#!/bin/sh

set -eu

chain=KUBEADM_METRICS

remove_jump() {
    while iptables -C INPUT -p tcp --dport 2381 -j "$chain" 2>/dev/null; do
        iptables -D INPUT -p tcp --dport 2381 -j "$chain"
    done
}

case "${1:-start}" in
    start)
        iptables -N "$chain" 2>/dev/null || true
        iptables -F "$chain"

        iptables -A "$chain" -s 127.0.0.0/8 -j ACCEPT
        iptables -A "$chain" -s 192.168.0.0/24 -j ACCEPT
        iptables -A "$chain" -p tcp -j REJECT --reject-with tcp-reset

        remove_jump
        iptables -I INPUT 1 -p tcp --dport 2381 -j "$chain"
        ;;
    stop)
        remove_jump
        iptables -F "$chain" 2>/dev/null || true
        iptables -X "$chain" 2>/dev/null || true
        ;;
    *)
        echo "Usage: $0 {start|stop}" >&2
        exit 2
        ;;
esac
