diff --git a/src/functions/backend/setup/setup-wireguard-host.ts b/src/functions/backend/setup/setup-wireguard-host.ts
index 7eee8ad..601913a 100644
--- a/src/functions/backend/setup/setup-wireguard-host.ts
+++ b/src/functions/backend/setup/setup-wireguard-host.ts
@@ -58,81 +58,86 @@ export default async function setupWireguardHost({
         };
     }
 
-    const HOST_PUBLIC_KEY = host?.id
-        ? host.public_key
-        : execSync(
-              `cat ${path.join(WIREGUARD_HOST_CONFIG_DIR, WIREGUARD_PUBLIC_KEY_FILE_NAME)}`,
-          );
-    const HOST_PRIVATE_KEY = host?.id
-        ? host.public_key
-        : execSync(
-              `cat ${path.join(WIREGUARD_HOST_CONFIG_DIR, WIREGUARD_PRIVATE_KEY_FILE_NAME)}`,
-          );
-
-    let sh = ``;
-
-    const POST_UP_PATH = path.join(WGUI_LIB_IP_TABLES_DIR, `${host_id}-up.sh`);
-    const POST_DOWN_PATH = path.join(
-        WGUI_LIB_IP_TABLES_DIR,
-        `${host_id}-down.sh`,
-    );
-
-    sh += `cat > ${POST_UP_PATH} << EOF\n`;
-    sh += `#!/bin/bash\n\n`;
-    sh += `# Allow WireGuard traffic to/from the server itself\n`;
-    sh += `iptables -I INPUT 1 -i wg${host_id} -j ACCEPT\n`;
-    sh += `iptables -I OUTPUT 1 -o wg${host_id} -j ACCEPT\n`;
-    sh += `\n`;
-    sh += `# Allow WireGuard traffic to be forwarded (insert above Docker rules)\n`;
-    sh += `iptables -I FORWARD 1 -i wg${host_id} -j ACCEPT\n`;
-    sh += `iptables -I FORWARD 1 -o wg${host_id} -j ACCEPT\n`;
-    sh += `\n`;
-    sh += `iptables -t nat -A POSTROUTING -o ${TARGET_INTERFACE} -j MASQUERADE\n`;
-    sh += `EOF\n`;
-
-    sh += `\n`;
-
-    sh += `cat > ${POST_DOWN_PATH} << EOF\n`;
-    sh += `#!/bin/bash\n\n`;
-    sh += `# Remove WireGuard INPUT/OUTPUT rules\n`;
-    sh += `iptables -D INPUT -i wg${host_id} -j ACCEPT\n`;
-    sh += `iptables -D OUTPUT -o wg${host_id} -j ACCEPT\n`;
-    sh += `\n`;
-    sh += `# Remove FORWARD rules\n`;
-    sh += `iptables -D FORWARD -i wg${host_id} -j ACCEPT\n`;
-    sh += `iptables -D FORWARD -o wg${host_id} -j ACCEPT\n`;
-    sh += `\n`;
-    sh += `iptables -t nat -D POSTROUTING -o ${TARGET_INTERFACE} -j MASQUERADE\n`;
-    sh += `EOF\n`;
-
-    sh += `\n`;
-
-    sh += `cat > wg${host_id}.conf << EOF\n`;
-    sh += `[Interface]\n`;
-    sh += `Address = ${HOST_WG_IP}/24\n`;
-    sh += `ListenPort = 51820\n`;
-    sh += `PrivateKey = ${HOST_PRIVATE_KEY}\n`;
-    sh += `PostUp = ${POST_UP_PATH}\n`;
-    sh += `PostDown = ${POST_DOWN_PATH}\n`;
-    sh += `\n`;
-
-    if (clients[0]) {
-        for (let i = 0; i < clients.length; i++) {
-            const client = clients[i];
-            if (!client?.id || !client.public_key || !client.private_key)
-                continue;
-
-            sh += `[Peer]\n`;
-            sh += `PublicKey = ${client.public_key}\n`;
-            sh += `\n`;
-        }
-    }
-
-    sh += `EOF\n`;
-
-    sh += `\n`;
-
     try {
+        const HOST_PUBLIC_KEY = host?.id
+            ? host.public_key
+            : execSync(
+                  `cat ${path.join(WIREGUARD_HOST_CONFIG_DIR, WIREGUARD_PUBLIC_KEY_FILE_NAME)}`,
+              );
+        const HOST_PRIVATE_KEY = host?.private_key
+            ? host.private_key
+            : execSync(
+                  `cat ${path.join(WIREGUARD_HOST_CONFIG_DIR, WIREGUARD_PRIVATE_KEY_FILE_NAME)}`,
+              );
+
+        let sh = ``;
+
+        const POST_UP_PATH = path.join(
+            WGUI_LIB_IP_TABLES_DIR,
+            `${host_id}-up.sh`,
+        );
+        const POST_DOWN_PATH = path.join(
+            WGUI_LIB_IP_TABLES_DIR,
+            `${host_id}-down.sh`,
+        );
+
+        sh += `cd ${WIREGUARD_HOST_CONFIG_DIR}\n`;
+
+        sh += `cat > ${POST_UP_PATH} << EOF\n`;
+        sh += `#!/bin/bash\n\n`;
+        sh += `# Allow WireGuard traffic to/from the server itself\n`;
+        sh += `iptables -I INPUT 1 -i wg${host_id} -j ACCEPT\n`;
+        sh += `iptables -I OUTPUT 1 -o wg${host_id} -j ACCEPT\n`;
+        sh += `\n`;
+        sh += `# Allow WireGuard traffic to be forwarded (insert above Docker rules)\n`;
+        sh += `iptables -I FORWARD 1 -i wg${host_id} -j ACCEPT\n`;
+        sh += `iptables -I FORWARD 1 -o wg${host_id} -j ACCEPT\n`;
+        sh += `\n`;
+        sh += `iptables -t nat -A POSTROUTING -o ${TARGET_INTERFACE} -j MASQUERADE\n`;
+        sh += `EOF\n`;
+
+        sh += `\n`;
+
+        sh += `cat > ${POST_DOWN_PATH} << EOF\n`;
+        sh += `#!/bin/bash\n\n`;
+        sh += `# Remove WireGuard INPUT/OUTPUT rules\n`;
+        sh += `iptables -D INPUT -i wg${host_id} -j ACCEPT\n`;
+        sh += `iptables -D OUTPUT -o wg${host_id} -j ACCEPT\n`;
+        sh += `\n`;
+        sh += `# Remove FORWARD rules\n`;
+        sh += `iptables -D FORWARD -i wg${host_id} -j ACCEPT\n`;
+        sh += `iptables -D FORWARD -o wg${host_id} -j ACCEPT\n`;
+        sh += `\n`;
+        sh += `iptables -t nat -D POSTROUTING -o ${TARGET_INTERFACE} -j MASQUERADE\n`;
+        sh += `EOF\n`;
+
+        sh += `\n`;
+
+        sh += `cat > wg${host_id}.conf << EOF\n`;
+        sh += `[Interface]\n`;
+        sh += `Address = ${HOST_WG_IP}/24\n`;
+        sh += `ListenPort = 51820\n`;
+        sh += `PrivateKey = ${HOST_PRIVATE_KEY}\n`;
+        sh += `PostUp = ${POST_UP_PATH}\n`;
+        sh += `PostDown = ${POST_DOWN_PATH}\n`;
+        sh += `\n`;
+
+        if (clients[0]) {
+            for (let i = 0; i < clients.length; i++) {
+                const client = clients[i];
+                if (!client?.id || !client.public_key) continue;
+
+                sh += `[Peer]\n`;
+                sh += `PublicKey = ${client.public_key}\n`;
+                sh += `AllowedIPs = ${client.allowed_ips}\n`;
+                sh += `\n`;
+            }
+        }
+
+        sh += `EOF\n`;
+
+        sh += `\n`;
+
         const exec = execSync(sh, { encoding: "utf-8" });
     } catch (error: any) {
         return {