#!/bin/bash
# ----------------------------------------------------------
# wifi_bridge.sh – Crea un puente NAT entre Wi-Fi y Ethernet
# Compatible con Debian 12/13 (Bookworm/Trixie)
# ----------------------------------------------------------

# Interfaces
WIFI_IF="wlp3s0"
ETH_IF="enp0s25"

# IP interna para la red compartida
LAN_IP="192.168.137.1"
LAN_NET="192.168.137.0/24"

echo "[*] Configurando reenvío IPv4..."
echo 1 | tee /proc/sys/net/ipv4/ip_forward >/dev/null

# Aplicar persistencia en sysctl
if ! grep -q '^net.ipv4.ip_forward=1' /etc/sysctl.conf; then
    echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
fi

echo "[*] Asignando IP local a $ETH_IF..."
ip addr flush dev "$ETH_IF"
ip addr add "$LAN_IP/24" dev "$ETH_IF"
ip link set "$ETH_IF" up

echo "[*] Limpiando reglas iptables anteriores..."
iptables -t nat -F
iptables -F
iptables -X

echo "[*] Configurando NAT y reenvío..."
iptables -t nat -A POSTROUTING -o "$WIFI_IF" -j MASQUERADE
iptables -A FORWARD -i "$ETH_IF" -o "$WIFI_IF" -j ACCEPT
iptables -A FORWARD -i "$WIFI_IF" -o "$ETH_IF" -m state --state RELATED,ESTABLISHED -j ACCEPT

# Guardar reglas
if command -v iptables-save &>/dev/null; then
    mkdir -p /etc/iptables
    iptables-save > /etc/iptables/rules.v4
    echo "[*] Reglas iptables guardadas en /etc/iptables/rules.v4"
else
    echo "[!] iptables-save no encontrado. Instala iptables-persistent si querés guardar reglas."
fi

# Opcional: iniciar dnsmasq si existe
if command -v dnsmasq &>/dev/null; then
    echo "[*] Verificando configuración DHCP (dnsmasq)..."
    if ! grep -q "interface=$ETH_IF" /etc/dnsmasq.conf 2>/dev/null; then
        echo -e "\ninterface=$ETH_IF\ndhcp-range=192.168.137.10,192.168.137.100,12h" >> /etc/dnsmasq.conf
    fi
    systemctl restart dnsmasq
    echo "[*] dnsmasq configurado y reiniciado."
else
    echo "[!] dnsmasq no instalado. Los clientes deberán usar IP manual o instalá dnsmasq."
fi

echo "[✔] Puente Wi-Fi ↔ Ethernet activado correctamente."
echo "    Wi-Fi: $WIFI_IF  →  Ethernet: $ETH_IF"
echo "    Red interna: $LAN_NET (Gateway: $LAN_IP)"