def audit_fw_counts(clients_dir):
    """Return peer_name:fw_count pairs from iptables and client configs"""
    import glob, subprocess
    
    # Get iptables output once
    try:
        result = subprocess.run(
            ['iptables', '-L', 'FORWARD', '-n'],
            capture_output=True, text=True
        )
        fw_output = result.stdout
    except:
        fw_output = ""
    
    # Build ip->name and count rules
    for conf in glob.glob(f"{clients_dir}/*.conf"):
        name = os.path.basename(conf).replace('.conf', '')
        try:
            with open(conf) as f:
                for line in f:
                    if line.startswith('Address'):
                        ip = line.split('=')[1].strip().split('/')[0]
                        count = fw_output.count(ip)
                        print(f"{name}:{count}")
                        break
        except:
            pass