diff --git a/DEVLOG.md b/DEVLOG.md
index 85b9449..0d314ca 100644
--- a/DEVLOG.md
+++ b/DEVLOG.md
@@ -3461,3 +3461,139 @@ Keine Commits in dieser Session.
 - templates/wg.conf | 12 ++++++++++--
 
 ---
+## 2026-07-29 13:08 – 13:09 (1m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+- 83b1da2 Add per-server NAT egress, ip_forward auto-enable, OPNsense import review checklist
+
+### Geänderte Dateien
+- DEVLOG.md              | 942 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- firewall/nftables.go   |  12 +++
+- model/setting.go       |  10 +++
+- opnsense/map.go        |  57 +++++++++++++-
+- opnsense/parse.go      |  61 ++++++++++++++-
+- templates/servers.html |  31 ++++++++
+- wireguard/service.go   |  24 ++++++
+
+---
+## 2026-07-29 13:10 – 13:11 (1m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md              | 942 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- firewall/nftables.go   |  12 +++
+- model/setting.go       |  10 +++
+- opnsense/map.go        |  57 +++++++++++++-
+- opnsense/parse.go      |  61 ++++++++++++++-
+- templates/servers.html |  31 ++++++++
+- wireguard/service.go   |  24 ++++++
+
+---
+## 2026-07-29 13:14 – 13:19 (4m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md              | 942 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- firewall/nftables.go   |  12 +++
+- model/setting.go       |  10 +++
+- opnsense/map.go        |  57 +++++++++++++-
+- opnsense/parse.go      |  61 ++++++++++++++-
+- templates/servers.html |  31 ++++++++
+- wireguard/service.go   |  24 ++++++
+
+---
+## 2026-07-29 13:24 – 13:25 (1m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md              | 942 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- firewall/nftables.go   |  12 ++
+- model/setting.go       |  10 +
+- opnsense/map.go        |  57 +++++-
+- opnsense/parse.go      |  61 ++++++-
+- templates/servers.html |  31 ++++
+- wireguard/service.go   |  24 +++
+
+---
+## 2026-07-29 13:27 – 13:28 (1m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md              | 942 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- firewall/nftables.go   |  12 ++
+- model/setting.go       |  10 +
+- opnsense/map.go        |  57 +++++-
+- opnsense/parse.go      |  61 ++++++-
+- templates/servers.html |  31 ++++
+- wireguard/service.go   |  24 +++
+
+---
+## 2026-07-29 13:30 – 13:31 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md              | 942 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- firewall/nftables.go   |  12 ++
+- model/setting.go       |  10 +
+- opnsense/map.go        |  57 +++++-
+- opnsense/parse.go      |  61 ++++++-
+- templates/servers.html |  31 ++++
+- wireguard/service.go   |  24 +++
+
+---
+## 2026-07-29 13:32 – 13:32 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md              | 942 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- firewall/nftables.go   |  12 ++
+- model/setting.go       |  10 +
+- opnsense/map.go        |  57 +++++-
+- opnsense/parse.go      |  61 ++++++-
+- templates/servers.html |  31 ++++
+- wireguard/service.go   |  24 +++
+
+---
+## 2026-07-29 13:35 – 13:36 (1m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md              | 942 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- firewall/nftables.go   |  12 ++
+- model/setting.go       |  10 +
+- opnsense/map.go        |  57 +++++-
+- opnsense/parse.go      |  61 ++++++-
+- templates/servers.html |  31 ++++
+- wireguard/service.go   |  24 +++
+
+---
diff --git a/wireguard/service.go b/wireguard/service.go
index 7bca37b..49f582a 100644
--- a/wireguard/service.go
+++ b/wireguard/service.go
@@ -17,16 +17,22 @@ func UnitName(iface string) string {
 }
 
 // Start brings up the given WireGuard interface via
-// `systemctl start wg-quick@<iface>.service`.
+// `systemctl enable --now wg-quick@<iface>.service`. Enabling (not just
+// starting) is deliberate: a server that's up now but not enabled silently
+// vanishes on the next reboot, taking its PostUp-installed cross-tunnel
+// routes with it, with no error anywhere to point at - this makes "started
+// from the UI" and "survives a reboot" the same action instead of two.
 func Start(ctx context.Context, iface string) error {
 	EnsureIPForwarding()
-	return runSystemctl(ctx, "start", iface)
+	return runSystemctlArgs(ctx, iface, "enable", "--now")
 }
 
 // Stop brings down the given WireGuard interface via
-// `systemctl stop wg-quick@<iface>.service`.
+// `systemctl disable --now wg-quick@<iface>.service`. Disabling mirrors
+// Start's enable: an admin-initiated stop should stay stopped after a
+// reboot too, not silently come back.
 func Stop(ctx context.Context, iface string) error {
-	return runSystemctl(ctx, "stop", iface)
+	return runSystemctlArgs(ctx, iface, "disable", "--now")
 }
 
 // Restart restarts the given WireGuard interface via
@@ -57,13 +63,18 @@ func setSysctl(path string) {
 }
 
 func runSystemctl(ctx context.Context, action, iface string) error {
+	return runSystemctlArgs(ctx, iface, action)
+}
+
+func runSystemctlArgs(ctx context.Context, iface string, action ...string) error {
 	if !util.ValidateInterfaceName(iface) {
 		return fmt.Errorf("invalid interface name: %q", iface)
 	}
-	cmd := exec.CommandContext(ctx, "systemctl", action, UnitName(iface))
+	args := append(append([]string{}, action...), UnitName(iface))
+	cmd := exec.CommandContext(ctx, "systemctl", args...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
-		return fmt.Errorf("systemctl %s %s failed: %w: %s", action, UnitName(iface), err, string(out))
+		return fmt.Errorf("systemctl %s %s failed: %w: %s", strings.Join(action, " "), UnitName(iface), err, string(out))
 	}
 	return nil
 }