this works, to the extent that i tested it

services/natQueue.js

@@ -0,0 +1,48 @@
+import { error, info, success } from "../util/Console.js";
+import { runRouterCmds } from "./sshExec.js";
+
+const queue = [];
+let running = false;
+
+function enqueue(task) {
+    queue.push(task);
+    if (!running) processQueue();
+}
+
+async function processQueue() {
+    if (queue.length === 0) { running = false; return; }
+    running = true;
+    const t = queue.shift();
+    try { await t(); } catch (err) { error('Queue error: ' + String(err)); }
+    setImmediate(processQueue);
+}
+
+export function enqueueCmd(fn) {
+    enqueue(() => fn());
+}
+
+export function enqueueNatAdd(ip, port, proto='tcp') {
+    enqueue(async () => {
+        info(`NAT ADD ${proto} ${ip}:${port}`);
+        await runRouterCmds([
+            'conf t',
+            `ip nat inside source static ${proto} ${ip} ${port} interface ${process.env.ROUTER_WAN_IF || 'gi0'} ${port}`,
+            'end',
+            'wr mem'
+        ]);
+        success(`NAT ADDED ${proto} ${ip}:${port}`);
+    });
+}
+
+export function enqueueNatRemove(ip, port, proto='tcp') {
+    enqueue(async () => {
+        info(`NAT DEL ${proto} ${ip}:${port}`);
+        await runRouterCmds([
+            'conf t',
+            `no ip nat inside source static ${proto} ${ip} ${port} interface ${process.env.ROUTER_WAN_IF || 'gi0'} ${port}`,
+            'end',
+            'wr mem'
+        ]);
+        success(`NAT DELETED ${proto} ${ip}:${port}`);
+    });
+}

services/sshExec.js

@@ -0,0 +1,58 @@
+import { Client } from "ssh2";
+import { info } from "../util/Console.js";
+import fs from 'fs';
+
+
+export function runRouterCmds(cmds, onData) {
+    const ROUTER = {
+        host: process.env.ROUTER_HOST || '192.168.0.1',
+        username: process.env.ROUTER_USER || 'cisco',
+        password: process.env.ROUTER_PASS || '',
+        wanInterface: process.env.ROUTER_WAN_IF || 'gi0'
+    };
+
+    return new Promise((resolve, reject) => {
+        const conn = new Client();
+        let out = '';
+        conn.on('ready', () => {
+            conn.shell((err, stream) => {
+                if (err) return reject(err);
+                stream.on('data', d => {
+                    const s = d.toString();
+                    out += s;
+                    if (onData) onData(s);
+                });
+                stream.on('close', () => {
+                    conn.end();
+                    resolve(out);
+                });
+                cmds.forEach(c => stream.write(c + '\n'));
+                stream.end('exit\n');
+            });
+        }).on('error', reject).connect({
+            host: ROUTER.host,
+            username: ROUTER.username,
+            password: ROUTER.password,
+            readyTimeout: 20000,
+            algorithms: {
+                kex: [
+                    'diffie-hellman-group14-sha1',
+                    'diffie-hellman-group-exchange-sha1',
+                ],
+                cipher: [
+                    'aes128-ctr',
+                    'aes192-ctr',
+                    'aes256-ctr',
+                ],
+                serverHostKey: [
+                    'ssh-rsa',
+                ],
+                hmac: [
+                    'hmac-sha1',
+                    'hmac-sha2-256',
+                ]
+            },
+            hostVerifier: () => true
+        });
+    });
+}