#!/bin/bash
# FRP 服务器防火墙配置脚本
# 功能：封禁攻击IP，设置连接速率限制

echo "========================================"
echo "   FRP 服务器防火墙安全加固"
echo "========================================"
echo ""

# 服务器信息
SERVER_IP="180.97.221.140"
SERVER_USER="root"
SERVER_PASS="NEjoy4h8B9Fa"

# 检查 sshpass
if ! command -v sshpass &> /dev/null; then
    echo "❌ 错误：需要安装 sshpass"
    exit 1
fi

echo "🔗 连接到服务器..."
echo ""

sshpass -p "$SERVER_PASS" ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no "$SERVER_USER@$SERVER_IP" << 'ENDSSH'

echo "✅ 已连接到服务器"
echo ""

# ========================================
# 第一步：分析日志，找出攻击IP
# ========================================
echo "🔍 第一步：分析最近24小时的攻击IP..."
echo ""

# 提取攻击IP（连接次数超过100的IP，排除白名单）
echo "正在分析日志..."
ATTACK_IPS=$(grep 'get a user connection' /var/log/frps.log | \
  awk '{match($0, /\[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+\]/); 
        ip = substr($0, RSTART+1, RLENGTH-2); 
        if(ip != "") {split(ip, a, ":"); print a[1]}}' | \
  sort | uniq -c | sort -rn | \
  awk '$1 > 100 {print $2}' | \
  grep -v '^127\.' | \
  grep -v '^10\.' | \
  grep -v '^172\.1[6-9]\.' | \
  grep -v '^172\.2[0-9]\.' | \
  grep -v '^172\.3[0-1]\.' | \
  grep -v '^192\.168\.')

echo "⚪ 白名单（永不封禁）："
echo "  - 127.0.0.0/8      (本地回环地址)"
echo "  - 10.0.0.0/8       (私有网络A类)"
echo "  - 172.16.0.0/12    (私有网络B类)"
echo "  - 192.168.0.0/16   (私有网络C类)"
echo ""

echo "🔴 发现以下高频攻击IP（连接次数 > 100）："
echo "$ATTACK_IPS" | nl
echo ""

ATTACK_COUNT=$(echo "$ATTACK_IPS" | wc -l | tr -d ' ')
echo "总计：$ATTACK_COUNT 个攻击IP"
echo ""

# ========================================
# 第二步：备份当前防火墙规则
# ========================================
echo "💾 第二步：备份当前防火墙规则..."
echo ""

mkdir -p /root/firewall-backup
iptables-save > /root/firewall-backup/iptables-backup-$(date +%Y%m%d-%H%M%S).rules
echo "✅ 防火墙规则已备份到 /root/firewall-backup/"
echo ""

# ========================================
# 第三步：创建防火墙规则
# ========================================
echo "🛡️  第三步：设置防火墙规则..."
echo ""

# 检查是否已经有 FRP_BLACKLIST 链
if ! iptables -L FRP_BLACKLIST -n &> /dev/null; then
    echo "创建 FRP_BLACKLIST 链..."
    iptables -N FRP_BLACKLIST
    iptables -I INPUT -j FRP_BLACKLIST
    echo "✅ FRP_BLACKLIST 链已创建"
else
    echo "⚠️  FRP_BLACKLIST 链已存在，清空旧规则..."
    iptables -F FRP_BLACKLIST
fi
echo ""

# 封禁攻击IP
echo "🚫 封禁攻击IP..."
BLOCKED=0
for ip in $ATTACK_IPS; do
    # 检查IP是否已被封禁
    if ! iptables -C FRP_BLACKLIST -s $ip -j DROP 2>/dev/null; then
        iptables -A FRP_BLACKLIST -s $ip -j DROP
        echo "  ✅ 已封禁：$ip"
        BLOCKED=$((BLOCKED + 1))
    else
        echo "  ⏭️  已存在：$ip"
    fi
done
echo ""
echo "✅ 成功封禁 $BLOCKED 个新IP"
echo ""

# ========================================
# 第四步：设置连接速率限制
# ========================================
echo "⚡ 第四步：设置连接速率限制..."
echo ""

# FRP主端口(7000)的速率限制
if ! iptables -L INPUT -n | grep -q "dpt:7000.*limit:"; then
    iptables -I INPUT -p tcp --dport 7000 -m state --state NEW -m recent --set --name FRP_CONN
    iptables -I INPUT -p tcp --dport 7000 -m state --state NEW -m recent --update --seconds 60 --hitcount 100 --name FRP_CONN -j DROP
    echo "✅ FRP主端口(7000)：限制每IP每分钟最多100个新连接"
else
    echo "⏭️  FRP主端口(7000)速率限制已存在"
fi
echo ""

# SSH代理端口的速率限制
SSH_PORTS="2322 2323 6000"
for port in $SSH_PORTS; do
    if ! iptables -L INPUT -n | grep -q "dpt:$port.*limit:"; then
        iptables -I INPUT -p tcp --dport $port -m state --state NEW -m recent --set --name SSH_$port
        iptables -I INPUT -p tcp --dport $port -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name SSH_$port -j DROP
        echo "✅ SSH代理端口($port)：限制每IP每分钟最多10个新连接"
    else
        echo "⏭️  SSH代理端口($port)速率限制已存在"
    fi
done
echo ""

# ========================================
# 第五步：保存防火墙规则（持久化）
# ========================================
echo "💾 第五步：保存防火墙规则（重启后生效）..."
echo ""

# 检查系统类型
if command -v iptables-save &> /dev/null; then
    # CentOS 7
    if [ -f /etc/sysconfig/iptables ]; then
        iptables-save > /etc/sysconfig/iptables
        echo "✅ 规则已保存到 /etc/sysconfig/iptables"
    fi
    
    # 确保 iptables 服务开机启动
    if command -v systemctl &> /dev/null; then
        if systemctl list-unit-files | grep -q iptables.service; then
            systemctl enable iptables 2>/dev/null || echo "⚠️  无法设置 iptables 开机启动"
        fi
    fi
fi
echo ""

# ========================================
# 第六步：显示当前防火墙状态
# ========================================
echo "📊 第六步：当前防火墙状态"
echo ""

echo "--- FRP_BLACKLIST 链（黑名单）---"
iptables -L FRP_BLACKLIST -n -v | head -20
TOTAL_BLOCKED=$(iptables -L FRP_BLACKLIST -n | grep DROP | wc -l)
echo ""
echo "总计封禁：$TOTAL_BLOCKED 个IP"
echo ""

echo "--- 速率限制规则 ---"
iptables -L INPUT -n -v | grep -E "limit:|recent:"
echo ""

# ========================================
# 第七步：创建管理脚本
# ========================================
echo "📝 第七步：创建管理脚本..."
echo ""

cat > /root/frp-firewall-manager.sh << 'MANAGER_SCRIPT'
#!/bin/bash
# FRP 防火墙管理脚本

case "$1" in
    list)
        echo "=== 当前黑名单IP ==="
        iptables -L FRP_BLACKLIST -n | grep DROP | awk '{print $4}' | nl
        ;;
    
    add)
        if [ -z "$2" ]; then
            echo "用法: $0 add <IP地址>"
            exit 1
        fi
        iptables -A FRP_BLACKLIST -s $2 -j DROP
        echo "✅ 已封禁：$2"
        # 保存规则
        iptables-save > /etc/sysconfig/iptables 2>/dev/null || true
        ;;
    
    del)
        if [ -z "$2" ]; then
            echo "用法: $0 del <IP地址>"
            exit 1
        fi
        iptables -D FRP_BLACKLIST -s $2 -j DROP
        echo "✅ 已解封：$2"
        # 保存规则
        iptables-save > /etc/sysconfig/iptables 2>/dev/null || true
        ;;
    
    clear)
        read -p "确定要清空所有黑名单规则吗？(yes/no): " confirm
        if [ "$confirm" = "yes" ]; then
            iptables -F FRP_BLACKLIST
            echo "✅ 黑名单已清空"
            iptables-save > /etc/sysconfig/iptables 2>/dev/null || true
        fi
        ;;
    
    stats)
        echo "=== 防火墙统计 ==="
        echo "黑名单IP数量：$(iptables -L FRP_BLACKLIST -n | grep DROP | wc -l)"
        echo ""
        echo "=== 被拦截最多的IP（前10）==="
        iptables -L FRP_BLACKLIST -n -v | grep DROP | sort -rn -k1 | head -10
        ;;
    
    update)
        echo "正在分析日志更新黑名单..."
        NEW_IPS=$(grep 'get a user connection' /var/log/frps.log | \
          awk '{match($0, /\[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+\]/); 
                ip = substr($0, RSTART+1, RLENGTH-2); 
                if(ip != "") {split(ip, a, ":"); print a[1]}}' | \
          sort | uniq -c | sort -rn | \
          awk '$1 > 100 {print $2}' | \
          grep -v '^127\.' | \
          grep -v '^10\.' | \
          grep -v '^172\.1[6-9]\.' | \
          grep -v '^172\.2[0-9]\.' | \
          grep -v '^172\.3[0-1]\.' | \
          grep -v '^192\.168\.')
        
        ADDED=0
        for ip in $NEW_IPS; do
            if ! iptables -C FRP_BLACKLIST -s $ip -j DROP 2>/dev/null; then
                iptables -A FRP_BLACKLIST -s $ip -j DROP
                echo "  ✅ 新增封禁：$ip"
                ADDED=$((ADDED + 1))
            fi
        done
        
        if [ $ADDED -eq 0 ]; then
            echo "✅ 没有发现新的攻击IP"
        else
            echo "✅ 新增封禁 $ADDED 个IP"
            iptables-save > /etc/sysconfig/iptables 2>/dev/null || true
        fi
        ;;
    
    *)
        echo "FRP 防火墙管理工具"
        echo ""
        echo "用法: $0 {命令} [参数]"
        echo ""
        echo "命令："
        echo "  list          - 查看黑名单"
        echo "  add <IP>      - 添加IP到黑名单"
        echo "  del <IP>      - 从黑名单移除IP"
        echo "  clear         - 清空黑名单"
        echo "  stats         - 查看统计信息"
        echo "  update        - 自动更新黑名单（分析日志）"
        echo ""
        echo "示例："
        echo "  $0 list"
        echo "  $0 add 1.2.3.4"
        echo "  $0 del 1.2.3.4"
        echo "  $0 update"
        ;;
esac
MANAGER_SCRIPT

chmod +x /root/frp-firewall-manager.sh
echo "✅ 管理脚本已创建：/root/frp-firewall-manager.sh"
echo ""

# ========================================
# 第八步：设置定时任务
# ========================================
echo "⏰ 第八步：设置定时任务..."
echo ""

# 检查是否已有定时任务
if ! crontab -l 2>/dev/null | grep -q "frp-firewall-manager.sh update"; then
    # 添加定时任务：每1小时自动更新黑名单
    (crontab -l 2>/dev/null; echo "0 * * * * /root/frp-firewall-manager.sh update >> /var/log/frp-firewall-update.log 2>&1") | crontab -
    echo "✅ 已设置定时任务：每1小时自动更新黑名单"
else
    echo "⏭️  定时任务已存在"
fi
echo ""

# ========================================
# 完成
# ========================================
echo "========================================"
echo "✅ 防火墙配置完成！"
echo "========================================"
echo ""

echo "📋 配置摘要："
echo "  - 封禁IP数量：$TOTAL_BLOCKED 个"
echo "  - 速率限制：已启用"
echo "  - 管理工具：/root/frp-firewall-manager.sh"
echo "  - 自动更新：每1小时"
echo ""

echo "🔧 常用管理命令："
echo "  查看黑名单：/root/frp-firewall-manager.sh list"
echo "  添加IP：    /root/frp-firewall-manager.sh add <IP>"
echo "  移除IP：    /root/frp-firewall-manager.sh del <IP>"
echo "  查看统计：  /root/frp-firewall-manager.sh stats"
echo "  更新黑名单：/root/frp-firewall-manager.sh update"
echo ""

echo "📊 当前被封禁的主要攻击者："
echo "$ATTACK_IPS" | head -5 | nl
echo ""

ENDSSH

if [ $? -eq 0 ]; then
    echo ""
    echo "🎉 配置成功完成！"
    echo ""
    echo "下一步建议："
    echo "  1. 测试您的服务是否正常访问"
    echo "  2. 监控日志确认攻击被拦截"
    echo "  3. 定期查看统计信息"
else
    echo ""
    echo "❌ 配置失败，请检查连接"
fi