#!/bin/sh

RULE='tcp dport 22 dnat to 192.168.100.10:22 comment "vm-ssh-forward"'
TABLE="ip"
CHAIN="prerouting"
TABLE_NAME="nat"

set -e

case "$1" in
  enable)
    echo "Enabling SSH DNAT rule..."
    nft list chain $TABLE $TABLE_NAME $CHAIN | grep -q 'vm-ssh-forward' || \
      nft add rule $TABLE $TABLE_NAME $CHAIN $RULE
    ;;
  disable)
    echo "Disabling SSH DNAT rule..."
    HANDLE=$(nft --handle list chain $TABLE $TABLE_NAME $CHAIN | \
      awk '/vm-ssh-forward/ {print $(NF)}')
    if [ -n "$HANDLE" ]; then
      nft delete rule $TABLE $TABLE_NAME $CHAIN handle $HANDLE
    else
      echo "Rule not found or already removed."
    fi
    ;;
  status)
    if nft list chain $TABLE $TABLE_NAME $CHAIN | grep -q 'vm-ssh-forward'; then
      echo "SSH forwarding is ENABLED"
    else
      echo "SSH forwarding is DISABLED"
    fi
    ;;
  *)
    echo "Usage: $0 enable|disable|status"
    exit 1
    ;;
esac

