diff --git a/src/config.js b/src/config.js
index 09fbcf3e..ff186d03 100644
--- a/src/config.js
+++ b/src/config.js
@@ -20,12 +20,12 @@ module.exports.WG_ALLOWED_IPS = process.env.WG_ALLOWED_IPS || '0.0.0.0/0, ::/0';
 
 module.exports.WG_PRE_UP = process.env.WG_PRE_UP || '';
 module.exports.WG_POST_UP = process.env.WG_POST_UP || `
-iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o ${module.exports.WG_DEVICE} -j MASQUERADE;
-iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT;
-iptables -A FORWARD -i wg0 -j ACCEPT;
-iptables -A FORWARD -o wg0 -j ACCEPT;
+iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o ${module.exports.WG_DEVICE} -j MASQUERADE -m comment --comment "wg-easy rule";
+iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT -m comment --comment "wg-easy rule";
+iptables -A FORWARD -i wg0 -j ACCEPT -m comment --comment "wg-easy rule";
+iptables -A FORWARD -o wg0 -j ACCEPT -m comment --comment "wg-easy rule";
 `.split('\n').join(' ');
 
-module.exports.WG_PRE_DOWN = process.env.WG_PRE_DOWN || '';
+module.exports.WG_PRE_DOWN = process.env.WG_PRE_DOWN || 'iptables-save | grep -vF "wg-easy rule" | iptables-restore';
 module.exports.WG_POST_DOWN = process.env.WG_POST_DOWN || '';
 module.exports.LANG = process.env.LANG || 'en';