# configuration
TAPDEV=tap0

# figure local settings
eval $(/usr/bin/netparam)

case $1 in
start)

# Allow outgoing traffic via default route in LAN
iptables -I OUTPUT -s $LANADR -o $LANDEV -j ACCEPT
iptables -I INPUT -d $LANADR -i $LANDEV -m state --state RELATED,ESTABLISHED -j ACCEPT

# Allow all traffic through the tunnel
iptables -I OUTPUT -o $TAPDEV -j ACCEPT
iptables -I INPUT -i $TAPDEV -j ACCEPT
iptables -I FORWARD -o $TAPDEV -j ACCEPT
iptables -I FORWARD -i $TAPDEV -j ACCEPT

# Masquerade LAN traffic through the tunnel
iptables -t nat -A POSTROUTING -o $TAPDEV -s $LANNET/$LANPRE -j MASQUERADE
iptables -I FORWARD -i $LANDEV -o $TAPDEV -j ACCEPT
iptables -I FORWARD -i $TAPDEV -o $LANDEV -j ACCEPT

# tor + privoxy Forwarding
iptables -t nat -A PREROUTING -i $WIFIDEV -s $WIFINET/$WIFIPRE -d $WIFIADR -p tcp --dport 9050 -j DNAT --to 192.168.0.1
iptables -t nat -A POSTROUTING -o $TAPDEV -d 192.168.0.1 -p tcp --dport 9050 -j MASQUERADE
iptables -I FORWARD -d 192.168.0.1 -p tcp --dport 9050 -j ACCEPT 
iptables -t nat -A PREROUTING -i $WIFIDEV -s $WIFINET/$WIFIPRE -d $WIFIADR -p tcp --dport 8118 -j DNAT --to 192.168.0.1
iptables -t nat -A POSTROUTING -o $TAPDEV -d 192.168.0.1 -p tcp --dport 8118 -j MASQUERADE
iptables -I FORWARD -d 192.168.0.1 -p tcp --dport 8118 -j ACCEPT
;;
stop)

iptables -D OUTPUT -s $LANADR -o $LANDEV -j ACCEPT
iptables -D INPUT -d $LANADR -i $LANDEV -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -D OUTPUT -o $TAPDEV -j ACCEPT
iptables -D INPUT -i $TAPDEV -j ACCEPT
iptables -D FORWARD -o $TAPDEV -j ACCEPT
iptables -D FORWARD -i $TAPDEV -j ACCEPT

iptables -t nat -D POSTROUTING -o $TAPDEV -s $LANNET/$LANPRE -j MASQUERADE
iptables -D FORWARD -i $LANDEV -o $TAPDEV -j ACCEPT
iptables -D FORWARD -i $TAPDEV -o $LANDEV -j ACCEPT

iptables -t nat -D PREROUTING -i $WIFIDEV -s $WIFINET/$WIFIPRE -d $WIFIADR -p tcp --dport 9050 -j DNAT --to 192.168.0.1
iptables -t nat -D POSTROUTING -o $TAPDEV -d 192.168.0.1 -p tcp --dport 9050 -j MASQUERADE
iptables -D FORWARD -d 192.168.0.1 -p tcp --dport 9050 -j ACCEPT
iptables -t nat -D PREROUTING -i $WIFIDEV -s $WIFINET/$WIFIPRE -d $WIFIADR -p tcp --dport 8118 -j DNAT --to 192.168.0.1
iptables -t nat -D POSTROUTING -o $TAPDEV -d 192.168.0.1 -p tcp --dport 8118 -j MASQUERADE
iptables -D FORWARD -d 192.168.0.1 -p tcp --dport 8118 -j ACCEPT
;;
esac