this works, to the extent that i tested it

services/natQueue.js

@@ -0,0 +1,48 @@
+import { error, info, success } from "../util/Console.js";
+import { runRouterCmds } from "./sshExec.js";
+
+const queue = [];
+let running = false;
+
+function enqueue(task) {
+    queue.push(task);
+    if (!running) processQueue();
+}
+
+async function processQueue() {
+    if (queue.length === 0) { running = false; return; }
+    running = true;
+    const t = queue.shift();
+    try { await t(); } catch (err) { error('Queue error: ' + String(err)); }
+    setImmediate(processQueue);
+}
+
+export function enqueueCmd(fn) {
+    enqueue(() => fn());
+}
+
+export function enqueueNatAdd(ip, port, proto='tcp') {
+    enqueue(async () => {
+        info(`NAT ADD ${proto} ${ip}:${port}`);
+        await runRouterCmds([
+            'conf t',
+            `ip nat inside source static ${proto} ${ip} ${port} interface ${process.env.ROUTER_WAN_IF || 'gi0'} ${port}`,
+            'end',
+            'wr mem'
+        ]);
+        success(`NAT ADDED ${proto} ${ip}:${port}`);
+    });
+}
+
+export function enqueueNatRemove(ip, port, proto='tcp') {
+    enqueue(async () => {
+        info(`NAT DEL ${proto} ${ip}:${port}`);
+        await runRouterCmds([
+            'conf t',
+            `no ip nat inside source static ${proto} ${ip} ${port} interface ${process.env.ROUTER_WAN_IF || 'gi0'} ${port}`,
+            'end',
+            'wr mem'
+        ]);
+        success(`NAT DELETED ${proto} ${ip}:${port}`);
+    });
+}