fix(firewall/iptables): shared mutex for both iptables and ip6tables

internal/firewall/firewall.go

@@ -10,12 +10,11 @@ import (
 )
 
 type Config struct {
-	runner         CmdRunner
+	runner        CmdRunner
-	logger         Logger
+	logger        Logger
-	iptablesMutex  sync.Mutex
+	iptablesMutex sync.Mutex
-	ip6tablesMutex sync.Mutex
+	defaultRoutes []routing.DefaultRoute
-	defaultRoutes  []routing.DefaultRoute
+	localNetworks []routing.LocalNetwork
-	localNetworks  []routing.LocalNetwork
 
 	// Fixed state
 	ipTables        string

internal/firewall/ip6tables.go

@@ -36,8 +36,8 @@ func (c *Config) runIP6tablesInstruction(ctx context.Context, instruction string
 	if c.ip6Tables == "" {
 		return nil
 	}
-	c.ip6tablesMutex.Lock() // only one ip6tables command at once
+	c.iptablesMutex.Lock() // only one ip6tables command at once
-	defer c.ip6tablesMutex.Unlock()
+	defer c.iptablesMutex.Unlock()
 
 	if isDeleteMatchInstruction(instruction) {
 		return deleteIPTablesRule(ctx, c.ip6Tables, instruction,

internal/firewall/iptables.go

@@ -215,6 +215,9 @@ func (c *Config) redirectPort(ctx context.Context, intf string,
 		interfaceFlag = ""
 	}
 
+	c.iptablesMutex.Lock()
+	defer c.iptablesMutex.Unlock()
+
 	err = c.runIptablesInstructions(ctx, []string{
 		fmt.Sprintf("-t nat %s PREROUTING %s -p tcp --dport %d -j REDIRECT --to-ports %d",
 			appendOrDelete(remove), interfaceFlag, sourcePort, destinationPort),