Add per-server NAT egress, ip_forward auto-enable, OPNsense import review checklist

- ServerSetting gains WanInterface/EgressSNATIP for optional per-server
  masquerade/SNAT of client traffic, isolated in each server's own
  nftables table
- wireguard.Start/Restart now ensure net.ipv4.ip_forward and
  net.ipv6.conf.all.forwarding are enabled before bringing an interface up
- OPNsense config.xml import now parses staticroutes/filter/nat rules and
  surfaces them as a manual-review checklist in the preview UI (never
  auto-applied)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATVUwTa4Pqwq26orW5BcDW

opnsense/parse.go

@@ -60,6 +60,53 @@ type rawConfig struct {
 			} `xml:"general"`
 		} `xml:"wireguard"`
 	} `xml:"OPNsense"`
+	StaticRoutes struct {
+		Route []rawStaticRoute `xml:"route"`
+	} `xml:"staticroutes"`
+	Filter struct {
+		Rule []rawFilterRule `xml:"rule"`
+	} `xml:"filter"`
+	Nat struct {
+		Outbound struct {
+			Mode string        `xml:"mode"`
+			Rule []rawNatRule `xml:"rule"`
+		} `xml:"outbound"`
+	} `xml:"nat"`
+}
+
+// rawStaticRoute mirrors <staticroutes><route> - a manually configured
+// route not otherwise expressible via WireGuard's own tunneladdress/peers
+// fields. Surfaced as a review item only; never auto-applied.
+type rawStaticRoute struct {
+	Network string `xml:"network"`
+	Gateway string `xml:"gateway"`
+	Descr   string `xml:"descr"`
+}
+
+// rawFilterRule mirrors <filter><rule> - a firewall rule. Only the fields
+// needed to flag rules that reference a WireGuard interface are captured.
+type rawFilterRule struct {
+	Type        string `xml:"type"`
+	Interface   string `xml:"interface"`
+	Descr       string `xml:"descr"`
+	Source      struct {
+		Network string `xml:"network"`
+	} `xml:"source"`
+	Destination struct {
+		Network string `xml:"network"`
+	} `xml:"destination"`
+}
+
+// rawNatRule mirrors <nat><outbound><rule> - a manual outbound NAT/SNAT
+// rule. Surfaced as a review item so the admin can recreate the
+// equivalent via ServerSetting.WanInterface/EgressSNATIP if needed.
+type rawNatRule struct {
+	Interface string `xml:"interface"`
+	Source    struct {
+		Network string `xml:"network"`
+	} `xml:"source"`
+	Target string `xml:"target"`
+	Descr  string `xml:"descr"`
 }
 
 type rawServer struct {
@@ -94,8 +141,11 @@ type rawClient struct {
 // ParsedConfig is the raw parsed result, before any admin-editable mapping
 // is applied.
 type ParsedConfig struct {
-	Servers []rawServer
-	Clients []rawClient
+	Servers      []rawServer
+	Clients      []rawClient
+	StaticRoutes []rawStaticRoute
+	FilterRules  []rawFilterRule
+	NatRules     []rawNatRule
 }
 
 // Parse reads an OPNsense config.xml document and extracts the WireGuard
@@ -114,8 +164,11 @@ func Parse(r io.Reader) (*ParsedConfig, error) {
 	}
 
 	return &ParsedConfig{
-		Servers: cfg.Ns.Wireguard.Server.Servers.Server,
-		Clients: cfg.Ns.Wireguard.Client.Clients.Client,
+		Servers:      cfg.Ns.Wireguard.Server.Servers.Server,
+		Clients:      cfg.Ns.Wireguard.Client.Clients.Client,
+		StaticRoutes: cfg.StaticRoutes.Route,
+		FilterRules:  cfg.Filter.Rule,
+		NatRules:     cfg.Nat.Outbound.Rule,
 	}, nil
 }