#!/bin/sh

. /lib/functions/network.sh

iptables_insert() {
	local chain="$1"
	local position="$2"
	shift 2

	local line="$(
		iptables -t "filter" --line-numbers -n -L "$chain" \
		| wc \
		| awk '{print $1 - 2}'
	)"

	[[ "$position" -lt 0 ]] && position=$(( line + 1 + position + 1 ))

	[[ "$position" -lt 1 ]] && position=1
	[[ "$position" -gt "$(( line + 1 ))" ]] && position="$(( line + 1 ))"

	iptables -t "filter" -I "$chain" $position $@
}

iptables_check_and_insert() {
	local chain="$1"
	local position="$2"
	shift 2

	iptables -t "filter" -C "$chain" $@ 2>/dev/null \
	|| iptables_insert "$chain" "$position" $@
}

main() {
	iptables -t "filter" -N "MNH" 2>/dev/null

	network_find_wan wan_iface
	network_get_device wan_device "$wan_iface"
	wan_zone=$(fw3 -q device "$wan_device")
	
	# before REJECT
	iptables_check_and_insert "zone_${wan_zone}_input" -2 -j MNH
}

main