inspect:
 ── Firewall (+2 -6) ────────────────────────────

  ACCEPT   10.1.3.5        → 10.0.0.103:53:tcp
  ACCEPT   10.1.3.5        → 10.0.0.103:53:udp
  DROP     10.1.3.5        → 10.0.0.210:9000:tcp
  DROP     10.1.3.5        → 10.0.0.105:8007:tcp
  DROP     10.1.3.5        → 10.0.0.100:8006:tcp
  DROP     10.1.3.5        → 10.0.0.103
  DROP     10.1.3.5        → 10.0.0.100
  DROP     10.1.3.5        → 10.0.0.101

root@wireguard:/etc/wireguard/wgctl# wgctl fw list --peer phone-test

────────────────────────────────────────────────
  Firewall Rules (FORWARD)
────────────────────────────────────────────────

    0     0 ACCEPT     6    --  *      *       10.1.3.5             10.0.0.103           tcp dpt:53
    0     0 ACCEPT     17   --  *      *       10.1.3.5             10.0.0.103           udp dpt:53
    0     0 NFLOG      6    --  *      *       10.1.3.5             10.0.0.210           tcp dpt:9000 nflog-prefix "wgctl-drop:" nflog-group 1
    0     0 DROP       6    --  *      *       10.1.3.5             10.0.0.210           tcp dpt:9000
    0     0 NFLOG      6    --  *      *       10.1.3.5             10.0.0.105           tcp dpt:8007 nflog-prefix "wgctl-drop:" nflog-group 1
    0     0 DROP       6    --  *      *       10.1.3.5             10.0.0.105           tcp dpt:8007
    0     0 NFLOG      6    --  *      *       10.1.3.5             10.0.0.100           tcp dpt:8006 nflog-prefix "wgctl-drop:" nflog-group 1
    0     0 DROP       6    --  *      *       10.1.3.5             10.0.0.100           tcp dpt:8006
    0     0 NFLOG      0    --  *      *       10.1.3.5             10.0.0.103           nflog-prefix "wgctl-drop:" nflog-group 1
    0     0 DROP       0    --  *      *       10.1.3.5             10.0.0.103          
    0     0 NFLOG      0    --  *      *       10.1.3.5             10.0.0.100           nflog-prefix "wgctl-drop:" nflog-group 1
    0     0 DROP       0    --  *      *       10.1.3.5             10.0.0.100          
    0     0 NFLOG      0    --  *      *       10.1.3.5             10.0.0.101           nflog-prefix "wgctl-drop:" nflog-group 1
    0     0 DROP       0    --  *      *       10.1.3.5             10.0.0.101          