feat(wg): Push-Routes (Client-Routes) für WireGuard-Server-Interfaces

Neues Feld 'client_routes' auf wireguard_interfaces: der Operator
trägt dort kommagetrennte Netzwerke ein (z. B. 10.0.10.0/24 für ein
LAN hinter der Box). Der Peer-Config-Download fügt diese automatisch
als zusätzliche AllowedIPs in den [Peer]-Block der Client-Config ein.

Bisher wurde nur das Server-Tunnel-Subnetz (ifc.address_cidr) als
AllowedIPs exportiert — Peers konnten so keine anderen Netze über
den Tunnel erreichen ohne die Config manuell anzupassen.

Migration: 0026_wg_client_routes.sql

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

VERSION

@@ -1 +1 @@
-1.1.52
+1.1.53

internal/database/migrations/0026_wg_client_routes.sql

@@ -0,0 +1,6 @@
+-- +goose Up
+ALTER TABLE wireguard_interfaces
+    ADD COLUMN IF NOT EXISTS client_routes TEXT;
+
+-- +goose Down
+ALTER TABLE wireguard_interfaces DROP COLUMN IF EXISTS client_routes;

internal/handlers/wireguard.go

@@ -173,6 +173,7 @@ type ifaceCreateReq struct {
 	AllowedIPs          *string `json:"allowed_ips,omitempty"`
 	PersistentKeepalive *int    `json:"persistent_keepalive,omitempty"`
 	MTU                 *int    `json:"mtu,omitempty"`
+	ClientRoutes        *string `json:"client_routes,omitempty"`
 	Role                string  `json:"role"`
 	Active              bool    `json:"active"`
 	Description         *string `json:"description,omitempty"`
@@ -222,6 +223,7 @@ func (h *WireguardHandler) CreateIface(c *gin.Context) {
 		PeerEndpoint: req.PeerEndpoint, PeerPublicKey: req.PeerPublicKey,
 		PeerPSKEnc: encPSK, AllowedIPs: req.AllowedIPs,
 		PersistentKeepalive: req.PersistentKeepalive, MTU: req.MTU,
+		ClientRoutes: req.ClientRoutes,
 		Role: req.Role, Active: req.Active, Description: req.Description,
 	}
 	if ifc.Role == "" {
@@ -311,6 +313,7 @@ func (h *WireguardHandler) UpdateIface(c *gin.Context) {
 		PeerEndpoint: req.PeerEndpoint, PeerPublicKey: req.PeerPublicKey,
 		PeerPSKEnc: encPSK, AllowedIPs: req.AllowedIPs,
 		PersistentKeepalive: req.PersistentKeepalive, MTU: req.MTU,
+		ClientRoutes: req.ClientRoutes,
 		Role: req.Role, Active: req.Active, Description: req.Description,
 	}
 	if ifc.Role == "" {
@@ -645,12 +648,15 @@ func (h *WireguardHandler) peerConfigText(ctx context.Context, peerID int64) (st
 		}
 		fmt.Fprintf(&b, "PresharedKey = %s\n", string(psk))
 	}
-	// AllowedIPs on the client side is "everything that should go
+	// AllowedIPs on the client side: the server's tunnel subnet
-	// through the tunnel". For a server hosting an internal LAN
+	// (so peers can reach each other + the gateway) plus any
-	// this is typically 10.x/8 or the server's address range. We
+	// additional "push routes" the operator configured on the
-	// default to the iface address (so the client can at least
+	// server interface (e.g. 10.0.10.0/24 for a LAN behind the box).
-	// reach the gateway) — operator can edit downloaded conf.
+	clientAllowedIPs := ifc.AddressCIDR
-	fmt.Fprintf(&b, "AllowedIPs = %s\n", ifc.AddressCIDR)
+	if ifc.ClientRoutes != nil && strings.TrimSpace(*ifc.ClientRoutes) != "" {
+		clientAllowedIPs += ", " + strings.TrimSpace(*ifc.ClientRoutes)
+	}
+	fmt.Fprintf(&b, "AllowedIPs = %s\n", clientAllowedIPs)
 	// Endpoint — the operator's public host:port that peers dial.
 	// We don't know this here (could be a CNAME or behind a load
 	// balancer); leave a placeholder the operator must fill in.

internal/models/wireguard.go

@@ -18,6 +18,7 @@ type WireguardInterface struct {
 	AllowedIPs          *string   `gorm:"column:allowed_ips"         json:"allowed_ips,omitempty"`
 	PersistentKeepalive *int      `gorm:"column:persistent_keepalive" json:"persistent_keepalive,omitempty"`
 	MTU                 *int      `gorm:"column:mtu"                 json:"mtu,omitempty"`
+	ClientRoutes        *string   `gorm:"column:client_routes"       json:"client_routes,omitempty"`
 	Role                string    `gorm:"column:role"                json:"role"`
 	Active              bool      `gorm:"column:active"              json:"active"`
 	Description         *string   `gorm:"column:description"         json:"description,omitempty"`

internal/services/wireguard/interfaces.go

@@ -21,7 +21,7 @@ func NewInterfacesRepo(pool *pgxpool.Pool) *InterfacesRepo { return &InterfacesR
 const ifaceBaseSelect = `
 SELECT id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
        peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
-       mtu, role, active, description, created_at, updated_at
+       mtu, client_routes, role, active, description, created_at, updated_at
 FROM wireguard_interfaces
 `
 
@@ -59,14 +59,14 @@ func (r *InterfacesRepo) Create(ctx context.Context, i models.WireguardInterface
 INSERT INTO wireguard_interfaces (
   name, mode, address_cidr, listen_port, public_key, private_key_enc,
   peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
-  mtu, role, active, description
+  mtu, client_routes, role, active, description
-) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)
+) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)
 RETURNING id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
           peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
-          mtu, role, active, description, created_at, updated_at`,
+          mtu, client_routes, role, active, description, created_at, updated_at`,
 		i.Name, i.Mode, i.AddressCIDR, i.ListenPort, i.PublicKey, i.PrivateKeyEnc,
 		i.PeerEndpoint, i.PeerPublicKey, i.PeerPSKEnc, i.AllowedIPs, i.PersistentKeepalive,
-		i.MTU, i.Role, i.Active, i.Description)
+		i.MTU, i.ClientRoutes, i.Role, i.Active, i.Description)
 	return scanIface(row)
 }
 
@@ -75,15 +75,15 @@ func (r *InterfacesRepo) Update(ctx context.Context, id int64, i models.Wireguar
 UPDATE wireguard_interfaces SET
    name = $1, mode = $2, address_cidr = $3, listen_port = $4, public_key = $5,
    private_key_enc = $6, peer_endpoint = $7, peer_public_key = $8, peer_psk_enc = $9,
-   allowed_ips = $10, persistent_keepalive = $11, mtu = $12, role = $13,
+   allowed_ips = $10, persistent_keepalive = $11, mtu = $12, client_routes = $13,
-   active = $14, description = $15, updated_at = NOW()
+   role = $14, active = $15, description = $16, updated_at = NOW()
-WHERE id = $16
+WHERE id = $17
 RETURNING id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
           peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
-          mtu, role, active, description, created_at, updated_at`,
+          mtu, client_routes, role, active, description, created_at, updated_at`,
 		i.Name, i.Mode, i.AddressCIDR, i.ListenPort, i.PublicKey, i.PrivateKeyEnc,
 		i.PeerEndpoint, i.PeerPublicKey, i.PeerPSKEnc, i.AllowedIPs, i.PersistentKeepalive,
-		i.MTU, i.Role, i.Active, i.Description, id)
+		i.MTU, i.ClientRoutes, i.Role, i.Active, i.Description, id)
 	out, err := scanIface(row)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
@@ -110,7 +110,7 @@ func scanIface(row interface{ Scan(...any) error }) (*models.WireguardInterface,
 	if err := row.Scan(
 		&i.ID, &i.Name, &i.Mode, &i.AddressCIDR, &i.ListenPort, &i.PublicKey, &i.PrivateKeyEnc,
 		&i.PeerEndpoint, &i.PeerPublicKey, &i.PeerPSKEnc, &i.AllowedIPs, &i.PersistentKeepalive,
-		&i.MTU, &i.Role, &i.Active, &i.Description, &i.CreatedAt, &i.UpdatedAt,
+		&i.MTU, &i.ClientRoutes, &i.Role, &i.Active, &i.Description, &i.CreatedAt, &i.UpdatedAt,
 	); err != nil {
 		return nil, err
 	}

management-ui/src/i18n/locales/de/common.json

@@ -625,7 +625,9 @@
       "generateExtra": "Wenn an: Server erzeugt ein neues Curve25519-Keypair beim Speichern.",
       "generateOn": "Server generiert",
       "generateOff": "Manuell paste",
-      "editKeyWarning": "Achtung: neue Schlüssel = bestehende Peer-Configs ungültig. Nur ändern wenn explizit gewollt."
+      "editKeyWarning": "Achtung: neue Schlüssel = bestehende Peer-Configs ungültig. Nur ändern wenn explizit gewollt.",
+      "clientRoutes": "Push-Routes (Client)",
+      "clientRoutesExtra": "Zusätzliche Netzwerke die der Peer über den Tunnel erreichen soll, z. B. 10.0.10.0/24 für ein LAN hinter der Box. Kommagetrennt. Wird automatisch in den Peer-Config-Download eingetragen."
     },
     "peers": {
       "button": "Peers",

management-ui/src/i18n/locales/en/common.json

@@ -625,7 +625,9 @@
       "generateExtra": "If on: server generates a fresh Curve25519 keypair on save.",
       "generateOn": "Server-generated",
       "generateOff": "Manual paste",
-      "editKeyWarning": "Warning: new keys invalidate all existing peer configs. Only change if intentional."
+      "editKeyWarning": "Warning: new keys invalidate all existing peer configs. Only change if intentional.",
+      "clientRoutes": "Push routes (client)",
+      "clientRoutesExtra": "Extra networks the peer should reach through the tunnel, e.g. 10.0.10.0/24 for a LAN behind the box. Comma-separated. Automatically included in the peer config download."
     },
     "peers": {
       "button": "Peers",

management-ui/src/pages/Wireguard/Servers.tsx

@@ -25,6 +25,7 @@ interface ServerForm {
   address_cidr: string
   listen_port: number
   mtu?: number
+  client_routes?: string
   role: string
   active: boolean
   description?: string
@@ -153,6 +154,7 @@ export default function ServersTab() {
                 address_cidr: row.address_cidr,
                 listen_port: row.listen_port ?? 51820,
                 mtu: row.mtu ?? undefined,
+                client_routes: row.client_routes ?? undefined,
                 role: row.role,
                 active: row.active,
                 description: row.description ?? undefined,
@@ -263,6 +265,12 @@ export default function ServersTab() {
               </Form.Item>
             </Col>
           </Row>
+          <Form.Item
+            label={t('wg.iface.clientRoutes')} name="client_routes"
+            extra={t('wg.iface.clientRoutesExtra')}
+          >
+            <Input placeholder="10.0.10.0/24, 192.168.1.0/24" />
+          </Form.Item>
           <Form.Item label={t('wg.iface.description')} name="description">
             <Input.TextArea rows={2} />
           </Form.Item>

management-ui/src/pages/Wireguard/types.ts

@@ -12,6 +12,7 @@ export interface WGInterface {
   allowed_ips?: string | null
   persistent_keepalive?: number | null
   mtu?: number | null
+  client_routes?: string | null
   role: string
   active: boolean
   description?: string | null