fix: resolve ghost iptables rules, set -e crashes, and automate MASQUERADE NAT

README.md

@@ -54,28 +54,27 @@ To integrate the engine, you need to append hooks into your `wg0.conf` interface
 ### 1. Interface Block (Hooks)
 Add the `PostUp` and `PostDown` scripts so the engine initializes correctly during VPN startup and removes traces upon shutdown.
 
+> **⚠️ WireGuard does NOT support multiline values.** Every command must be on a `PostUp = ...` or `PostDown = ...` line. Bare commands without the `PostUp =` prefix will cause `Configuration parsing error`.
+
 ```ini
 [Interface]
 Address = 10.0.0.1/24
 ListenPort = 51820
 PrivateKey = <SERVER_PRIVATE_KEY>
 
-# PostUp: sync policy + apply engine
-# default PostUp
-iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;
-# modification
-PostUp = /usr/local/bin/wg-sync-policy.sh && /usr/local/bin/wg-policy-engine.sh
+# Policy engine: auto-handles NAT, IP forwarding, and dynamic firewall rules
+PostUp = /usr/local/bin/wg-sync-policy.sh; /usr/local/bin/wg-policy-engine.sh
 
-# PostDown: safe cleanup
-# default PostUp
-iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;
-# modification
+# Policy engine: cleanup all firewall and routing traces
 PostDown = /usr/local/bin/wg-policy-cleanup.sh
 ```
 
 ### 2. Peer Block (`#Access` Tags)
 For each client, use the `#Access` comment line. Define the destinations (targets) the peer is allowed to access. You can separate multiple IPs or CIDRs with commas or semicolons.
 
+> **⚠️ WARNING: Do NOT use `SaveConfig = true`!**
+> WireGuard's `SaveConfig` feature overwrites `wg0.conf` directly and **strips all comments**, which will permanently delete all `#Access` tags. If you are using a Web UI/Dashboard, make sure it does not strip unknown comments when saving.
+
 ```ini
 [Peer]
 PublicKey = <CLIENT_1_PUBKEY>