---
- name: Set firewall zone name
  set_fact:
    fw_zone: "{{ gateway_config.lab_name }}"
    br_if: "br_{{ gateway_config.lab_name }}"

- name: Remove existing firewall zone
  shell: |
    # Find and remove existing zone
    zone_idx=$(uci show firewall | grep "=zone" | grep "name='{{ fw_zone }}'" | cut -d. -f2 | cut -d= -f1)
    if [ -n "$zone_idx" ]; then
      uci delete firewall.$zone_idx
    fi
    
    # Remove associated forwarding rules
    for fwd in $(uci show firewall | grep "={{ fw_zone }}" | cut -d. -f2 | cut -d= -f1); do
      uci delete firewall.$fwd 2>/dev/null || true
    done
    
    uci commit firewall
  changed_when: true

- name: Create isolated firewall zone for lab network
  shell: |
    # Create new zone
    uci add firewall zone
    uci set firewall.@zone[-1].name='{{ fw_zone }}'
    uci set firewall.@zone[-1].input='REJECT'
    uci set firewall.@zone[-1].output='ACCEPT'
    uci set firewall.@zone[-1].forward='REJECT'
    uci set firewall.@zone[-1].network='{{ br_if }}'
    uci commit firewall
  changed_when: true

- name: Allow DNS and DHCP from lab to gateway
  shell: |
    # Allow DNS
    uci add firewall rule
    uci set firewall.@rule[-1].name='Allow-{{ fw_zone }}-DNS'
    uci set firewall.@rule[-1].src='{{ fw_zone }}'
    uci set firewall.@rule[-1].proto='tcp udp'
    uci set firewall.@rule[-1].dest_port='53'
    uci set firewall.@rule[-1].target='ACCEPT'
    
    # Allow DHCP
    uci add firewall rule
    uci set firewall.@rule[-1].name='Allow-{{ fw_zone }}-DHCP'
    uci set firewall.@rule[-1].src='{{ fw_zone }}'
    uci set firewall.@rule[-1].proto='udp'
    uci set firewall.@rule[-1].src_port='67:68'
    uci set firewall.@rule[-1].dest_port='67:68'
    uci set firewall.@rule[-1].target='ACCEPT'
    
    uci commit firewall
  changed_when: true

- name: Allow intra-lab forwarding
  shell: |
    uci add firewall forwarding
    uci set firewall.@forwarding[-1].src='{{ fw_zone }}'
    uci set firewall.@forwarding[-1].dest='{{ fw_zone }}'
    uci commit firewall
  changed_when: true

- name: Block lab to WAN/LAN
  shell: |
    # Explicit reject to WAN
    uci add firewall forwarding
    uci set firewall.@forwarding[-1].src='{{ fw_zone }}'
    uci set firewall.@forwarding[-1].dest='wan'
    uci set firewall.@forwarding[-1].enabled='0'
    
    # Explicit reject to LAN
    uci add firewall forwarding
    uci set firewall.@forwarding[-1].src='{{ fw_zone }}'
    uci set firewall.@forwarding[-1].dest='lan'
    uci set firewall.@forwarding[-1].enabled='0'
    
    uci commit firewall
  changed_when: true

- name: Reload firewall
  shell: /etc/init.d/firewall reload
  changed_when: true

- name: Verify firewall configuration
  shell: |
    echo "=== Firewall Zones ==="
    uci show firewall | grep "={{ fw_zone }}"
    echo ""
    echo "=== Firewall Rules ==="
    iptables -L -n -v | grep -A 5 "{{ fw_zone }}" || echo "No iptables rules yet"
  register: firewall_status
  changed_when: false

- name: Display firewall status
  debug:
    var: firewall_status.stdout_lines