From c5b20a3b0607776ca05445facd76446d1fadc54c Mon Sep 17 00:00:00 2001
From: Quentin McGaw <quentin.mcgaw@gmail.com>
Date: Mon, 23 Mar 2026 14:09:26 +0000
Subject: [PATCH] fix(firewall/iptables): shared mutex for both iptables and
 ip6tables

---
 internal/firewall/firewall.go  | 11 +++++------
 internal/firewall/ip6tables.go |  4 ++--
 internal/firewall/iptables.go  |  3 +++
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/internal/firewall/firewall.go b/internal/firewall/firewall.go
index f1618443..c78b41f3 100644
--- a/internal/firewall/firewall.go
+++ b/internal/firewall/firewall.go
@@ -10,12 +10,11 @@ import (
 )
 
 type Config struct {
-	runner         CmdRunner
-	logger         Logger
-	iptablesMutex  sync.Mutex
-	ip6tablesMutex sync.Mutex
-	defaultRoutes  []routing.DefaultRoute
-	localNetworks  []routing.LocalNetwork
+	runner        CmdRunner
+	logger        Logger
+	iptablesMutex sync.Mutex
+	defaultRoutes []routing.DefaultRoute
+	localNetworks []routing.LocalNetwork
 
 	// Fixed state
 	ipTables        string
diff --git a/internal/firewall/ip6tables.go b/internal/firewall/ip6tables.go
index 0bcc3f05..41f41572 100644
--- a/internal/firewall/ip6tables.go
+++ b/internal/firewall/ip6tables.go
@@ -36,8 +36,8 @@ func (c *Config) runIP6tablesInstruction(ctx context.Context, instruction string
 	if c.ip6Tables == "" {
 		return nil
 	}
-	c.ip6tablesMutex.Lock() // only one ip6tables command at once
-	defer c.ip6tablesMutex.Unlock()
+	c.iptablesMutex.Lock() // only one ip6tables command at once
+	defer c.iptablesMutex.Unlock()
 
 	if isDeleteMatchInstruction(instruction) {
 		return deleteIPTablesRule(ctx, c.ip6Tables, instruction,
diff --git a/internal/firewall/iptables.go b/internal/firewall/iptables.go
index eaf276ba..16953d3b 100644
--- a/internal/firewall/iptables.go
+++ b/internal/firewall/iptables.go
@@ -215,6 +215,9 @@ func (c *Config) redirectPort(ctx context.Context, intf string,
 		interfaceFlag = ""
 	}
 
+	c.iptablesMutex.Lock()
+	defer c.iptablesMutex.Unlock()
+
 	err = c.runIptablesInstructions(ctx, []string{
 		fmt.Sprintf("-t nat %s PREROUTING %s -p tcp --dport %d -j REDIRECT --to-ports %d",
 			appendOrDelete(remove), interfaceFlag, sourcePort, destinationPort),