"function firewall::restore_blocks" /etc/wireguard/wgctl/modules/firewall.module.sh
function firewall::restore_blocks() {
  local blocks_dir
  blocks_dir="$(ctx::blocks)"

  # Restore guest rules if marker exists
  local marker="${blocks_dir}/_guest_rules.active"
  if [[ -f "$marker" ]]; then
    firewall::apply_guest_rules
    log::wg "Restored guest firewall rules"
  fi

  # Restore per-client block rules
  for block_file in "${blocks_dir}"/*.block; do
    [[ -f "$block_file" ]] || continue

    local name
    name=$(basename "$block_file" .block)

    while IFS=" " read -r client_ip target port proto; do
      if [[ -z "$target" ]]; then
        firewall::block_all "$client_ip" "$name"