Add bundled WireGuard diagnostics and application proxy

backend/internal/service/wireguard/wireguard_test.go

@@ -83,6 +83,19 @@ func TestValidateRejectsUnsafeNATAndInvalidPeerAddress(t *testing.T) {
 	}
 }
 
+func TestNATOnlyAppliesToWireGuardSubnet(t *testing.T) {
+	conf := renderServerConfig(map[string]interface{}{
+		"address": "10.88.0.1/24", "listen_port": 51820,
+		"enable_nat": true, "egress_interface": "eth0",
+	}, "test-key", nil, nil)
+	if !strings.Contains(conf, "POSTROUTING -s 10.88.0.0/24 -o eth0 -j MASQUERADE") {
+		t.Fatal("NAT must be limited to the tunnel subnet")
+	}
+	if strings.Count(conf, "POSTROUTING -s 10.88.0.0/24") != 2 {
+		t.Fatal("PostUp and PostDown must use the same subnet")
+	}
+}
+
 func TestInterfaceNameFitsLinuxLimit(t *testing.T) {
 	name := interfaceName(&model.Tunnel{ID: ^uint(0)})
 	if len(name) > 15 {