From 034e6688defecbfe4a1e855e49f4fc442e1c2733 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Sat, 11 Jul 2026 09:09:48 +0100
Subject: [PATCH] firewall: apply redirects in all modes, persist across
 reboots

---
 tools/nextwks.sh | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/tools/nextwks.sh b/tools/nextwks.sh
index a8e38b0..0fe311f 100755
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@@ -154,18 +154,29 @@ if [ "$MODE" = "install" ]; then
 fi
 
 # ============================================================
-# 3. FIREWALL SETUP (install mode only)
+# 3. FIREWALL SETUP (all modes)
 # ============================================================
 if [ "$MODE" = "install" ]; then
     echo "[*] Applying firewall and port redirects (80→8080, 443→8443)..."
     maybe_sudo bash "$BUILD_DIR/tools/firewall-routing.sh"
-    # Persist across reboots
-    if command -v netfilter-persistent &>/dev/null; then
-        maybe_sudo netfilter-persistent save 2>/dev/null || true
-    else
-        maybe_sudo mkdir -p /etc/iptables
-        maybe_sudo sh -c 'iptables-save > /etc/iptables/rules.v4'
-    fi
+elif [ "$MODE" = "update" ] || [ "$MODE" = "destroy" ]; then
+    # Lightweight: ensure redirects exist without flushing existing rules
+    echo "[*] Ensuring port redirects (80→8080, 443→8443)..."
+    maybe_sudo iptables -t nat -C PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080 2>/dev/null || \
+        maybe_sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
+    maybe_sudo iptables -t nat -C PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443 2>/dev/null || \
+        maybe_sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443
+    maybe_sudo iptables -t nat -C OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-ports 8080 2>/dev/null || \
+        maybe_sudo iptables -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-ports 8080
+    maybe_sudo iptables -t nat -C OUTPUT -o lo -p tcp --dport 443 -j REDIRECT --to-ports 8443 2>/dev/null || \
+        maybe_sudo iptables -t nat -A OUTPUT -o lo -p tcp --dport 443 -j REDIRECT --to-ports 8443
+fi
+# Persist across reboots (always)
+if command -v netfilter-persistent &>/dev/null; then
+    maybe_sudo netfilter-persistent save 2>/dev/null || true
+else
+    maybe_sudo mkdir -p /etc/iptables
+    maybe_sudo sh -c 'iptables-save > /etc/iptables/rules.v4'
 fi
 
 # ============================================================