fix: resolve ghost iptables rules, set -e crashes, and automate MASQUERADE NAT

wg-sync-policy.sh

@@ -46,7 +46,7 @@ main() {
     awk '
     BEGIN { RS="\n\\[Peer\\]\n"; FS="\n" }
     NR>1 {
-        ip=""; access=""
+        ip=""; access=""; internet="false"
         for(i=1;i<=NF;i++){
             if($i ~ /^AllowedIPs/) {
                 split($i,a," = ")
@@ -59,12 +59,17 @@ main() {
                 sub(/^#Access[ \t]*=?[ \t]*/, "", $i)
                 access=$i
             }
+            if($i ~ /^#Internet/) {
+                if(tolower($i) ~ /true|yes|1|allow/) {
+                    internet="true"
+                }
+            }
         }
         if(ip!="" && ip!="0.0.0.0" && ip!="::") {
-            printf "%s|%s\n", ip, access
+            printf "%s|%s|%s\n", ip, access, internet
         }
     }
-    ' "$WG_CONF" | while IFS="|" read -r ip access_string; do
+    ' "$WG_CONF" | while IFS="|" read -r ip access_string internet_flag; do
 
         # === VALIDATE CLIENT IP ===
         if ! validate_cidr "$ip"; then
@@ -104,8 +109,8 @@ main() {
         fi
 
         # Write to temp policy
-        jq --arg ip "$ip" --argjson access "$ACCESS_JSON" \
-           '.clients[$ip] = {"name": $ip, "access": $access}' \
+        jq --arg ip "$ip" --argjson access "$ACCESS_JSON" --argjson internet "$internet_flag" \
+           '.clients[$ip] = {"name": $ip, "access": $access, "internet": $internet}' \
            "$tmp_policy" > "${tmp_policy}.tmp" && mv "${tmp_policy}.tmp" "$tmp_policy"
 
     done