Iptables bugfix: allow dns queries over wireguard tunnel

src/functions/backend/setup/build-host-iptables-scripts.ts

@@ -209,7 +209,7 @@ export default function buildHostIptablesScripts({
                     accept_lines.push(
                         `iptables -A ${forward} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
                         `iptables -A ${forward} -s ${source} -o ${target_interface} -j ACCEPT`,
-                        `iptables -A ${input} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
+                        `iptables -A ${input} -s ${source} -j ACCEPT`,
                     );
                 } else {
                     accept_lines.push(
@@ -268,6 +268,9 @@ export default function buildHostIptablesScripts({
         `iptables -A ${forward} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`,
         `iptables -A ${input} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`,
         ``,
+        `iptables -A ${input} -i${interface_name} -p udp --dport 53 -j ACCEPT`,
+        `iptables -A ${input} -i${interface_name} -p tcp --dport 53 -j ACCEPT`,
+        ``,
         ...accept_lines,
         ``,
         `iptables -A ${forward} -j DROP`,