function firewall::block_ip_logged() {
  local client_ip="$1" target_ip="$2"

  iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j LOG --log-prefix "wgctl-dropped: " --log-level 4
  iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j DROP
  log::wg_block "Blocked ${client_ip} → ${target_ip} (logged)"
}
function firewall::unblock_ip() {
  local client_ip="$1" target_ip="$2"

  iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j LOG --log-prefix "wgctl-dropped: " --log-level 4 2>/dev/null || true
  iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j DROP 2>/dev/null || true
}
function firewall::block_all() {
  local client_ip="$1" client_name="$2"

  iptables -A FORWARD -s "$client_ip" -j LOG --log-prefix "wgctl-dropped: " --log-level 4
  iptables -A FORWARD -s "$client_ip" -j DROP

  log::debug "Blocked all traffic from: ${client_ip}"
}
function firewall::unblock_all() {
  local client_ip="$1"

  iptables -D FORWARD -s "$client_ip" -j LOG --log-prefix "wgctl-dropped: " --log-level 4 2>/dev/null || true
  iptables -D FORWARD -s "$client_ip" -j DROP 2>/dev/null || true

  monitor::unwatch "$client_ip"
  log::debug "Unblocked all traffic from: ${client_ip}"
}
function firewall::apply_guest_dns_redirect() {
  if iptables -t nat -C PREROUTING -s "$(config::subnet_for guest).0/24" -p udp --dport 53 -j DNAT --to-destination "$(config::dns):53" 2>/dev/null; then
    log::wg "Guest DNS redirect already applied"
    return 0
  fi

  local guest_subnet dns
  guest_subnet="$(config::subnet_for "guest").0/24"
  dns="$(config::dns)"

  # Log DNS bypass attempts (queries not directed at Pi-hole)
  iptables -t nat -A PREROUTING -s "$guest_subnet" -p udp --dport 53 \
    ! -d "$dns" \
    -j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4
  iptables -t nat -A PREROUTING -s "$guest_subnet" -p tcp --dport 53 \
    ! -d "$dns" \
    -j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4

  # Redirect all DNS to Pi-hole
  iptables -t nat -A PREROUTING -s "$guest_subnet" -p udp --dport 53 -j DNAT --to-destination "${dns}:53"
  iptables -t nat -A PREROUTING -s "$guest_subnet" -p tcp --dport 53 -j DNAT --to-destination "${dns}:53"

  log::wg_block "Guest DNS redirected to Pi-hole (${dns}), bypass attempts will be logged"
}
function firewall::remove_guest_dns_redirect() {
  local guest_subnet dns
  guest_subnet="$(config::subnet_for "guest").0/24"
  dns="$(config::dns)"

  iptables -t nat -D PREROUTING -s "$guest_subnet" -p udp --dport 53 \
    ! -d "$dns" \
    -j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4 2>/dev/null || true
  iptables -t nat -D PREROUTING -s "$guest_subnet" -p tcp --dport 53 \
    ! -d "$dns" \
    -j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4 2>/dev/null || true
  iptables -t nat -D PREROUTING -s "$guest_subnet" -p udp --dport 53 -j DNAT --to-destination "${dns}:53" 2>/dev/null || true
  iptables -t nat -D PREROUTING -s "$guest_subnet" -p tcp --dport 53 -j DNAT --to-destination "${dns}:53" 2>/dev/null || true

  log::debug "Removed guest DNS redirect"
}