Add bundled WireGuard diagnostics and application proxy

backend/internal/service/wireguard/wireguard.go

@@ -781,8 +781,12 @@ func renderServerConfig(cfg map[string]interface{}, serverPrivate string, peers
 	}
 	if service.Bool(cfg, "enable_nat", false) {
 		egress := service.Str(cfg, "egress_interface")
-		fmt.Fprintf(&b, "PostUp = iptables -A FORWARD -i %%i -j ACCEPT; iptables -A FORWARD -o %%i -j ACCEPT; iptables -t nat -A POSTROUTING -o %s -j MASQUERADE\n", egress)
-		fmt.Fprintf(&b, "PostDown = iptables -D FORWARD -i %%i -j ACCEPT; iptables -D FORWARD -o %%i -j ACCEPT; iptables -t nat -D POSTROUTING -o %s -j MASQUERADE\n", egress)
+		source := service.Str(cfg, "address")
+		if _, subnet, err := net.ParseCIDR(source); err == nil {
+			source = subnet.String()
+		}
+		fmt.Fprintf(&b, "PostUp = iptables -A FORWARD -i %%i -j ACCEPT; iptables -A FORWARD -o %%i -j ACCEPT; iptables -t nat -A POSTROUTING -s %s -o %s -j MASQUERADE\n", source, egress)
+		fmt.Fprintf(&b, "PostDown = iptables -D FORWARD -i %%i -j ACCEPT; iptables -D FORWARD -o %%i -j ACCEPT; iptables -t nat -D POSTROUTING -s %s -o %s -j MASQUERADE\n", source, egress)
 	}
 	for _, p := range peers {
 		if !p.Enabled {
@@ -806,4 +810,3 @@ func validateCIDRList(value string) error {
 	}
 	return nil
 }
-

backend/internal/service/wireguard/wireguard_test.go

@@ -83,6 +83,19 @@ func TestValidateRejectsUnsafeNATAndInvalidPeerAddress(t *testing.T) {
 	}
 }
 
+func TestNATOnlyAppliesToWireGuardSubnet(t *testing.T) {
+	conf := renderServerConfig(map[string]interface{}{
+		"address": "10.88.0.1/24", "listen_port": 51820,
+		"enable_nat": true, "egress_interface": "eth0",
+	}, "test-key", nil, nil)
+	if !strings.Contains(conf, "POSTROUTING -s 10.88.0.0/24 -o eth0 -j MASQUERADE") {
+		t.Fatal("NAT must be limited to the tunnel subnet")
+	}
+	if strings.Count(conf, "POSTROUTING -s 10.88.0.0/24") != 2 {
+		t.Fatal("PostUp and PostDown must use the same subnet")
+	}
+}
+
 func TestInterfaceNameFitsLinuxLimit(t *testing.T) {
 	name := interfaceName(&model.Tunnel{ID: ^uint(0)})
 	if len(name) > 15 {