Add firewall rules logic for all hosts

README.md

@@ -52,6 +52,36 @@ The install script will:
 8. Install the `wg-quick` helper script
 9. Set up a systemd or OpenRC service (`wgui`)
 
+The installer **never modifies your firewall** — it will print the commands to
+temporarily allow the dashboard port so you can reach the first login, and then
+point you to **Setup → Firewall** for reviewing and removing rules.
+
+### Firewall
+
+Firewall rules are managed per host, automatically:
+
+1. **Bootstrap (manual, temporary)** — allow the dashboard port so you can
+   reach the web UI once:
+   ```bash
+   ufw allow 10752/tcp          # ufw (Debian/Ubuntu)
+   firewall-cmd --permanent --add-port=10752/tcp && firewall-cmd --reload   # firewalld (RHEL/Fedora)
+   ```
+2. **Host creation** — every host setup automatically allows its entire
+   wireguard subnet (e.g. `10.5.0.1` → `10.5.0.0/24` from anywhere) and the
+   host's wireguard listen port (e.g. `51821/udp`) in ufw or firewalld.
+   Detailed per-client traffic rules are enforced by the existing iptables
+   chain scripts, not the host firewall.
+3. **Host deletion** — the host's subnet and listen-port rules are removed
+   automatically.
+4. **Cleanup** — once everything is reachable via the tunnel, remove the
+   temporary bootstrap rule and review all rules under **Setup → Firewall**:
+   ```bash
+   ufw delete allow 10752/tcp
+   firewall-cmd --permanent --remove-port=10752/tcp && firewall-cmd --reload
+   ```
+   Rules that no longer match any host (`temporary`/`orphaned`) are flagged
+   with copyable removal commands on the setup page.
+
 ### Manual (Development)
 
 ```bash