#!/bin/bash
set -e

echo "🔒 Setting up UFW VPN killswitch..."

ufw --force reset

ufw default deny outgoing
ufw default deny incoming

# Allow loopback
ufw allow in on lo
ufw allow out on lo

# Allow VPN tunnel traffic
ufw allow in on tun0
ufw allow out on tun0

# Allow local LAN
ufw allow in from 192.168.1.0/24
ufw allow out to 192.168.1.0/24

# Allow DNS
ufw allow out 53/udp
ufw allow out 53/tcp

# Allow OpenVPN ports
ufw allow out 1194/udp
ufw allow out 443/tcp

ufw --force enable

echo "✅ UFW killswitch configured."