···280280fi
281281282282echo "$PROG: press Ctrl+C to stop"
283283-dnsmasq "${DNSMASQ_OPTS[@]}"
283283+284284+# dnsmasq must not be a foreground child: a trap set while bash blocks on an
285285+# external command is deferred until that command returns, and sudo runs us in
286286+# its own pty/process group so the terminal's SIGINT never reaches dnsmasq
287287+# either. The result was a Ctrl+C that did nothing at all. Backgrounding it and
288288+# blocking in `wait` (a builtin, so handlers run immediately) means the signal
289289+# is forwarded on, dnsmasq exits, and the EXIT trap tears down the firewall
290290+# rules and darkhttpd.
291291+dnsmasq "${DNSMASQ_OPTS[@]}" &
292292+DNSMASQ_PID=$!
293293+trap 'kill -TERM "$DNSMASQ_PID" 2>/dev/null' INT TERM
294294+wait "$DNSMASQ_PID"