fix: include selected networks in dataplane NAT

crates/nx9-wg-api/src/lib.rs

@@ -20,6 +20,7 @@ pub use error::{ApiError, ApiResult, ErrorBody, ErrorResponse};
 pub use profile_resolver::ClientProfileResolver;
 pub use reconciliation::{
     ReconciliationAction, ReconciliationEngine, ReconciliationPlan, ReconciliationReport,
+    collect_managed_wg_subnets,
 };
 pub use routes::build_api_router;
 pub use state::{AppState, SystemEvent};

crates/nx9-wg-api/src/reconciliation.rs

@@ -6,6 +6,7 @@ use chrono::Utc;
 use ipnet::IpNet;
 use nx9_wg_core::types::audit::AuditEventType;
 use nx9_wg_core::types::wireguard::PeerState;
+use nx9_wg_db::Store;
 use nx9_wg_network::NetworkEngine;
 use nx9_wireguard::WireGuardEngine;
 use serde::{Deserialize, Serialize};
@@ -42,6 +43,34 @@ fn matches_allowed_ips(live_allowed_ips: &[String], desired_str: &str) -> bool {
     desired_nets == live_nets
 }
 
+/// Collect Interface CIDRs plus enabled Subnet Network CIDRs for NAT/forwarding.
+///
+/// Interface addresses remain the WireGuard transport identity. Enabled Network
+/// CIDRs are the peer allocation domains and must be masqueraded so selected-
+/// Network peers receive the same full-tunnel Internet path as Interface-CIDR
+/// peers. `network_id = null` peers still match the Interface CIDR.
+pub async fn collect_managed_wg_subnets(store: &Store) -> ApiResult<Vec<IpNet>> {
+    let mut subnets = Vec::new();
+
+    for iface in store.list_interfaces().await? {
+        if !iface.enabled {
+            continue;
+        }
+        subnets.push(iface.address_v4);
+        if let Some(v6) = iface.address_v6 {
+            subnets.push(v6);
+        }
+    }
+
+    for net in store.list_networks().await? {
+        if net.enabled {
+            subnets.push(net.cidr);
+        }
+    }
+
+    Ok(subnets)
+}
+
 /// Individual action proposed or taken by the reconciler.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ReconciliationAction {
@@ -355,7 +384,7 @@ impl ReconciliationEngine {
             }
         }
 
-        // 2. Routes
+        // 2. Routes (SQLite Routes table only; peer-allocation Networks are not routes)
         let desired_routes = self.state.store.list_routes().await?;
         let enabled_routes: Vec<_> = desired_routes.iter().filter(|r| r.enabled).collect();
         let has_route_drift = self
@@ -401,15 +430,7 @@ impl ReconciliationEngine {
             .map(|s| s.value == "true" || s.value == "1")
             .unwrap_or(true);
 
-        let mut wg_subnets = Vec::new();
-        for iface in &desired_interfaces {
-            if iface.enabled {
-                wg_subnets.push(iface.address_v4);
-                if let Some(v6) = iface.address_v6 {
-                    wg_subnets.push(v6);
-                }
-            }
-        }
+        let wg_subnets = collect_managed_wg_subnets(&self.state.store).await?;
 
         let expected_ruleset = nx9_wg_network::NftablesRulesetBuilder::build(
             &resolved_fw_rules,
@@ -484,7 +505,6 @@ impl ReconciliationEngine {
         let mut details = Vec::new();
 
         // 1. Sync all active WireGuard interfaces and their peers
-        let mut wg_subnets = Vec::new();
         for iface in &desired_interfaces {
             if iface.enabled {
                 let peers = self.state.store.list_peers_for_interface(iface.id).await?;
@@ -497,10 +517,6 @@ impl ReconciliationEngine {
                             iface.name
                         ))
                     })?;
-                wg_subnets.push(iface.address_v4);
-                if let Some(v6) = iface.address_v6 {
-                    wg_subnets.push(v6);
-                }
                 details.push(format!(
                     "Synchronized interface '{}' with {} peers",
                     iface.name,
@@ -515,7 +531,9 @@ impl ReconciliationEngine {
             }
         }
 
-        // 2. Sync Routes
+        let wg_subnets = collect_managed_wg_subnets(&self.state.store).await?;
+
+        // 2. Sync Routes (SQLite Routes table only; peer-allocation Networks are not routes)
         let routes = self.state.store.list_routes().await?;
         self.net_engine
             .sync_routes(&routes)

crates/nx9-wg-api/src/routes/peers.rs

@@ -16,15 +16,47 @@ use nx9_wg_core::types::wireguard::{
     WireGuardPublicKey,
 };
 use nx9_wg_core::validation::{validate_cidr, validate_mtu, validate_peer_name};
-use serde::{Deserialize, Serialize};
+use serde::{Deserialize, Deserializer, Serialize};
 use std::str::FromStr;
 use uuid::Uuid;
 
+/// Deserialize `network_id` from JSON null/empty as None, and from a UUID string as Some.
+/// Rejects non-UUID values instead of silently falling back to the Interface CIDR.
+fn deserialize_optional_network_id<'de, D>(deserializer: D) -> Result<Option<Uuid>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let value = Option::<serde_json::Value>::deserialize(deserializer)?;
+    match value {
+        None | Some(serde_json::Value::Null) => Ok(None),
+        Some(serde_json::Value::String(s)) => {
+            let trimmed = s.trim();
+            if trimmed.is_empty() {
+                Ok(None)
+            } else {
+                Uuid::parse_str(trimmed).map(Some).map_err(|e| {
+                    serde::de::Error::custom(format!("network_id must be a Network UUID: {e}"))
+                })
+            }
+        }
+        Some(other) => Err(serde::de::Error::custom(format!(
+            "network_id must be a UUID string, got {other}"
+        ))),
+    }
+}
+
 #[derive(Debug, Deserialize)]
 pub struct CreatePeerRequest {
     pub name: String,
     pub peer_type: Option<PeerType>,
     pub profile: Option<PeerProfile>,
+    /// Subnet Network UUID for IP allocation. Also accepts the historical
+    /// enrollment field name `network` when that value is a UUID.
+    #[serde(
+        default,
+        alias = "network",
+        deserialize_with = "deserialize_optional_network_id"
+    )]
     pub network_id: Option<Uuid>,
     pub public_key: Option<String>,
     pub private_key: Option<String>,
@@ -264,6 +296,47 @@ async fn validate_no_server_allowed_ips_conflict(
     Ok(())
 }
 
+/// Allocate a peer IPv4 address.
+///
+/// When `network_id` is present, allocation MUST use that Network's CIDR and
+/// MUST NOT fall back to the WireGuard Interface address space.
+/// When `network_id` is absent, preserve the existing Interface CIDR fallback.
+async fn allocate_address_v4_for_peer(
+    store: &nx9_wg_db::Store,
+    interface: &nx9_wg_core::types::wireguard::Interface,
+    network_id: Option<Uuid>,
+) -> ApiResult<IpNet> {
+    match network_id {
+        Some(net_id) => {
+            let network = store
+                .get_network(net_id)
+                .await?
+                .ok_or_else(|| ApiError::NotFound(format!("Network '{net_id}' not found")))?;
+            let allocated =
+                IpAllocator::allocate_next_ip(store, &network, Some(interface), None).await?;
+            if !network.cidr.contains(&allocated.addr()) {
+                return Err(ApiError::Internal(format!(
+                    "allocated address {allocated} is outside selected network '{}' ({})",
+                    network.name, network.cidr
+                )));
+            }
+            Ok(allocated)
+        }
+        None => {
+            let fallback = Network {
+                id: Uuid::nil(),
+                name: format!("{}-subnet", interface.name),
+                cidr: interface.address_v4,
+                enabled: true,
+                description: None,
+                created_at: Utc::now().naive_utc(),
+                updated_at: Utc::now().naive_utc(),
+            };
+            IpAllocator::allocate_next_ip(store, &fallback, Some(interface), None).await
+        }
+    }
+}
+
 /// POST /api/v1/interfaces/{id}/peers
 pub async fn create_peer_handler(
     State(state): State<AppState>,
@@ -289,28 +362,12 @@ pub async fn create_peer_handler(
         _ => None,
     };
 
-    // If address_v4 was not explicitly provided, automatically allocate it
+    // If address_v4 was not explicitly provided, automatically allocate it.
+    // A present network_id selects the Subnet Network CIDR; None keeps the
+    // Interface Network CIDR fallback. These paths are intentionally separate.
     if address_v4.is_none() {
-        let net = match payload.network_id {
-            Some(net_id) => state
-                .store
-                .get_network(net_id)
-                .await?
-                .ok_or_else(|| ApiError::NotFound(format!("Network '{net_id}' not found")))?,
-            None => Network {
-                id: Uuid::nil(),
-                name: format!("{}-subnet", interface.name),
-                cidr: interface.address_v4,
-                enabled: true,
-                description: None,
-                created_at: Utc::now().naive_utc(),
-                updated_at: Utc::now().naive_utc(),
-            },
-        };
-
-        let allocated =
-            IpAllocator::allocate_next_ip(&state.store, &net, Some(&interface), None).await?;
-        address_v4 = Some(allocated);
+        address_v4 =
+            Some(allocate_address_v4_for_peer(&state.store, &interface, payload.network_id).await?);
     }
 
     let allowed_ips = match payload.allowed_ips {
@@ -794,3 +851,55 @@ pub async fn get_peer_qr_handler(
         data_url,
     }))
 }
+
+#[cfg(test)]
+mod create_peer_request_tests {
+    use super::CreatePeerRequest;
+    use uuid::Uuid;
+
+    const NETWORK_UUID: &str = "c2aa62c7-3b9d-43fb-95e7-aa8ab1c71265";
+
+    #[test]
+    fn ui_payload_deserializes_network_id_uuid() {
+        let json = serde_json::json!({
+            "name": "sunil-moto-mobile-network-01",
+            "peer_type": "road_warrior",
+            "profile": "full_tunnel",
+            "mtu": 1280,
+            "persistent_keepalive": 25,
+            "dns": "1.1.1.1, 1.0.0.1",
+            "allowed_ips": "0.0.0.0/0, ::/0",
+            "network_id": NETWORK_UUID
+        });
+        let req: CreatePeerRequest = serde_json::from_value(json).expect("deserialize UI payload");
+        assert_eq!(req.network_id, Some(Uuid::parse_str(NETWORK_UUID).unwrap()));
+    }
+
+    #[test]
+    fn historical_network_field_uuid_maps_to_network_id() {
+        let json = serde_json::json!({
+            "name": "sunil-moto-mobile-network-01",
+            "network": NETWORK_UUID
+        });
+        let req: CreatePeerRequest =
+            serde_json::from_value(json).expect("deserialize historical network field");
+        assert_eq!(req.network_id, Some(Uuid::parse_str(NETWORK_UUID).unwrap()));
+    }
+
+    #[test]
+    fn null_network_id_deserializes_as_none() {
+        let json = serde_json::json!({
+            "name": "bob-fallback",
+            "network_id": null
+        });
+        let req: CreatePeerRequest = serde_json::from_value(json).expect("deserialize null");
+        assert_eq!(req.network_id, None);
+    }
+
+    #[test]
+    fn missing_network_id_deserializes_as_none() {
+        let json = serde_json::json!({ "name": "bob-fallback" });
+        let req: CreatePeerRequest = serde_json::from_value(json).expect("deserialize missing");
+        assert_eq!(req.network_id, None);
+    }
+}