function cmd::fw::list() {
  local peer="" type=""
  while [[ $# -gt 0 ]]; do
    case "$1" in
      --peer) peer="$2"; shift 2 ;;
      --type) type="$2"; shift 2 ;;
      *) shift ;;
    esac
  done

    log::section "Firewall Rules (FORWARD)"

  if [[ -n "$peer" ]]; then
    local ip
    ip=$(peers::get_ip "$peer")
    [[ -z "$ip" ]] && log::error "Peer not found: $peer" && return 1
    printf "\n"
    iptables -L FORWARD -n -v | grep -F "$ip"
    printf "\n"
  elif [[ -n "$type" ]]; then
    local subnet
    subnet=$(config::subnet_for "$type")
    [[ -z "$subnet" ]] && log::error "Unknown type: $type" && return 1
    printf "\n"
    iptables -L FORWARD -n -v | grep -F "$subnet"
    printf "\n"
  else
    printf "\n"
    iptables -L FORWARD -n -v | grep -v "^Chain\|^target\|^$\|ACCEPT.*0\.0\.0\.0.*0\.0\.0\.0"
    printf "\n"
  fi
}

function cmd::fw::nat() {
  log::section "NAT Rules (PREROUTING)"
  iptables -t nat -L PREROUTING -n -v
}