#!/bin/sh
set -eu
[ -f /etc/decoy-disposable-guest ]
id decoy-relay >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin decoy-relay
ip route replace default via 10.0.2.2
iptables -t nat -N DECOY 2>/dev/null || true
iptables -t nat -F DECOY
iptables -t nat -A DECOY -m owner --uid-owner decoy-relay -j RETURN
iptables -t nat -A DECOY -d 127.0.0.0/8 -j RETURN
iptables -t nat -A DECOY -d 10.0.2.100/32 -j RETURN
iptables -t nat -A DECOY -p tcp -j REDIRECT --to-ports 15001
iptables -t nat -C OUTPUT -p tcp -j DECOY 2>/dev/null || iptables -t nat -A OUTPUT -p tcp -j DECOY
printf 'nameserver 127.0.0.1\noptions timeout:2 attempts:1\n' > /etc/resolv.conf