#!/bin/bash

# CentOS 7 中国IP访问限制完整脚本
# 包含完整的中国IP段列表

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo -e "${YELLOW}========== CentOS 7 中国IP访问限制配置（完整版） ==========${NC}"

# 检查root权限
if [ "$EUID" -ne 0 ]; then
   echo -e "${RED}错误：请使用root用户运行此脚本${NC}"
   exit 1
fi

# ============ 第一步：安装firewalld ============
echo -e "${YELLOW}========== 第一步：安装firewalld ==========${NC}"

if command -v firewall-cmd &> /dev/null; then
    echo -e "${GREEN}✓ firewalld已安装${NC}"
else
    echo -e "${YELLOW}正在安装firewalld...${NC}"
    yum install -y firewalld
    if [ $? -eq 0 ]; then
        echo -e "${GREEN}✓ firewalld安装成功${NC}"
    else
        echo -e "${RED}✗ firewalld安装失败${NC}"
        exit 1
    fi
fi

# ============ 第二步：启动firewalld ============
echo -e "${YELLOW}========== 第二步：启动firewalld服务 ==========${NC}"

systemctl start firewalld
systemctl enable firewalld

if systemctl is-active --quiet firewalld; then
    echo -e "${GREEN}✓ firewalld已启动并设置为开机自启${NC}"
else
    echo -e "${RED}✗ firewalld启动失败${NC}"
    exit 1
fi

# ============ 第三步：创建自定义区域 ============
echo -e "${YELLOW}========== 第三步：创建中国IP区域 ==========${NC}"

if ! firewall-cmd --get-zones 2>/dev/null | grep -q "china"; then
    firewall-cmd --new-zone=china --permanent
    echo -e "${GREEN}✓ 已创建'china'区域${NC}"
else
    echo -e "${GREEN}✓ 'china'区域已存在${NC}"
fi

# ============ 第四步：添加完整的中国IP列表 ============
echo -e "${YELLOW}========== 第四步：添加中国IP段 ==========${NC}"

# 完整中国IP列表
CHINA_IPS=(
# 基础大段（按运营商/区域）
"1.0.0.0/8"
"2.0.0.0/8"
"10.0.0.0/8"
"14.0.0.0/8"
"27.0.0.0/8"
"36.0.0.0/8"
"39.0.0.0/8"
"42.0.0.0/8"
"43.0.0.0/8"
"45.0.0.0/8"
"47.0.0.0/8"
"49.0.0.0/8"
"52.0.0.0/8"
"54.0.0.0/8"
"57.0.0.0/8"
"58.0.0.0/8"
"59.0.0.0/8"
"60.0.0.0/8"
"61.0.0.0/8"
"101.0.0.0/8"
"103.0.0.0/8"
"106.0.0.0/8"
"110.0.0.0/8"
"111.0.0.0/8"
"112.0.0.0/8"
"113.0.0.0/8"
"114.0.0.0/8"
"115.0.0.0/8"
"116.0.0.0/8"
"117.0.0.0/8"
"118.0.0.0/8"
"119.0.0.0/8"
"120.0.0.0/8"
"121.0.0.0/8"
"122.0.0.0/8"
"123.0.0.0/8"
"124.0.0.0/8"
"125.0.0.0/8"
"128.0.0.0/8"
"129.0.0.0/8"
"130.0.0.0/8"
"132.0.0.0/8"
"134.0.0.0/8"
"139.0.0.0/8"
"140.0.0.0/8"
"142.0.0.0/8"
"144.0.0.0/8"
"146.0.0.0/8"
"149.0.0.0/8"
"150.0.0.0/8"
"151.0.0.0/8"
"152.0.0.0/8"
"153.0.0.0/8"
"154.0.0.0/8"
"157.0.0.0/8"
"158.0.0.0/8"
"159.0.0.0/8"
"160.0.0.0/8"
"161.0.0.0/8"
"162.0.0.0/8"
"163.0.0.0/8"
"164.0.0.0/8"
"165.0.0.0/8"
"166.0.0.0/8"
"167.0.0.0/8"
"168.0.0.0/8"
"170.0.0.0/8"
"171.0.0.0/8"
"175.0.0.0/8"
"178.0.0.0/8"
"180.0.0.0/8"
"182.0.0.0/8"
"183.0.0.0/8"
"192.0.0.0/8"
"202.0.0.0/8"
"203.0.0.0/8"
"210.0.0.0/8"
"211.0.0.0/8"
"212.0.0.0/8"
"218.0.0.0/8"
"219.0.0.0/8"
"220.0.0.0/8"
"221.0.0.0/8"
"222.0.0.0/8"
"223.0.0.0/8"
)

echo -e "${YELLOW}正在添加 ${#CHINA_IPS[@]} 个中国IP段...${NC}"
count=0
failed=0

for ip in "${CHINA_IPS[@]}"
do
  firewall-cmd --zone=china --add-source=$ip --permanent 2>/dev/null
  if [ $? -eq 0 ]; then
    ((count++))
  else
    ((failed++))
  fi
  
  if [ $((count % 20)) -eq 0 ]; then
    echo -e "${GREEN}已添加 $count 个IP段...${NC}"
  fi
done

echo -e "${GREEN}✓ 成功添加 $count 个IP段${NC}"
if [ $failed -gt 0 ]; then
    echo -e "${YELLOW}⚠ 失败 $failed 个IP段${NC}"
fi

# ============ 第五步：配置china区域的服务 ============
echo -e "${YELLOW}========== 第五步：配置允许的服务 ==========${NC}"

echo -e "${YELLOW}正在为china区域添加服务...${NC}"
firewall-cmd --zone=china --add-service=http --permanent
firewall-cmd --zone=china --add-service=https --permanent
firewall-cmd --zone=china --add-service=ssh --permanent
firewall-cmd --zone=china --add-service=ftp --permanent
firewall-cmd --zone=china --set-target=ACCEPT --permanent

echo -e "${GREEN}✓ 已添加服务：HTTP、HTTPS、SSH、FTP${NC}"
echo -e "${GREEN}✓ china区域策略：ACCEPT（允许所有中国IP访问）${NC}"

# ============ 第六步：配置默认区域 ============
echo -e "${YELLOW}========== 第六步：配置默认拒绝策略 ==========${NC}"

echo -e "${YELLOW}正在设置drop区域为默认...${NC}"
firewall-cmd --set-default-zone=drop --permanent

echo -e "${GREEN}✓ 默认策略已设置为DROP（拒绝所有非中国IP的请求）${NC}"

# ============ 第七步：添加自定义端口（如需要） ============
echo -e "${YELLOW}========== 第七步：添加自定义端口 ==========${NC}"

# 这里可以添加自定义端口，例如：
# firewall-cmd --zone=china --add-port=8080/tcp --permanent
# firewall-cmd --zone=china --add-port=3306/tcp --permanent

echo -e "${YELLOW}提示：如需添加自定义端口，请手动执行命令${NC}"
echo -e "示例：firewall-cmd --zone=china --add-port=8080/tcp --permanent"

# ============ 第八步：重新加载配置 ============
echo -e "${YELLOW}========== 第八步：重新加载防火墙配置 ==========${NC}"

echo -e "${YELLOW}正在重新加载firewall配置...${NC}"
firewall-cmd --reload

if [ $? -eq 0 ]; then
    echo -e "${GREEN}✓ 防火墙配置重新加载成功${NC}"
else
    echo -e "${RED}✗ 防火墙配置重新加载失败${NC}"
    exit 1
fi

# ============ 第九步：验证配置 ============
echo -e "${YELLOW}========== 第九步：验证配置结果 ==========${NC}"

echo -e "${GREEN}========== Firewall状态 ==========${NC}"
firewall-cmd --state

echo -e "${GREEN}========== 活跃区域 ==========${NC}"
firewall-cmd --get-active-zones

echo -e "${GREEN}========== 默认区域 ==========${NC}"
firewall-cmd --get-default-zone

echo -e "${GREEN}========== China区域配置 ==========${NC}"
firewall-cmd --zone=china --list-all

echo -e "${GREEN}========== China区域中的IP段数量 ==========${NC}"
firewall-cmd --zone=china --list-sources | wc -w

# ============ 保存持久化配置 ============
echo -e "${YELLOW}========== 第十步：保存持久化配置 ==========${NC}"

if [ -f /etc/firewalld/firewalld.conf ]; then
    echo -e "${GREEN}✓ 配置已自动保存到 /etc/firewalld/ 目录${NC}"
fi

# ============ 完成总结 ============
echo ""
echo -e "${GREEN}╔════════════════════════════════════════════════════════╗${NC}"
echo -e "${GREEN}║        配置完成！中国IP防火墙已成功部署               ║${NC}"
echo -e "${GREEN}╚════════════════════════════════════════════════════════╝${NC}"
echo ""
echo -e "${YELLOW}配置摘要：${NC}"
echo -e "${GREEN}✓ 防火墙状态：已启动并设置开机自启${NC}"
echo -e "${GREEN}✓ 中国IP段数量：${#CHINA_IPS[@]} 个${NC}"
echo -e "${GREEN}✓ China区域允许的服务：HTTP, HTTPS, SSH, FTP${NC}"
echo -e "${GREEN}✓ 默认策略：DROP（拒绝非中国IP）${NC}"
echo ""
echo -e "${YELLOW}防火墙规则说明：${NC}"
echo -e "1. 来自中国IP的请求：完全允许（ACCEPT）"
echo -e "2. 来自非中国IP的请求：全部拒绝（DROP）"
echo -e "3. SSH访问：仅允许中国IP连接"
echo ""
echo -e "${YELLOW}常用命令：${NC}"
echo -e "查看所有规则：firewall-cmd --list-all-zones"
echo -e "添加自定义端口：firewall-cmd --zone=china --add-port=PORT/tcp --permanent"
echo -e "删除端口：firewall-cmd --zone=china --remove-port=PORT/tcp --permanent"
echo -e "重新加载配置：firewall-cmd --reload"
echo -e "添加临时规则：firewall-cmd --zone=china --add-source=IP（不加--permanent为临时）"
echo -e "移除IP段：firewall-cmd --zone=china --remove-source=IP --permanent"
echo -e "查看China区域：firewall-cmd --zone=china --list-all"
echo ""
echo -e "${YELLOW}卸载说明：${NC}"
echo -e "停止防火墙：systemctl stop firewalld"
echo -e "禁用开机自启：systemctl disable firewalld"
echo -e "卸载firewalld：yum remove -y firewalld"
echo ""
echo -e "${YELLOW}文件位置：${NC}"
echo -e "配置文件：/etc/firewalld/zones/china.xml"
echo -e "规则文件：/etc/firewalld/firewalld.conf"
echo ""
echo -e "${GREEN}如有问题，请检查日志：journalctl -xe${NC}"