function firewall::restore_blocks() {
  local blocks_dir
  blocks_dir="$(ctx::blocks)"

  # Restore rules from meta files (new system)
  rule::restore_all

  # Restore per-client full-blocks (wgctl block/unblock system)
  for block_file in "${blocks_dir}"/*.block; do
    [[ -f "$block_file" ]] || continue
    local name
    name=$(basename "$block_file" .block)
    while IFS=" " read -r client_ip target port proto; do
      if [[ -z "$target" ]]; then
        firewall::block_all "$client_ip" "$name"
      elif [[ -n "$port" ]]; then
        firewall::block_port "$client_ip" "$target" "$port" "${proto:-tcp}"
      else
        firewall::block_ip "$client_ip" "$target"
      fi
    done < "$block_file"
    log::wg "Restored block rules for: ${name}"
  done
}