#!/bin/bash
# ============================================
# UFW Firewall Rules for SIAKAD Server
# ============================================

# Reset UFW
sudo ufw --force reset

# Default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (change port if needed)
sudo ufw allow 22/tcp comment 'SSH Access'

# Allow HTTP/HTTPS
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'

# Allow specific admin IPs (replace with actual IPs)
# sudo ufw allow from 192.168.1.100 to any port 22 comment 'Admin Office'
# sudo ufw allow from 10.0.0.0/8 to any port 3306 comment 'Internal Network DB'

# Block specific IPs (add malicious IPs here)
# sudo ufw deny from 1.2.3.4 comment 'Known attacker'

# Rate limit SSH
sudo ufw limit 22/tcp comment 'SSH Rate Limit'

# Enable logging
sudo ufw logging on

# Enable UFW
sudo ufw --force enable

# Show status
sudo ufw status verbose

echo "UFW configuration applied successfully!"