diff --git a/src/config.js b/src/config.js
index 9811c90..a08aab3 100644
--- a/src/config.js
+++ b/src/config.js
@@ -15,3 +15,12 @@ module.exports.WG_DEFAULT_DNS = typeof process.env.WG_DEFAULT_DNS === 'string'
   ? process.env.WG_DEFAULT_DNS
   : '1.1.1.1';
 module.exports.WG_ALLOWED_IPS = process.env.WG_ALLOWED_IPS || '0.0.0.0/0, ::/0';
+
+module.exports.WG_POST_UP = process.env.WG_POST_UP || `
+iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE;
+iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT;
+iptables -A FORWARD -i wg0 -j ACCEPT;
+iptables -A FORWARD -o wg0 -j ACCEPT;
+`.split('\n').join(' ');
+
+module.exports.WG_POST_DOWN = process.env.WG_POST_DOWN || '';
diff --git a/src/lib/WireGuard.js b/src/lib/WireGuard.js
index 816d50a..032854f 100644
--- a/src/lib/WireGuard.js
+++ b/src/lib/WireGuard.js
@@ -19,6 +19,8 @@ const {
   WG_DEFAULT_ADDRESS,
   WG_PERSISTENT_KEEPALIVE,
   WG_ALLOWED_IPS,
+  WG_POST_UP,
+  WG_POST_DOWN,
 } = require('../config');
 
 module.exports = class WireGuard {
@@ -63,10 +65,10 @@ module.exports = class WireGuard {
 
           throw err;
         });
-        await Util.exec(`iptables -t nat -A POSTROUTING -s ${WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE`);
-        await Util.exec('iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT');
-        await Util.exec('iptables -A FORWARD -i wg0 -j ACCEPT');
-        await Util.exec('iptables -A FORWARD -o wg0 -j ACCEPT');
+        // await Util.exec(`iptables -t nat -A POSTROUTING -s ${WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE`);
+        // await Util.exec('iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT');
+        // await Util.exec('iptables -A FORWARD -i wg0 -j ACCEPT');
+        // await Util.exec('iptables -A FORWARD -o wg0 -j ACCEPT');
         await this.__syncConfig();
 
         return config;
@@ -91,7 +93,10 @@ module.exports = class WireGuard {
 [Interface]
 PrivateKey = ${config.server.privateKey}
 Address = ${config.server.address}/24
-ListenPort = 51820`;
+ListenPort = 51820
+PostUp = ${WG_POST_UP}
+PostDown = ${WG_POST_DOWN}
+`;
 
     for (const [clientId, client] of Object.entries(config.clients)) {
       if (!client.enabled) continue;
@@ -105,7 +110,7 @@ PresharedKey = ${client.preSharedKey}
 AllowedIPs = ${client.address}/32`;
     }
 
-    debug('Saving config...');
+    debug('Config saving...');
     await fs.writeFile(path.join(WG_PATH, 'wg0.json'), JSON.stringify(config, false, 2), {
       mode: 0o660,
     });
@@ -116,7 +121,7 @@ AllowedIPs = ${client.address}/32`;
   }
 
   async __syncConfig() {
-    debug('Syncing config...');
+    debug('Config syncing...');
     await Util.exec('wg syncconf wg0 <(wg-quick strip wg0)');
     debug('Config synced.');
   }