From 803ba0adeff8fb4231da57868d3a064d51c811c9 Mon Sep 17 00:00:00 2001
From: Benjamin Toby <devops@tben.me>
Date: Mon, 21 Sep 2026 15:08:54 +0100
Subject: [PATCH] Iptables bugfix: allow dns queries over wireguard tunnel

---
 src/functions/backend/setup/build-host-iptables-scripts.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/functions/backend/setup/build-host-iptables-scripts.ts b/src/functions/backend/setup/build-host-iptables-scripts.ts
index a896d99..000e699 100644
--- a/src/functions/backend/setup/build-host-iptables-scripts.ts
+++ b/src/functions/backend/setup/build-host-iptables-scripts.ts
@@ -209,7 +209,7 @@ export default function buildHostIptablesScripts({
                     accept_lines.push(
                         `iptables -A ${forward} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
                         `iptables -A ${forward} -s ${source} -o ${target_interface} -j ACCEPT`,
-                        `iptables -A ${input} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
+                        `iptables -A ${input} -s ${source} -j ACCEPT`,
                     );
                 } else {
                     accept_lines.push(
@@ -268,6 +268,9 @@ export default function buildHostIptablesScripts({
         `iptables -A ${forward} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`,
         `iptables -A ${input} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`,
         ``,
+        `iptables -A ${input} -i${interface_name} -p udp --dport 53 -j ACCEPT`,
+        `iptables -A ${input} -i${interface_name} -p tcp --dport 53 -j ACCEPT`,
+        ``,
         ...accept_lines,
         ``,
         `iptables -A ${forward} -j DROP`,