From 781e74f77aec103604e9140be21f3b390478adb6 Mon Sep 17 00:00:00 2001
From: Quentin McGaw <quentin.mcgaw@gmail.com>
Date: Sat, 28 Feb 2026 15:25:15 +0000
Subject: [PATCH] chore: merge iptables SetIPv4AllPolicies and
 SetIPv6AllPolicies together

---
 internal/firewall/enable.go             |  6 +-----
 internal/firewall/interfaces.go         |  3 +--
 internal/firewall/iptables/ip6tables.go | 15 ---------------
 internal/firewall/iptables/iptables.go  |  5 +++--
 4 files changed, 5 insertions(+), 24 deletions(-)

diff --git a/internal/firewall/enable.go b/internal/firewall/enable.go
index 6f5cb18b..7ba20e56 100644
--- a/internal/firewall/enable.go
+++ b/internal/firewall/enable.go
@@ -51,11 +51,7 @@ func (c *Config) enable(ctx context.Context) (err error) {
 		}
 	}()
 
-	if err = c.impl.SetIPv4AllPolicies(ctx, "DROP"); err != nil {
-		return err
-	}
-
-	if err = c.impl.SetIPv6AllPolicies(ctx, "DROP"); err != nil {
+	if err = c.impl.SetBaseChainsPolicy(ctx, "DROP"); err != nil {
 		return err
 	}
 
diff --git a/internal/firewall/interfaces.go b/internal/firewall/interfaces.go
index a1938f96..ca39f01a 100644
--- a/internal/firewall/interfaces.go
+++ b/internal/firewall/interfaces.go
@@ -34,8 +34,7 @@ type firewallImpl interface { //nolint:interfacebloat
 	RedirectPort(ctx context.Context, intf string, sourcePort,
 		destinationPort uint16, remove bool) error
 	RunUserPostRules(ctx context.Context, customRulesPath string) error
-	SetIPv4AllPolicies(ctx context.Context, policy string) error
-	SetIPv6AllPolicies(ctx context.Context, policy string) error
+	SetBaseChainsPolicy(ctx context.Context, policy string) error
 	TempDropOutputTCPRST(ctx context.Context, src, dst netip.AddrPort, excludeMark int) (
 		revert func(ctx context.Context) error, err error)
 	Version(ctx context.Context) (version string, err error)
diff --git a/internal/firewall/iptables/ip6tables.go b/internal/firewall/iptables/ip6tables.go
index 6e096699..2b89ac4c 100644
--- a/internal/firewall/iptables/ip6tables.go
+++ b/internal/firewall/iptables/ip6tables.go
@@ -81,18 +81,3 @@ func (c *Config) runIP6tablesInstructionNoSave(ctx context.Context, instruction
 	}
 	return nil
 }
-
-var ErrPolicyNotValid = errors.New("policy is not valid")
-
-func (c *Config) SetIPv6AllPolicies(ctx context.Context, policy string) error {
-	switch policy {
-	case "ACCEPT", "DROP":
-	default:
-		return fmt.Errorf("%w: %s", ErrPolicyNotValid, policy)
-	}
-	return c.runIP6tablesInstructions(ctx, []string{
-		"--policy INPUT " + policy,
-		"--policy OUTPUT " + policy,
-		"--policy FORWARD " + policy,
-	})
-}
diff --git a/internal/firewall/iptables/iptables.go b/internal/firewall/iptables/iptables.go
index d97b306b..6bc6d1e0 100644
--- a/internal/firewall/iptables/iptables.go
+++ b/internal/firewall/iptables/iptables.go
@@ -98,13 +98,14 @@ func (c *Config) runIptablesInstructionNoSave(ctx context.Context, instruction s
 	return nil
 }
 
-func (c *Config) SetIPv4AllPolicies(ctx context.Context, policy string) error {
+func (c *Config) SetBaseChainsPolicy(ctx context.Context, policy string) error {
+	policy = strings.ToUpper(policy)
 	switch policy {
 	case "ACCEPT", "DROP":
 	default:
 		return fmt.Errorf("%w: %s", ErrPolicyUnknown, policy)
 	}
-	return c.runIptablesInstructions(ctx, []string{
+	return c.runMixedIptablesInstructions(ctx, []string{
 		"--policy INPUT " + policy,
 		"--policy OUTPUT " + policy,
 		"--policy FORWARD " + policy,