#!/bin/sh
# This is supposed to be run on openwrt
 
# Written by Stanislav German-Evtushenko, 2014
# Based on [[:doc:recipes:guest-wlan]]
 
# Configure guest network
ucidef_guest_network_conf() {
	uci delete network.guest
	uci batch <<EOF
set network.guest=interface
set network.guest.proto=static
set network.guest.ipaddr=192.168.101.21
set network.guest.netmask=255.255.255.0
EOF
	uci commit network
}
 
# Configure DHCP for guest network
ucidef_guest_dhcp_conf() {
	uci delete dhcp.guest
	uci batch <<EOF
set dhcp.guest=dhcp
set dhcp.guest.interface=guest
set dhcp.guest.start=50
set dhcp.guest.limit=200
set dhcp.guest.leasetime=1h
EOF
	uci commit dhcp
}
 
# Configure firewall for guest network
ucidef_guest_firewall_conf() {
## Configure guest zone
	uci delete firewall.guest_zone
	uci batch <<EOF
set firewall.guest_zone=zone
set firewall.guest_zone.name=guest
set firewall.guest_zone.network=guest
set firewall.guest_zone.input=REJECT
set firewall.guest_zone.forward=REJECT
set firewall.guest_zone.output=ACCEPT
EOF

## Allow Guest -> Internet
	uci delete firewall.guest_forwarding
	uci batch <<EOF
set firewall.guest_forwarding=forwarding
set firewall.guest_forwarding.src=guest
set firewall.guest_forwarding.dest=wan
EOF

## Allow DNS Guest -> Router
	uci delete firewall.guest_rule_dns
	uci batch <<EOF
set firewall.guest_rule_dns=rule
set firewall.guest_rule_dns.name='Allow DNS Queries'
set firewall.guest_rule_dns.src=guest
set firewall.guest_rule_dns.dest_port=53
set firewall.guest_rule_dns.proto=udp
set firewall.guest_rule_dns.target=ACCEPT
EOF

## Allow DHCP Guest -> Router
	uci delete firewall.guest_rule_dhcp
	uci batch <<EOF
set firewall.guest_rule_dhcp=rule
set firewall.guest_rule_dhcp.name='Allow DHCP request'
set firewall.guest_rule_dhcp.src=guest
set firewall.guest_rule_dhcp.src_port=68
set firewall.guest_rule_dhcp.dest_port=67
set firewall.guest_rule_dhcp.proto=udp
set firewall.guest_rule_dhcp.target=ACCEPT
EOF
	uci commit firewall
}

ucidef_setup_guest() {
	ucidef_guest_network_conf
	ucidef_guest_dhcp_conf
	ucidef_guest_firewall_conf
}

ucidef_setup_guest
