Fix client access scope

src/functions/backend/setup/build-host-iptables-scripts.ts

@@ -1,6 +1,7 @@
 import type { BUN_SQLITE_WGUI_CLIENT_RULES } from "@/db/types/db";
 import parsePortList from "@/src/utils/parse-port-list";
 import validateIpv4 from "@/src/utils/validate-ipv4";
+import validateIpv4Cidr from "@/src/utils/validate-ipv4-cidr";
 import deriveIptablesChainNames from "./derive-iptables-chain-names";
 import normalizeIptablesDestination from "./normalize-iptables-destination";
 import validateClientRule from "./validate-client-rule";
@@ -15,6 +16,7 @@ type Params = {
     host_id: number;
     interface_name: string;
     target_interface: string;
+    host_subnet?: string;
     clients?: HostIptablesClient[];
 };
 
@@ -123,6 +125,7 @@ export default function buildHostIptablesScripts({
     host_id,
     interface_name,
     target_interface,
+    host_subnet,
     clients,
 }: Params) {
     if (!Number.isInteger(host_id) || host_id < 0) {
@@ -146,6 +149,15 @@ export default function buildHostIptablesScripts({
         };
     }
 
+    const scoped_subnet = host_subnet?.trim();
+
+    if (scoped_subnet && !validateIpv4Cidr({ value: scoped_subnet })) {
+        return {
+            success: false,
+            msg: `Invalid host subnet "${scoped_subnet}"`,
+        };
+    }
+
     const { forward, input } = deriveIptablesChainNames({ host_id });
     const accept_lines: string[] = [];
     const host_clients = clients || [];
@@ -193,12 +205,19 @@ export default function buildHostIptablesScripts({
             }
 
             if (rule.rule_type == "all") {
-                accept_lines.push(
-                    `iptables -A ${forward} -s ${source} -j ACCEPT`,
-                );
-                accept_lines.push(
-                    `iptables -A ${input} -s ${source} -j ACCEPT`,
-                );
+                if (scoped_subnet) {
+                    accept_lines.push(
+                        `iptables -A ${forward} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
+                        `iptables -A ${forward} -s ${source} -o ${target_interface} -j ACCEPT`,
+                        `iptables -A ${input} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
+                    );
+                } else {
+                    accept_lines.push(
+                        `iptables -A ${forward} -s ${source} -j ACCEPT`,
+                        `iptables -A ${input} -s ${source} -j ACCEPT`,
+                    );
+                }
+
                 continue;
             }
 

src/functions/backend/setup/setup-wireguard-host.ts

@@ -172,10 +172,13 @@ export default async function setupWireguardHost({
 
         sh += `cd ${HOST_CONFIG_DIR}\n`;
 
+        const HOST_SUBNET = `${HOST_WG_IP.split(".").slice(0, 3).join(".")}.0/24`;
+
         const iptables_scripts = buildHostIptablesScripts({
             host_id: Number(HOST_ID),
             interface_name: INTERFACE_NAME,
             target_interface: TARGET_INTERFACE || "eth0",
+            host_subnet: HOST_SUBNET,
             clients: clients.map((client) => ({
                 id: client.id,
                 wg_ip_address: client.wg_ip_address,