Usage: wgctl rule <subcommand> [options]

Manage firewall rules with inheritance support.
Rules can extend base rules to compose reusable access policies.
Service names from 'wgctl net' can be used instead of raw IPs/ports.

Subcommands:
  list, ls                    List all rules
  show, inspect               Show rule details and inheritance
  add, new, create            Create a new rule
  update, edit                Update a rule and re-apply to peers
  remove, rm, del             Remove a rule
  assign                      Assign a rule to a peer
  unassign                    Remove rule from a peer
  reapply                     Re-apply rule to all assigned peers
  migrate                     Apply default rules to unassigned peers

Options for list:
  --base                      Show only base rules
  --no-base                   Hide base rules section
  --group <name>              Filter by group (case insensitive)
  --tree                      Show full inheritance tree inline

Options for add:
  --name <name>               Rule name
  --desc <description>        Description
  --group <group>             Display group (e.g. VM Rules, Users)
  --extends <rule,...>        Inherit from base rules (comma-separated)