

apt-get update && apt-get install -y sudo nftables iptables tzdata frr
timedatectl set-timezone Europe/Moscow

sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/net/sysctl.conf
sysctl -p /etc/net/sysctl.conf

cat << 'EOF' > /etc/nftables/nftables.nft
#!/usr/sbin/nft -f
flush ruleset
table ip nat {
    chain postrouting {
        type nat hook postrouting priority srcnat;
        oifname "ens18" masquerade
    }
}
EOF
systemctl enable --now nftables

sed -i 's/ospfd=no/ospfd=yes/' /etc/frr/daemons
cat << 'EOF' > /etc/frr/frr.conf
interface gre1
 ip ospf area 0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 P@ssw0rd
 no ip ospf passive
exit
interface ens19
 ip ospf area 0
 no ip ospf passive
exit
router ospf
 ospf router-id 192.168.10.2
 passive-interface default
 no passive-interface gre1
 no passive-interface ens19
exit
EOF

systemctl restart network
systemctl enable --now frr
systemctl restart frr

# ======= [МОДУЛЬ 2] BR-RTR (ALT Linux): Chrony NTP (Пункт 4) и Проброс портов DNAT (Пункт 8) =======

# 1. Клиент сетевого времени Chrony (сервер ISP: 192.168.2.1, Пункт 4)
apt-get update && apt-get install -y chrony
sed -i 's/^pool /#pool /g; s/^server /#server /g' /etc/chrony.conf
echo "server 192.168.2.1 iburst prefer" >> /etc/chrony.conf
systemctl enable --now chronyd
systemctl restart chronyd
chronyc sources -v

# 2. Статическая трансляция портов DNAT (Пункт 8):
# - Порт 8080 (192.168.2.2:8080) -> Приложение testapp BR-SRV (192.168.4.2:8080)
# - Порт 2027 (192.168.2.2:2027) -> SSH BR-SRV (192.168.4.2:2027)
cat << 'EOF' > /etc/nftables/nftables.nft
#!/usr/sbin/nft -f
flush ruleset
table ip nat {
    chain prerouting {
        type nat hook prerouting priority dstnat;
        ip daddr 192.168.2.2 tcp dport 8080 dnat to 192.168.4.2:8080
        ip daddr 192.168.2.2 tcp dport 2027 dnat to 192.168.4.2:2027
    }
    chain postrouting {
        type nat hook postrouting priority srcnat;
        oifname "ens18" masquerade
    }
}
EOF
systemctl enable --now nftables
systemctl restart nftables
nft list ruleset