#!/bin/bash

# ==============================================================================
# 🚀 ZONIX ULTIMATE IPTABLES & NETWORK MANAGER
# Domain: bash.zonixbot.ir
# ==============================================================================

# ANSI Color Palette (256-color & Truecolor styling)
RESET='\033[0m'
BOLD='\033[1m'
DIM='\033[2m'

# Neon Colors
C_RED='\033[38;5;196m'
C_GREEN='\033[38;5;46m'
C_YELLOW='\033[38;5;226m'
C_BLUE='\033[38;5;39m'
C_PURPLE='\033[38;5;141m'
C_CYAN='\033[38;5;51m'
C_ORANGE='\033[38;5;208m'
C_GRAY='\033[38;5;244m'
C_WHITE='\033[38;5;231m'
C_PINK='\033[38;5;207m'

# Background Badges
BG_BLUE='\033[48;5;24m\033[38;5;231m'
BG_GREEN='\033[48;5;28m\033[38;5;231m'
BG_RED='\033[48;5;124m\033[38;5;231m'
BG_PURPLE='\033[48;5;54m\033[38;5;231m'
BG_ORANGE='\033[48;5;130m\033[38;5;231m'

# Safe Input Reader (Compatible with piped curl | bash)
safe_read() {
    local prompt="$1"
    local __resultvar="$2"
    local input_val=""
    if [ -e /dev/tty ]; then
        read -rp "$(echo -e "$prompt")" input_val < /dev/tty
    else
        read -rp "$(echo -e "$prompt")" input_val
    fi
    eval "$__resultvar=\"$input_val\""
}

# Root Check
check_root() {
    if [ "$EUID" -ne 0 ]; then
        echo -e "\n${BG_RED} ERROR ${RESET} ${C_RED}${BOLD}This script must be run as root (sudo). / این اسکریپت باید با دسترسی روت اجرا شود.${RESET}\n"
        exit 1
    fi
}

# Detect Network Interface
detect_interface() {
    local iface
    iface=$(ip route get 8.8.8.8 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="dev") print $(i+1)}')
    if [ -z "$iface" ]; then
        iface=$(ip link show | awk -F': ' '$2 !~ /lo/ {print $2; exit}')
    fi
    echo "${iface:-eth0}"
}

# Get Server Public IP
get_public_ip() {
    local ip
    ip=$(ip route get 8.8.8.8 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="src") print $(i+1)}')
    echo "${ip:-127.0.0.1}"
}

# Count Active Rules
count_active_rules() {
    local count
    count=$(iptables -t nat -L PREROUTING -n 2>/dev/null | grep -c "DNAT" || echo "0")
    echo "$count"
}

# Check TCP BBR Status
check_bbr_status() {
    local bbr
    bbr=$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null)
    if [ "$bbr" == "bbr" ]; then
        echo "${C_GREEN}BBR Active${RESET}"
    else
        echo "${C_YELLOW}${bbr:-cubic}${RESET}"
    fi
}

# Enable IPv4 Forwarding
enable_ip_forwarding() {
    local current_state
    current_state=$(sysctl -n net.ipv4.ip_forward 2>/dev/null)
    if [ "$current_state" != "1" ]; then
        echo -e "${C_YELLOW}[*] Enabling IPv4 forwarding (net.ipv4.ip_forward=1)...${RESET}"
        sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1
        if ! grep -q "^net.ipv4.ip_forward=1" /etc/sysctl.conf 2>/dev/null; then
            echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
        fi
        sysctl -p >/dev/null 2>&1
    fi
}

# Ensure Masquerade
ensure_masquerade() {
    if ! iptables -t nat -C POSTROUTING -j MASQUERADE 2>/dev/null; then
        iptables -t nat -A POSTROUTING -j MASQUERADE
    fi
    if ! iptables -C FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT 2>/dev/null; then
        iptables -I FORWARD 1 -m state --state ESTABLISHED,RELATED -j ACCEPT
    fi
}

# Save Rules Persistently
save_rules() {
    echo -e "\n${C_CYAN}[*] Saving iptables rules for reboot persistence...${RESET}"
    if command -v netfilter-persistent >/dev/null 2>&1; then
        netfilter-persistent save >/dev/null 2>&1
        echo -e "${C_GREEN}[✓] Saved via netfilter-persistent.${RESET}"
    elif command -v iptables-save >/dev/null 2>&1; then
        mkdir -p /etc/iptables
        iptables-save > /etc/iptables/rules.v4
        
        if [ ! -f /etc/systemd/system/iptables-restore.service ]; then
            cat << 'EOF' > /etc/systemd/system/iptables-restore.service
[Unit]
Description=Restore iptables firewall rules
Before=network-pre.target
Wants=network-pre.target

[Service]
Type=oneshot
ExecStart=/sbin/iptables-restore /etc/iptables/rules.v4
ExecReload=/sbin/iptables-restore /etc/iptables/rules.v4
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF
            systemctl daemon-reload >/dev/null 2>&1
            systemctl enable iptables-restore.service >/dev/null 2>&1
        fi
        echo -e "${C_GREEN}[✓] Saved to /etc/iptables/rules.v4 & systemd enabled.${RESET}"
    fi
}

# UI Header Banner (Pixel-perfect terminal alignment)
draw_header() {
    clear
    local iface
    local pub_ip
    local rules_count
    local ip_fwd
    local bbr_stat

    iface=$(detect_interface)
    pub_ip=$(get_public_ip)
    rules_count=$(count_active_rules)
    ip_fwd=$(sysctl -n net.ipv4.ip_forward 2>/dev/null)
    bbr_stat=$(check_bbr_status)

    if [ "$ip_fwd" == "1" ]; then
        fwd_status="${C_GREEN}Enabled${RESET}"
    else
        fwd_status="${C_RED}Disabled${RESET}"
    fi

    echo -e "${C_PURPLE}┌────────────────────────────────────────────────────────────────────────┐${RESET}"
    echo -e "${C_PURPLE}│${C_CYAN}${BOLD}   ███████╗ ██████╗ ███╗   ██╗██╗██╗  ██╗    ██████╗  ██████╗ ████████╗  ${C_PURPLE}│${RESET}"
    echo -e "${C_PURPLE}│${C_CYAN}${BOLD}   ╚══███╔╝██╔═══██╗████╗  ██║██║╚██╗██╔╝    ██╔══██╗██╔═══██╗╚══██╔══╝  ${C_PURPLE}│${RESET}"
    echo -e "${C_PURPLE}│${C_CYAN}${BOLD}     ███╔╝ ██║   ██║██╔██╗ ██║██║ ╚███╔╝     ██████╔╝██║   ██║   ██║     ${C_PURPLE}│${RESET}"
    echo -e "${C_PURPLE}│${C_CYAN}${BOLD}    ███╔╝  ██║   ██║██║╚██╗██║██║ ██╔██╗     ██╔══██╗██║   ██║   ██║     ${C_PURPLE}│${RESET}"
    echo -e "${C_PURPLE}│${C_CYAN}${BOLD}   ███████╗╚██████╔╝██║ ╚████║██║██╔╝ ██╗    ██████╔╝╚██████╔╝   ██║     ${C_PURPLE}│${RESET}"
    echo -e "${C_PURPLE}│${C_CYAN}${BOLD}   ╚══════╝ ╚═════╝ ╚═╝  ╚═══╝╚═╝╚═╝  ╚═╝    ╚═════╝  ╚═════╝    ╚═╝     ${C_PURPLE}│${RESET}"
    echo -e "${C_PURPLE}│${C_PINK}            🚀 ZONIX ULTIMATE IPTABLES & TUNNEL MANAGER                 ${C_PURPLE}│${RESET}"
    echo -e "${C_PURPLE}├────────────────────────────────────────────────────────────────────────┤${RESET}"
    echo -e "${C_PURPLE}│${RESET}  ${C_GRAY}Server IP :${RESET} ${C_WHITE}${BOLD}%-15s${RESET} ${C_GRAY}Interface :${RESET} ${C_YELLOW}%-8s${RESET} ${C_GRAY}Active Rules :${RESET} ${C_CYAN}%-4s${RESET}${C_PURPLE}│${RESET}" \
        "$pub_ip" "$iface" "$rules_count"
    echo -e "${C_PURPLE}│${RESET}  ${C_GRAY}IP Forward:${RESET} ${fwd_status}        ${C_GRAY}TCP CC    :${RESET} ${bbr_stat}   ${C_GRAY}Domain:${RESET} ${C_PINK}bash.zonixbot.ir${RESET} ${C_PURPLE}│${RESET}"
    echo -e "${C_PURPLE}└────────────────────────────────────────────────────────────────────────┘${RESET}"
}

# 1. Add Single / Multi Port Forward
add_forward_rule() {
    local iface="$1"
    local local_ports="$2" # Can be single (1001), multi (80,443,8080), or range (10000:20000)
    local dest_ip="$3"
    local dest_port="$4"
    local proto="$5"

    enable_ip_forwarding
    ensure_masquerade

    local protocols=()
    if [ "$proto" = "both" ] || [ "$proto" = "all" ] || [ "$proto" = "TCP+UDP" ]; then
        protocols=("tcp" "udp")
    elif [ "$proto" = "tcp" ] || [ "$proto" = "TCP" ]; then
        protocols=("tcp")
    elif [ "$proto" = "udp" ] || [ "$proto" = "UDP" ]; then
        protocols=("udp")
    else
        protocols=("tcp" "udp")
    fi

    # Handle comma separated ports or port range or single port
    IFS=',' read -ra PORT_LIST <<< "$local_ports"

    for port_entry in "${PORT_LIST[@]}"; do
        port_entry=$(echo "$port_entry" | tr -d ' ')
        local target_p="$port_entry"
        if [ -n "$dest_port" ] && [ "${#PORT_LIST[@]}" -eq 1 ] && [[ ! "$port_entry" =~ ":" ]]; then
            target_p="$dest_port"
        fi

        for p in "${protocols[@]}"; do
            # PREROUTING
            if ! iptables -t nat -C PREROUTING -i "$iface" -p "$p" --dport "$port_entry" -j DNAT --to-destination "$dest_ip:$target_p" 2>/dev/null; then
                iptables -t nat -A PREROUTING -i "$iface" -p "$p" --dport "$port_entry" -j DNAT --to-destination "$dest_ip:$target_p"
            fi

            # OUTPUT
            if ! iptables -t nat -C OUTPUT -p "$p" --dport "$port_entry" -j DNAT --to-destination "$dest_ip:$target_p" 2>/dev/null; then
                iptables -t nat -A OUTPUT -p "$p" --dport "$port_entry" -j DNAT --to-destination "$dest_ip:$target_p"
            fi

            # FORWARD
            if [[ "$target_p" =~ ":" ]]; then
                iptables -A FORWARD -p "$p" -d "$dest_ip" -m "$p" --dport "$target_p" -j ACCEPT 2>/dev/null
            else
                if ! iptables -C FORWARD -p "$p" -d "$dest_ip" --dport "$target_p" -j ACCEPT 2>/dev/null; then
                    iptables -A FORWARD -p "$p" -d "$dest_ip" --dport "$target_p" -j ACCEPT
                fi
            fi
        done
        echo -e "${C_GREEN}[✓] Forwarded: Port $port_entry ➜ $dest_ip:$target_p (${proto^^})${RESET}"
    done

    save_rules
}

# 2. List Rules in Formatted Table with Packet/Byte Counters
list_forward_rules() {
    echo -e "\n${C_BLUE}┌──────┬──────────┬──────────────┬──────────────────────────┬────────────┬───────────┐${RESET}"
    echo -e "${C_BLUE}│${C_YELLOW}  #   ${C_BLUE}│${C_CYAN} PROTO    ${C_BLUE}│${C_WHITE} LOCAL PORT   ${C_BLUE}│${C_GREEN} DESTINATION (IP:PORT)     ${C_BLUE}│${C_PINK} INTERFACE  ${C_BLUE}│${C_ORANGE} TRAFFIC   ${C_BLUE}│${RESET}"
    echo -e "${C_BLUE}├──────┼──────────┼──────────────┼──────────────────────────┼────────────┼───────────┤${RESET}"

    local count=0
    while IFS= read -r line; do
        if [[ "$line" =~ DNAT ]]; then
            ((count++))
            local pkts
            local bytes
            local proto
            local iface_name
            local in_port
            local target

            pkts=$(echo "$line" | awk '{print $1}')
            bytes=$(echo "$line" | awk '{print $2}')
            proto=$(echo "$line" | awk '{print $3}')
            iface_name=$(echo "$line" | awk '{print $6}')
            in_port=$(echo "$line" | grep -oP 'dpt[s]?:[0-9:]+' | head -1 | cut -d':' -f2-)
            [ -z "$in_port" ] && in_port=$(echo "$line" | awk '{print $(NF-1)}')
            target=$(echo "$line" | grep -oP 'to:\K[0-9.:]+' || echo "$line" | awk '{print $NF}')

            [ "$iface_name" == "*" ] && iface_name="ALL"

            printf "${C_BLUE}│${RESET} %-4s ${C_BLUE}│${RESET} %-8s ${C_BLUE}│${RESET} %-12s ${C_BLUE}│${RESET} %-24s ${C_BLUE}│${RESET} %-10s ${C_BLUE}│${RESET} %-9s ${C_BLUE}│${RESET}\n" \
                   "${C_YELLOW}$count${RESET}" "${C_CYAN}${proto^^}${RESET}" "${C_WHITE}${BOLD}$in_port${RESET}" "${C_GREEN}${BOLD}$target${RESET}" "${C_PINK}$iface_name${RESET}" "${C_ORANGE}$bytes${RESET}"
        fi
    done < <(iptables -t nat -L PREROUTING -n -v -x 2>/dev/null)

    if [ "$count" -eq 0 ]; then
        echo -e "${C_BLUE}│${C_GRAY}                       No active forwarding rules found                   ${C_BLUE}│${RESET}"
    fi
    echo -e "${C_BLUE}└──────┴──────────┴──────────────┴──────────────────────────┴────────────┴───────────┘${RESET}\n"
}

# 3. Delete Forward Rule
delete_forward_rule() {
    local iface="$1"
    local local_port="$2"
    local dest_ip="$3"
    local dest_port="$4"
    local proto="$5"

    local protocols=()
    if [ "$proto" = "both" ] || [ "$proto" = "all" ] || [ "$proto" = "TCP+UDP" ]; then
        protocols=("tcp" "udp")
    elif [ "$proto" = "tcp" ] || [ "$proto" = "TCP" ]; then
        protocols=("tcp")
    elif [ "$proto" = "udp" ] || [ "$proto" = "UDP" ]; then
        protocols=("udp")
    else
        protocols=("tcp" "udp")
    fi

    for p in "${protocols[@]}"; do
        iptables -t nat -D PREROUTING -i "$iface" -p "$p" --dport "$local_port" -j DNAT --to-destination "$dest_ip:$dest_port" 2>/dev/null
        iptables -t nat -D OUTPUT -p "$p" --dport "$local_port" -j DNAT --to-destination "$dest_ip:$dest_port" 2>/dev/null
        iptables -D FORWARD -p "$p" -d "$dest_ip" --dport "$dest_port" -j ACCEPT 2>/dev/null
    done

    echo -e "\n${BG_GREEN} REMOVED ${RESET} ${C_GREEN}Rule $local_port -> $dest_ip:$dest_port removed successfully.${RESET}"
    save_rules
}

# 4. Real-time Live Traffic Monitor
live_traffic_monitor() {
    echo -e "${C_CYAN}[*] Starting Real-time Traffic Monitor (Press Ctrl+C to exit)...${RESET}"
    sleep 1
    while true; do
        clear
        echo -e "${C_PURPLE}╔═════════════════════════════════════════════════════════════════════════╗${RESET}"
        echo -e "${C_PURPLE}║${C_CYAN}${BOLD}                 📊 REAL-TIME FORWARDING TRAFFIC MONITOR                 ${C_PURPLE}║${RESET}"
        echo -e "${C_PURPLE}╚═════════════════════════════════════════════════════════════════════════╝${RESET}"
        list_forward_rules
        echo -e "${C_GRAY}Refreshes every 2 seconds. Press ${C_YELLOW}Ctrl + C${C_GRAY} to return to main menu.${RESET}"
        sleep 2
    done
}

# 5. Network Latency & Ping Benchmarking
test_latency() {
    echo -e "\n${BG_BLUE} PING & LATENCY BENCHMARK ${RESET}\n"
    safe_read "${C_WHITE}Enter Destination IP / Host to test: ${RESET}" target_host
    if [ -n "$target_host" ]; then
        echo -e "\n${C_CYAN}📡 Sending 5 ICMP Ping packets to ${C_YELLOW}$target_host${C_CYAN}...${RESET}"
        ping -c 5 "$target_host"
        
        safe_read "\n${C_WHITE}Test TCP port connectivity? (Enter port or press Enter to skip): ${RESET}" test_port
        if [ -n "$test_port" ]; then
            echo -e "${C_CYAN}🔌 Testing TCP Connection to $target_host:$test_port...${RESET}"
            if timeout 3 bash -c "</dev/tcp/$target_host/$test_port" 2>/dev/null; then
                echo -e "${C_GREEN}✔ SUCCESS: Port $test_port on $target_host is OPEN and reachable!${RESET}"
            else
                echo -e "${C_RED}✖ FAILED: Cannot connect to port $test_port on $target_host (Connection timed out or refused).${RESET}"
            fi
        fi
    fi
}

# 6. Enable TCP BBR & Kernel Network Optimization
optimize_bbr() {
    echo -e "\n${BG_PURPLE} TCP BBR & NETWORK OPTIMIZER ${RESET}\n"
    echo -e "${C_CYAN}This will enable Google TCP BBR, increase TCP buffer sizes, and reduce tunnel latency.${RESET}"
    safe_read "${C_YELLOW}Apply BBR & Network Optimization? (y/N): ${RESET}" confirm
    if [[ "$confirm" =~ ^[Yy]$ ]]; then
        modprobe tcp_bbr 2>/dev/null
        echo "tcp_bbr" >> /etc/modules-load.d/bbr.conf 2>/dev/null

        cat << 'EOF' > /etc/sysctl.d/99-network-optimization.conf
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
net.ipv4.ip_forward = 1
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
net.core.rmem_default = 65536
net.core.wmem_default = 65536
net.core.netdev_max_backlog = 100000
net.ipv4.tcp_rmem = 4096 87380 67108864
net.ipv4.tcp_wmem = 4096 65536 67108864
net.ipv4.tcp_mtu_probing = 1
net.ipv4.tcp_fastopen = 3
EOF
        sysctl --system >/dev/null 2>&1
        echo -e "${C_GREEN}[✓] Google TCP BBR and high-speed network tuning applied successfully!${RESET}"
    else
        echo -e "${C_GRAY}[*] Operation cancelled.${RESET}"
    fi
}

# 7. Backup & Restore IPTables Config
backup_restore_menu() {
    echo -e "\n${BG_BLUE} BACKUP & RESTORE RULES ${RESET}\n"
    echo -e "  ${C_CYAN}[1]${RESET} 📦 Backup current rules to file"
    echo -e "  ${C_CYAN}[2]${RESET} 📥 Restore rules from file"
    safe_read "${C_WHITE}Select option [1-2]: ${RESET}" br_choice
    
    local backup_file="/root/iptables_backup_$(date +%Y%m%d_%H%M%S).v4"
    if [ "$br_choice" == "1" ]; then
        iptables-save > "$backup_file"
        echo -e "${C_GREEN}[✓] Rules successfully backed up to: ${C_YELLOW}$backup_file${RESET}"
    elif [ "$br_choice" == "2" ]; then
        safe_read "${C_WHITE}Enter path to backup file: ${RESET}" restore_path
        if [ -f "$restore_path" ]; then
            iptables-restore < "$restore_path"
            save_rules
            echo -e "${C_GREEN}[✓] Rules restored from $restore_path.${RESET}"
        else
            echo -e "${C_RED}File not found: $restore_path${RESET}"
        fi
    fi
}

# 8. iPerf3 SpeedTest Server / Client
run_iperf3_tool() {
    echo -e "\n${BG_GREEN} IPERF3 BANDWIDTH SPEEDTEST ${RESET}\n"
    if ! command -v iperf3 >/dev/null 2>&1; then
        echo -e "${C_YELLOW}[*] Installing iperf3 package...${RESET}"
        apt-get update -y >/dev/null 2>&1 && apt-get install -y iperf3 >/dev/null 2>&1 || yum install -y iperf3 >/dev/null 2>&1
    fi

    echo -e "  ${C_CYAN}[1]${RESET} 🖥️  Run as iPerf3 Server (Listen on port)"
    echo -e "  ${C_CYAN}[2]${RESET} 🚀 Run as iPerf3 Client (Test speed to remote IP)"
    safe_read "${C_WHITE}Select mode [1-2]: ${RESET}" ip_mode

    if [ "$ip_mode" == "1" ]; then
        safe_read "${C_WHITE}Enter listening port [Default: 5201]: ${RESET}" srv_port
        srv_port=${srv_port:-5201}
        echo -e "${C_GREEN}Starting iperf3 server on port $srv_port (Press Ctrl+C to stop)...${RESET}"
        iperf3 -s -p "$srv_port"
    elif [ "$ip_mode" == "2" ]; then
        safe_read "${C_WHITE}Enter remote Server IP: ${RESET}" remote_ip
        safe_read "${C_WHITE}Enter remote Port [Default: 5201]: ${RESET}" remote_p
        remote_p=${remote_p:-5201}
        echo -e "${C_CYAN}Running TCP SpeedTest to $remote_ip:$remote_p...${RESET}"
        iperf3 -c "$remote_ip" -p "$remote_p"
    fi
}

# Flush All Forwarding Rules
flush_all_rules() {
    echo -e "\n${BG_RED} WARNING ${RESET} ${C_RED}${BOLD}This will flush ALL NAT and FORWARD iptables rules!${RESET}"
    safe_read "${C_YELLOW}Are you sure you want to proceed? (y/N): ${RESET}" confirm
    if [[ "$confirm" =~ ^[Yy]$ ]]; then
        iptables -t nat -F
        iptables -F FORWARD
        echo -e "${C_GREEN}[✓] All NAT and FORWARD rules flushed.${RESET}"
        save_rules
    else
        echo -e "${C_GRAY}[*] Operation cancelled.${RESET}"
    fi
}

# Check Port Status
check_port_status() {
    echo -e "\n${C_CYAN}[*] Port & Socket Status Check${RESET}"
    safe_read "${C_WHITE}Enter port number to inspect: ${RESET}" port_to_check
    if [ -n "$port_to_check" ]; then
        echo -e "\n${C_YELLOW}--- Listening Sockets (ss): ---${RESET}"
        ss -tulpn | grep -E "$port_to_check" || echo -e "${C_GRAY}No local application is listening on port $port_to_check directly (traffic is forwarded by kernel).${RESET}"
        
        echo -e "\n${C_YELLOW}--- IPTables NAT Rules: ---${RESET}"
        iptables -t nat -L PREROUTING -n -v --line-numbers | grep -E "dpt:$port_to_check|to:" || echo -e "${C_GRAY}No iptables rule found for port $port_to_check.${RESET}"
    fi
}

# Interactive Menu Loop
interactive_menu() {
    while true; do
        draw_header
        echo -e "  ${C_CYAN}[1]${RESET} ${C_WHITE}➕  Add Port Forward${RESET}           ${C_GRAY}(Single / Multi / Range 1000:2000)${RESET}"
        echo -e "  ${C_CYAN}[2]${RESET} ${C_WHITE}📋  List Active Rules${RESET}          ${C_GRAY}(جدول رول‌ها با میزان مصرف ترافیک)${RESET}"
        echo -e "  ${C_CYAN}[3]${RESET} ${C_WHITE}❌  Delete Forward Rule${RESET}        ${C_GRAY}(حذف یک رول مشخص)${RESET}"
        echo -e "  ${C_CYAN}[4]${RESET} ${C_WHITE}📊  Live Traffic Monitor${RESET}       ${C_GRAY}(مانیتورینگ زنده ترافیک عبوری)${RESET}"
        echo -e "  ${C_CYAN}[5]${RESET} ${C_WHITE}⚡  TCP BBR & Network Booster${RESET}  ${C_GRAY}(بهینه‌سازی سرعت و کاهش پینگ تونل)${RESET}"
        echo -e "  ${C_CYAN}[6]${RESET} ${C_WHITE}📡  Ping & Port Reachability${RESET}   ${C_GRAY}(تست پینگ و اتصال به سرور مقصد)${RESET}"
        echo -e "  ${C_CYAN}[7]${RESET} ${C_WHITE}🚀  iPerf3 SpeedTest Tool${RESET}      ${C_GRAY}(تست دقیق پهنای باند و سرعت تونل)${RESET}"
        echo -e "  ${C_CYAN}[8]${RESET} ${C_WHITE}📦  Backup & Restore Rules${RESET}     ${C_GRAY}(بکاپ و بازگردانی قوانین)${RESET}"
        echo -e "  ${C_CYAN}[9]${RESET} ${C_WHITE}🧹  Flush All Rules${RESET}            ${C_GRAY}(پاکسازی تمام رول‌ها)${RESET}"
        echo -e "  ${C_RED}[0]${RESET} ${C_WHITE}🚪  Exit${RESET}                       ${C_GRAY}(خروج)${RESET}"
        echo -e "${C_PURPLE}────────────────────────────────────────────────────────────────────────${RESET}"
        
        safe_read "${C_YELLOW}${BOLD}👉 Select an option [0-9]: ${RESET}" choice

        case $choice in
            1)
                default_iface=$(detect_interface)
                echo -e "\n${BG_BLUE} ADD PORT FORWARDING ${RESET}\n"
                
                safe_read "${C_WHITE}Network Interface ${C_GRAY}[Default: ${C_YELLOW}$default_iface${C_GRAY}]: ${RESET}" iface
                iface=${iface:-$default_iface}

                echo -e "${C_GRAY}Tips: Single (e.g. 1001), Multi (e.g. 80,443,8080), or Range (e.g. 10000:20000)${RESET}"
                safe_read "${C_WHITE}Local Ingress Port(s): ${RESET}" local_port
                while [ -z "$local_port" ]; do
                    echo -e "${C_RED}❌ Port cannot be empty.${RESET}"
                    safe_read "${C_WHITE}Local Ingress Port(s): ${RESET}" local_port
                done

                safe_read "${C_WHITE}Destination Target IP (آی‌پی سرور مقصد): ${RESET}" dest_ip
                while [ -z "$dest_ip" ]; do
                    echo -e "${C_RED}❌ Destination IP cannot be empty.${RESET}"
                    safe_read "${C_WHITE}Destination Target IP: ${RESET}" dest_ip
                done

                if [[ ! "$local_port" =~ "," ]] && [[ ! "$local_port" =~ ":" ]]; then
                    safe_read "${C_WHITE}Destination Port ${C_GRAY}[Default: ${C_YELLOW}$local_port${C_GRAY}]: ${RESET}" dest_port
                    dest_port=${dest_port:-$local_port}
                else
                    dest_port=""
                fi

                echo -e "\n${C_GRAY}Select Protocol:${RESET}"
                echo -e "  ${C_CYAN}1)${RESET} TCP + UDP ${C_GRAY}(Both - Recommended)${RESET}"
                echo -e "  ${C_CYAN}2)${RESET} TCP Only"
                echo -e "  ${C_CYAN}3)${RESET} UDP Only"
                safe_read "${C_WHITE}Choice [1-3, Default: 1]: ${RESET}" proto_choice
                case $proto_choice in
                    2) proto="tcp" ;;
                    3) proto="udp" ;;
                    *) proto="both" ;;
                esac

                add_forward_rule "$iface" "$local_port" "$dest_ip" "$dest_port" "$proto"
                safe_read "\n${C_GRAY}Press Enter to return to menu...${RESET}" _
                ;;
            2)
                list_forward_rules
                safe_read "${C_GRAY}Press Enter to return to menu...${RESET}" _
                ;;
            3)
                default_iface=$(detect_interface)
                echo -e "\n${BG_RED} DELETE FORWARD RULE ${RESET}\n"
                safe_read "${C_WHITE}Network Interface ${C_GRAY}[Default: ${C_YELLOW}$default_iface${C_GRAY}]: ${RESET}" iface
                iface=${iface:-$default_iface}
                safe_read "${C_WHITE}Local Port: ${RESET}" local_port
                safe_read "${C_WHITE}Destination IP: ${RESET}" dest_ip
                safe_read "${C_WHITE}Destination Port ${C_GRAY}[Default: ${C_YELLOW}$local_port${C_GRAY}]: ${RESET}" dest_port
                dest_port=${dest_port:-$local_port}
                echo -e "Protocol: 1) Both  2) TCP  3) UDP"
                safe_read "${C_WHITE}Choice [Default: 1]: ${RESET}" proto_choice
                case $proto_choice in
                    2) proto="tcp" ;;
                    3) proto="udp" ;;
                    *) proto="both" ;;
                esac
                delete_forward_rule "$iface" "$local_port" "$dest_ip" "$dest_port" "$proto"
                safe_read "\n${C_GRAY}Press Enter to return to menu...${RESET}" _
                ;;
            4)
                live_traffic_monitor
                ;;
            5)
                optimize_bbr
                safe_read "\n${C_GRAY}Press Enter to return to menu...${RESET}" _
                ;;
            6)
                test_latency
                safe_read "\n${C_GRAY}Press Enter to return to menu...${RESET}" _
                ;;
            7)
                run_iperf3_tool
                safe_read "\n${C_GRAY}Press Enter to return to menu...${RESET}" _
                ;;
            8)
                backup_restore_menu
                safe_read "\n${C_GRAY}Press Enter to return to menu...${RESET}" _
                ;;
            9)
                flush_all_rules
                safe_read "\n${C_GRAY}Press Enter to return to menu...${RESET}" _
                ;;
            0)
                echo -e "\n${C_GREEN}Goodbye! 👋${RESET}\n"
                exit 0
                ;;
            *)
                echo -e "${C_RED}Invalid option.${RESET}"
                sleep 1
                ;;
        esac
    done
}

# CLI Mode Handling
check_root

if [ $# -eq 0 ]; then
    interactive_menu
else
    COMMAND="$1"
    shift
    IFACE=$(detect_interface)
    PROTO="both"
    LOCAL_PORT=""
    DEST_IP=""
    DEST_PORT=""

    while [[ $# -gt 0 ]]; do
        case $1 in
            -i|--iface)
                IFACE="$2"
                shift 2
                ;;
            -l|--local-port)
                LOCAL_PORT="$2"
                shift 2
                ;;
            -d|--dest-ip)
                DEST_IP="$2"
                shift 2
                ;;
            -p|--dest-port)
                DEST_PORT="$2"
                shift 2
                ;;
            -proto|--protocol)
                PROTO="$2"
                shift 2
                ;;
            -h|--help)
                echo -e "Usage: $0 [add|list|delete|flush|save|bbr|monitor] [options]"
                exit 0
                ;;
            *)
                echo -e "${C_RED}Unknown argument: $1${RESET}"
                exit 1
                ;;
        esac
    done

    DEST_PORT=${DEST_PORT:-$LOCAL_PORT}

    case $COMMAND in
        add)
            if [ -z "$LOCAL_PORT" ] || [ -z "$DEST_IP" ]; then
                echo -e "${C_RED}Error: Local port (-l) and Destination IP (-d) are required.${RESET}"
                exit 1
            fi
            add_forward_rule "$IFACE" "$LOCAL_PORT" "$DEST_IP" "$DEST_PORT" "$PROTO"
            ;;
        list)
            list_forward_rules
            ;;
        delete)
            if [ -z "$LOCAL_PORT" ] || [ -z "$DEST_IP" ]; then
                echo -e "${C_RED}Error: Local port (-l) and Destination IP (-d) are required.${RESET}"
                exit 1
            fi
            delete_forward_rule "$IFACE" "$LOCAL_PORT" "$DEST_IP" "$DEST_PORT" "$PROTO"
            ;;
        monitor)
            live_traffic_monitor
            ;;
        bbr)
            optimize_bbr
            ;;
        flush)
            flush_all_rules
            ;;
        save)
            save_rules
            ;;
        *)
            echo -e "${C_RED}Unknown command: $COMMAND${RESET}"
            exit 1
            ;;
    esac
fi