RouterOS/RouterOSAssistant/Core/Models/FirewallConfig.swift

import Foundation

struct FirewallRuleCounts: Equatable {
    var filterRuleCount: Int
    var natRuleCount: Int
}

/// A safe-default firewall + NAT preset, standard Mikrotik best practice (matches the ruleset
/// shipped in RouterOS' own factory-default home-router configurations, unchanged across
/// RouterOS versions for well over a decade): NAT/masquerade the WAN interface, allow
/// established/related traffic, drop invalid packets, and drop unsolicited connections
/// arriving from the WAN that aren't destination-NATed (i.e. not an explicit port forward).
///
/// Every rule gets an incrementing `place-before` so it lands ahead of whatever the router
/// already has in that chain (filter and NAT are separate, independently numbered lists) —
/// otherwise, on a device that already has firewall rules, a pre-existing catch-all rule
/// earlier in the chain could make our rules unreachable.
struct FirewallConfig: Equatable {
    /// One configured LAN/VLAN network, for the pairwise isolation rules below.
    struct NetworkSegment: Equatable {
        var interfaceName: String
        var isolated: Bool
    }

    var wanInterface: String
    var networks: [NetworkSegment] = []

    func buildCommands() -> [RouterOSCommand] {
        let natCommand = RouterOSCommand.add(
            menuPath: "/ip firewall nat",
            restPath: "ip/firewall/nat",
            arguments: [
                "chain": "srcnat",
                "out-interface": wanInterface,
                "action": "masquerade",
                "place-before": "0"
            ],
            summary: "Internetfreigabe (NAT/Masquerade) über \(wanInterface) einrichten"
        )

        let filterRules: [(arguments: [String: String], summary: String)] = [
            (
                ["chain": "input", "connection-state": "established,related", "action": "accept"],
                "Bestehende Verbindungen zum Router erlauben"
            ),
            (
                ["chain": "input", "connection-state": "invalid", "action": "drop"],
                "Ungültige Pakete zum Router verwerfen"
            ),
            (
                ["chain": "input", "in-interface": wanInterface, "protocol": "icmp", "action": "accept"],
                "Ping (ICMP) vom Internet zum Router erlauben"
            ),
            (
                ["chain": "input", "in-interface": wanInterface, "action": "drop"],
                "Restlichen Zugriff vom Internet auf den Router blockieren"
            ),
            (
                ["chain": "forward", "connection-state": "established,related", "action": "accept"],
                "Bestehende Verbindungen durch den Router erlauben"
            ),
            (
                ["chain": "forward", "connection-state": "invalid", "action": "drop"],
                "Ungültige Pakete verwerfen"
            ),
            (
                [
                    "chain": "forward",
                    "connection-state": "new",
                    "connection-nat-state": "!dstnat",
                    "in-interface": wanInterface,
                    "action": "drop"
                ],
                "Unaufgeforderte Verbindungen aus dem Internet zu Geräten im Heimnetz blockieren"
            )
        ]

        let filterCommands = filterRules.enumerated().map { index, rule -> RouterOSCommand in
            var arguments = rule.arguments
            arguments["place-before"] = "\(index)"
            return RouterOSCommand.add(
                menuPath: "/ip firewall filter",
                restPath: "ip/firewall/filter",
                arguments: arguments,
                summary: rule.summary
            )
        }

        let isolationCommands = buildIsolationCommands(startingPlaceBefore: filterCommands.count)

        return [natCommand] + filterCommands + isolationCommands
    }

    /// Forward-drop rules between every network marked `isolated` and every other configured
    /// network (both directions). Pairs are deduplicated so two mutually isolated networks
    /// still only get one pair of rules, not two.
    private func buildIsolationCommands(startingPlaceBefore: Int) -> [RouterOSCommand] {
        var seenPairs = Set<Set<String>>()
        var commands: [RouterOSCommand] = []
        var placeBefore = startingPlaceBefore

        for network in networks where network.isolated {
            for other in networks where other.interfaceName != network.interfaceName {
                let pair = Set([network.interfaceName, other.interfaceName])
                guard !seenPairs.contains(pair) else { continue }
                seenPairs.insert(pair)

                for (from, to) in [(network.interfaceName, other.interfaceName), (other.interfaceName, network.interfaceName)] {
                    commands.append(
                        RouterOSCommand.add(
                            menuPath: "/ip firewall filter",
                            restPath: "ip/firewall/filter",
                            arguments: [
                                "chain": "forward",
                                "in-interface": from,
                                "out-interface": to,
                                "action": "drop",
                                "place-before": "\(placeBefore)"
                            ],
                            summary: "Netzwerk \"\(from)\" von \"\(to)\" isolieren"
                        )
                    )
                    placeBefore += 1
                }
            }
        }

        return commands
    }
}