Fix client access scope

src/functions/backend/setup/build-host-iptables-scripts.ts

@@ -1,6 +1,7 @@
 import type { BUN_SQLITE_WGUI_CLIENT_RULES } from "@/db/types/db";
 import parsePortList from "@/src/utils/parse-port-list";
 import validateIpv4 from "@/src/utils/validate-ipv4";
+import validateIpv4Cidr from "@/src/utils/validate-ipv4-cidr";
 import deriveIptablesChainNames from "./derive-iptables-chain-names";
 import normalizeIptablesDestination from "./normalize-iptables-destination";
 import validateClientRule from "./validate-client-rule";
@@ -15,6 +16,7 @@ type Params = {
     host_id: number;
     interface_name: string;
     target_interface: string;
+    host_subnet?: string;
     clients?: HostIptablesClient[];
 };
 
@@ -123,6 +125,7 @@ export default function buildHostIptablesScripts({
     host_id,
     interface_name,
     target_interface,
+    host_subnet,
     clients,
 }: Params) {
     if (!Number.isInteger(host_id) || host_id < 0) {
@@ -146,6 +149,15 @@ export default function buildHostIptablesScripts({
         };
     }
 
+    const scoped_subnet = host_subnet?.trim();
+
+    if (scoped_subnet && !validateIpv4Cidr({ value: scoped_subnet })) {
+        return {
+            success: false,
+            msg: `Invalid host subnet "${scoped_subnet}"`,
+        };
+    }
+
     const { forward, input } = deriveIptablesChainNames({ host_id });
     const accept_lines: string[] = [];
     const host_clients = clients || [];
@@ -193,12 +205,19 @@ export default function buildHostIptablesScripts({
             }
 
             if (rule.rule_type == "all") {
-                accept_lines.push(
-                    `iptables -A ${forward} -s ${source} -j ACCEPT`,
-                );
-                accept_lines.push(
-                    `iptables -A ${input} -s ${source} -j ACCEPT`,
-                );
+                if (scoped_subnet) {
+                    accept_lines.push(
+                        `iptables -A ${forward} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
+                        `iptables -A ${forward} -s ${source} -o ${target_interface} -j ACCEPT`,
+                        `iptables -A ${input} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
+                    );
+                } else {
+                    accept_lines.push(
+                        `iptables -A ${forward} -s ${source} -j ACCEPT`,
+                        `iptables -A ${input} -s ${source} -j ACCEPT`,
+                    );
+                }
+
                 continue;
             }