#!/bin/bash

# 检查是否具有 root 权限
if [ "$EUID" -ne 0 ]; then
    echo "请使用 sudo 运行此脚本"
    exit 1
fi

# 显示帮助信息
show_help() {
    echo "用法:"
    echo "  $0 list                     # 显示所有端口转发规则"
    echo "  $0 add tcp|udp 本地端口 目标IP 目标端口  # 添加转发规则"
    echo "  $0 del tcp|udp 本地端口     # 删除转发规则"
    echo ""
    echo "示例:"
    echo "  $0 add tcp 8080 192.168.1.100 80"
    echo "  $0 del tcp 8080"
}

# 列出当前转发规则
list_forwards() {
    # 获取 PREROUTING 规则
    rules=$(iptables -t nat -L PREROUTING -n --line-numbers | grep "dpt:" | grep "to:")

    if [ -z "$rules" ]; then
        echo "当前没有端口转发规则"
        return
    fi

    echo "当前端口转发规则列表："
    echo "----------------------------------------"

    while IFS= read -r line; do
        # 提取规则信息
        protocol=$(echo "$line" | grep -o 'tcp\|udp' | tr '[:lower:]' '[:upper:]')
        local_port=$(echo "$line" | grep -o 'dpt:[0-9]*' | cut -d':' -f2)
        target=$(echo "$line" | grep -o 'to:[0-9.]*:[0-9]*' | cut -d':' -f2,3)

        if [ ! -z "$protocol" ] && [ ! -z "$local_port" ] && [ ! -z "$target" ]; then
            target_ip=$(echo "$target" | cut -d':' -f1)
            target_port=$(echo "$target" | cut -d':' -f2)
            echo "[$protocol] 本地端口: $local_port 转发目标: $target_ip:$target_port"
        fi
    done <<< "$rules"
}

# 检查转发规则是否已存在
check_forward_exists() {
    local proto=$1
    local port=$2

    iptables -t nat -L PREROUTING -n | grep "dpt:$port" | grep -q "$proto"
    return $?
}

# 添加转发规则
add_forward() {
    local proto=$1
    local local_port=$2
    local target_ip=$3
    local target_port=$4

    # 验证参数
    if [[ ! "$proto" =~ ^(tcp|udp)$ ]]; then
        echo "错误: 协议必须是 tcp 或 udp"
        return 1
    fi

    if [[ ! "$local_port" =~ ^[0-9]+$ ]] || [ "$local_port" -lt 1 ] || [ "$local_port" -gt 65535 ]; then
        echo "错误: 无效的端口号 $local_port"
        return 1
    fi

    if [[ ! "$target_ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
        echo "错误: 无效的 IP 地址 $target_ip"
        return 1
    fi

    if [[ ! "$target_port" =~ ^[0-9]+$ ]] || [ "$target_port" -lt 1 ] || [ "$target_port" -gt 65535 ]; then
        echo "错误: 无效的目标端口号 $target_port"
        return 1
    fi

    # 检查规则是否已存在
    if check_forward_exists "$proto" "$local_port"; then
        echo "${proto^^} $local_port 已经有转发规则了"
        return 1
    fi

    # 添加转发规则
    iptables -t nat -A PREROUTING -p "$proto" --dport "$local_port" -j DNAT --to-destination "$target_ip:$target_port"
    iptables -t nat -A POSTROUTING -p "$proto" -d "$target_ip" --dport "$target_port" -j MASQUERADE

    if [ $? -eq 0 ]; then
        echo "添加完成"
    else
        echo "添加失败"
        return 1
    fi
}

# 删除转发规则
del_forward() {
    local proto=$1
    local port=$2

    # 验证参数
    if [[ ! "$proto" =~ ^(tcp|udp)$ ]]; then
        echo "错误: 协议必须是 tcp 或 udp"
        return 1
    fi

    if [[ ! "$port" =~ ^[0-9]+$ ]] || [ "$port" -lt 1 ] || [ "$port" -gt 65535 ]; then
        echo "错误: 无效的端口号 $port"
        return 1
    fi

    # 检查规则是否存在
    if ! check_forward_exists "$proto" "$port"; then
        echo "未找到 ${proto^^} 端口 $port 的转发规则"
        return 1
    fi

    # 获取目标地址信息用于删除 POSTROUTING 规则
    target_info=$(iptables -t nat -L PREROUTING -n | grep "dpt:$port" | grep "$proto")
    target_ip=$(echo "$target_info" | grep -o 'to:[0-9.]*:[0-9]*' | cut -d':' -f2)
    target_port=$(echo "$target_info" | grep -o 'to:[0-9.]*:[0-9]*' | cut -d':' -f3)

    # 删除规则
    iptables -t nat -D PREROUTING -p "$proto" --dport "$port" -j DNAT --to-destination "$target_ip:$target_port" 2>/dev/null
    iptables -t nat -D POSTROUTING -p "$proto" -d "$target_ip" --dport "$target_port" -j MASQUERADE 2>/dev/null

    if [ $? -eq 0 ]; then
        echo "删除完成"
    else
        echo "删除失败"
        return 1
    fi
}

# 主程序
case "$1" in
    list)
        list_forwards
        ;;
    add)
        if [ $# -ne 5 ]; then
            echo "错误: add 命令需要4个参数"
            show_help
            exit 1
        fi
        add_forward "$2" "$3" "$4" "$5"
        ;;
    del)
        if [ $# -ne 3 ]; then
            echo "错误: del 命令需要2个参数"
            show_help
            exit 1
        fi
        del_forward "$2" "$3"
        ;;
    *)
        show_help
        exit 1
        ;;
esac

exit 0