From 8492ae1a2ab88e5c1342a6c66a676c9e11b28d4e Mon Sep 17 00:00:00 2001
From: Benjamin Toby <devops@tben.me>
Date: Mon, 28 Sep 2026 18:54:01 +0100
Subject: [PATCH] Revert to previous version

---
 .../setup/build-host-iptables-scripts.ts      | 23 ++++---------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/src/functions/backend/setup/build-host-iptables-scripts.ts b/src/functions/backend/setup/build-host-iptables-scripts.ts
index 7cb1e86..49b4a4e 100644
--- a/src/functions/backend/setup/build-host-iptables-scripts.ts
+++ b/src/functions/backend/setup/build-host-iptables-scripts.ts
@@ -27,16 +27,6 @@ function joinArgs(parts: (string | undefined)[]) {
     return parts.filter(Boolean).join(" ");
 }
 
-function deriveGatewayIp(cidr?: string): string | undefined {
-    if (!cidr) return undefined;
-    const ip = cidr.split("/")[0];
-    if (!ip) return undefined;
-    const parts = ip.split(".");
-    if (parts.length !== 4) return undefined;
-    // Assume host/gateway is .1 on the subnet
-    return `${parts[0]}.${parts[1]}.${parts[2]}.1`;
-}
-
 function protocolsForRule({
     protocol,
     has_ports,
@@ -175,7 +165,6 @@ export default function buildHostIptablesScripts({
     }
 
     const scoped_subnet = host_subnet?.trim();
-    const host_wg_ip = deriveGatewayIp(scoped_subnet);
 
     if (scoped_subnet && !validateIpv4Cidr({ value: scoped_subnet })) {
         return {
@@ -186,7 +175,7 @@ export default function buildHostIptablesScripts({
 
     const { forward, input } = deriveIptablesChainNames({ host_id });
 
-    const masquerade_match = scoped_subnet ? `-s ${scoped_subnet}` : ``;
+    const masquerade_match = scoped_subnet ? `-s ${scoped_subnet} ` : ``;
     const accept_lines: string[] = [
         `iptables -A ${forward} -o ${interface_name} -j DROP`,
     ];
@@ -237,18 +226,14 @@ export default function buildHostIptablesScripts({
             if (rule.rule_type == "all") {
                 accept_lines.push(
                     `iptables -A ${forward} -s ${source} -j ACCEPT`,
-                    host_wg_ip
-                        ? `iptables -A ${input} -s ${source} -d ${host_wg_ip} -j ACCEPT`
+                    scoped_subnet
+                        ? `iptables -A ${input} -s ${source} -d ${scoped_subnet} -j ACCEPT`
                         : `iptables -A ${input} -s ${source} -j ACCEPT`,
                 );
 
                 continue;
             }
 
-            const destination = normalizeIptablesDestination({
-                destination: rule.destination,
-            });
-
             const parsed_ports = parsePortList({ ports: rule.ports });
 
             if (!parsed_ports.success) {
@@ -265,7 +250,7 @@ export default function buildHostIptablesScripts({
                     source,
                     protocol: rule.protocol || "any",
                     ports: parsed_ports.ports,
-                    host_wg_ip,
+                    host_wg_ip: scoped_subnet,
                 }),
             );
         }