From 4e1228fff0ba7e7db54ec1e148557f50b0263f31 Mon Sep 17 00:00:00 2001
From: serinko <97586125+serinko@users.noreply.github.com>
Date: Thu, 13 Nov 2025 16:43:39 +0100
Subject: [PATCH] ensure cars passing in a shell

---
 .../nym-node-setup/network-tunnel-manager.sh  | 25 +++++++++++++++----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/scripts/nym-node-setup/network-tunnel-manager.sh b/scripts/nym-node-setup/network-tunnel-manager.sh
index 2f3d9b2424..eac8a4112a 100644
--- a/scripts/nym-node-setup/network-tunnel-manager.sh
+++ b/scripts/nym-node-setup/network-tunnel-manager.sh
@@ -625,21 +625,36 @@ EOF
   total_rules=$(grep "^ExitPolicy reject" "$POLICY_FILE" | grep -v "\*:\*" | wc -l || true)
   echo "processing $total_rules blocklist rules"
 
-  grep "^ExitPolicy reject" "$POLICY_FILE" | grep -v "\*:\*" | while read -r line; do
+  #
+  # main loop — no subshell, safe variable handling
+  #
+  while read -r line; do
+    [[ -z "$line" ]] && continue
+
     local ip_range
     ip_range=$(echo "$line" | sed -E 's/ExitPolicy reject ([^:]+):.*/\1/')
 
     if [[ -n "$ip_range" ]]; then
+
+      # ipv4 reject
       if ! iptables -C "$NYM_CHAIN" -d "$ip_range" -j REJECT 2>/dev/null; then
-        iptables -A "$NYM_CHAIN" -d "$ip_range" -j REJECT
+        iptables -A "$NYM_CHAIN" -d "$ip_range" -j REJECT || \
+          echo "warning: failed adding ipv4 reject for $ip_range"
       fi
-      if [[ "$ip_range" == *":"* ]] && ! ip6tables -C "$NYM_CHAIN" -d "$ip_range" -j REJECT 2>/dev/null; then
-        ip6tables -A "$NYM_CHAIN" -d "$ip_range" -j REJECT
+
+      # ipv6 reject
+      if [[ "$ip_range" == *":"* ]]; then
+        if ! ip6tables -C "$NYM_CHAIN" -d "$ip_range" -j REJECT 2>/dev/null; then
+          ip6tables -A "$NYM_CHAIN" -d "$ip_range" -j REJECT || \
+            echo "warning: failed adding ipv6 reject for $ip_range"
+        fi
       fi
     fi
-  done
+
+  done < <(grep "^ExitPolicy reject" "$POLICY_FILE" | grep -v "\*:\*")
 }
 
+
 add_default_reject_rule() {
   echo "ensuring default reject rule at end of ${NYM_CHAIN}"