From 73a3384d984128ee31b6ca56b1a7cffcdfe95f55 Mon Sep 17 00:00:00 2001
From: Benjamin Toby <devops@tben.me>
Date: Mon, 28 Sep 2026 18:34:09 +0100
Subject: [PATCH] Fix DNS resolution issues

---
 .../setup/build-host-iptables-scripts.ts      | 28 ++++++++++++-------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/src/functions/backend/setup/build-host-iptables-scripts.ts b/src/functions/backend/setup/build-host-iptables-scripts.ts
index cdfafdf..7cb1e86 100644
--- a/src/functions/backend/setup/build-host-iptables-scripts.ts
+++ b/src/functions/backend/setup/build-host-iptables-scripts.ts
@@ -27,6 +27,16 @@ function joinArgs(parts: (string | undefined)[]) {
     return parts.filter(Boolean).join(" ");
 }
 
+function deriveGatewayIp(cidr?: string): string | undefined {
+    if (!cidr) return undefined;
+    const ip = cidr.split("/")[0];
+    if (!ip) return undefined;
+    const parts = ip.split(".");
+    if (parts.length !== 4) return undefined;
+    // Assume host/gateway is .1 on the subnet
+    return `${parts[0]}.${parts[1]}.${parts[2]}.1`;
+}
+
 function protocolsForRule({
     protocol,
     has_ports,
@@ -165,6 +175,7 @@ export default function buildHostIptablesScripts({
     }
 
     const scoped_subnet = host_subnet?.trim();
+    const host_wg_ip = deriveGatewayIp(scoped_subnet);
 
     if (scoped_subnet && !validateIpv4Cidr({ value: scoped_subnet })) {
         return {
@@ -175,8 +186,10 @@ export default function buildHostIptablesScripts({
 
     const { forward, input } = deriveIptablesChainNames({ host_id });
 
-    const masquerade_match = scoped_subnet ? `-s ${scoped_subnet} ` : ``;
-    const accept_lines: string[] = [];
+    const masquerade_match = scoped_subnet ? `-s ${scoped_subnet}` : ``;
+    const accept_lines: string[] = [
+        `iptables -A ${forward} -o ${interface_name} -j DROP`,
+    ];
     const host_clients = clients || [];
 
     for (let i = 0; i < host_clients.length; i++) {
@@ -224,8 +237,8 @@ export default function buildHostIptablesScripts({
             if (rule.rule_type == "all") {
                 accept_lines.push(
                     `iptables -A ${forward} -s ${source} -j ACCEPT`,
-                    scoped_subnet
-                        ? `iptables -A ${input} -s ${source} -d ${scoped_subnet} -j ACCEPT`
+                    host_wg_ip
+                        ? `iptables -A ${input} -s ${source} -d ${host_wg_ip} -j ACCEPT`
                         : `iptables -A ${input} -s ${source} -j ACCEPT`,
                 );
 
@@ -252,17 +265,12 @@ export default function buildHostIptablesScripts({
                     source,
                     protocol: rule.protocol || "any",
                     ports: parsed_ports.ports,
-                    host_wg_ip: scoped_subnet,
+                    host_wg_ip,
                 }),
             );
         }
     }
 
-    accept_lines.push(
-        `# Prevent clients from forwarding traffic back into the WireGuard network`,
-        `iptables -A ${forward} -o ${interface_name} -j DROP`,
-    );
-
     const post_up = [
         `#!/bin/bash`,
         ``,