fix: resolve ghost iptables rules, set -e crashes, and automate MASQUERADE NAT

wg-policy-cleanup.sh

@@ -1,8 +1,7 @@
 #!/bin/bash
 # wg-policy-cleanup.sh — Clean removal of all policy artifacts
-# Fixed: proper loop, ipset cleanup, IPv6 cleanup
 
-set -euo pipefail
+set -uo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/wg-policy-lib.sh"
@@ -10,10 +9,26 @@ source "${SCRIPT_DIR}/wg-policy-lib.sh"
 main() {
     log_info "Starting cleanup..."
 
+    local DEF_IF
+    DEF_IF="$(detect_default_if)"
+
+    # === Base Routing Cleanup ===
+    while iptables -D FORWARD -o "$WG_IF" -j ACCEPT 2>/dev/null; do :; done
+    while iptables -t nat -D POSTROUTING -o "$DEF_IF" -j MASQUERADE 2>/dev/null; do :; done
+    log_info "Removed base routing and NAT rules"
+
     # === IPv4 chain cleanup ===
     local removed=0
-    while iptables -D FORWARD -i "$WG_IF" -j "$CHAIN" 2>/dev/null; do
-        (( removed++ ))
+
+    while true; do
+        local line=""
+        line=$(iptables -nL FORWARD --line-numbers 2>/dev/null | grep "$CHAIN" | awk '{print $1}' | head -n 1 || true)
+        if [[ -n "$line" ]]; then
+            iptables -D FORWARD "$line" 2>/dev/null || break
+            (( removed++ ))
+        else
+            break
+        fi
     done
 
     if (( removed > 0 )); then
@@ -29,7 +44,15 @@ main() {
 
     # === IPv6 chain cleanup ===
     if command -v ip6tables &>/dev/null; then
-        while ip6tables -D FORWARD -i "$WG_IF" -j "$CHAIN" 2>/dev/null; do :; done
+        while true; do
+            local line6=""
+            line6=$(ip6tables -nL FORWARD --line-numbers 2>/dev/null | grep "$CHAIN" | awk '{print $1}' | head -n 1 || true)
+            if [[ -n "$line6" ]]; then
+                ip6tables -D FORWARD "$line6" 2>/dev/null || break
+            else
+                break
+            fi
+        done
         ip6tables -F "$CHAIN" 2>/dev/null || true
         ip6tables -X "$CHAIN" 2>/dev/null || true
         ip6tables -F "$CHAIN_BACKUP" 2>/dev/null || true