From 7fa53565e2f7bf046c69e5ee5e6a988dd7474c05 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Fri, 11 Sep 2026 13:54:50 -0400
Subject: [PATCH 1/2] Add AI disclosure

---
 .github/ISSUE_TEMPLATE/1.bug_report.yml | 8 ++++++++
 .github/PULL_REQUEST_TEMPLATE.md        | 4 ++++
 2 files changed, 12 insertions(+)

diff --git a/.github/ISSUE_TEMPLATE/1.bug_report.yml b/.github/ISSUE_TEMPLATE/1.bug_report.yml
index c945608..1b8084a 100644
--- a/.github/ISSUE_TEMPLATE/1.bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/1.bug_report.yml
@@ -34,6 +34,14 @@ body:
       validations:
           required: true
 
+    - type: textarea
+      attributes:
+          label: AI Disclosure
+          description: |
+              If you used AI to help write this issue, please disclose it here. This is important for transparency and helps maintain the integrity of the issue tracking process.
+      validations:
+          required: true
+
     - type: textarea
       attributes:
           label: Expected Behavior
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index aeee133..12ec56a 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -4,8 +4,12 @@ perpetual license to use, modify, and redistribute these contributions under any
 choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
 represent that I have the right to grant this license for all contributed content.
 
+## AI Disclosure
+
+> Please disclose how AI was used in this pull request. The use of AI does not preclude this from being merged but is an important factor in how we review your request.
 ## Description
 
 
+
 ## How to test?
 

From 18e22513895b0cace3ca39c60cf13f6fd5173193 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Fri, 18 Sep 2026 10:07:04 -0400
Subject: [PATCH 2/2] Fix #114

---
 main.go | 43 +++++++++++++++++++++++++++++--------------
 1 file changed, 29 insertions(+), 14 deletions(-)

diff --git a/main.go b/main.go
index 5970950..59c990a 100644
--- a/main.go
+++ b/main.go
@@ -997,20 +997,33 @@ func ensureMSSClamping() error {
 	// Calculate MSS value (MTU - 40 for IPv4 header (20) and TCP header (20))
 	mssValue := mtuInt - 40
 
-	// Rules to be managed - just the chains, we'll construct the full command separately
-	chains := []string{"INPUT", "OUTPUT", "FORWARD"}
+	// Rules to be managed. Each rule is scoped to the WireGuard interface so
+	// that only traffic entering or leaving the tunnel is clamped - traffic
+	// that never touches WireGuard (e.g. Traefik sharing this network
+	// namespace) must not be affected.
+	type mssRule struct {
+		chain string
+		flag  string // "-i" or "-o"
+	}
+	rules := []mssRule{
+		{"INPUT", "-i"},
+		{"OUTPUT", "-o"},
+		{"FORWARD", "-i"},
+		{"FORWARD", "-o"},
+	}
 
 	// First, try to delete any existing rules
-	for _, chain := range chains {
+	for _, rule := range rules {
 		deleteCmd := exec.Command("/usr/sbin/iptables",
 			"-t", "mangle",
-			"-D", chain,
+			"-D", rule.chain,
+			rule.flag, interfaceName,
 			"-p", "tcp",
 			"--tcp-flags", "SYN,RST", "SYN",
 			"-j", "TCPMSS",
 			"--set-mss", fmt.Sprintf("%d", mssValue))
 
-		logger.Info("Attempting to delete existing MSS clamping rule for chain %s", chain)
+		logger.Info("Attempting to delete existing MSS clamping rule for chain %s (%s %s)", rule.chain, rule.flag, interfaceName)
 
 		// Try deletion multiple times to handle multiple existing rules
 		for i := 0; i < 3; i++ {
@@ -1019,30 +1032,31 @@ func ensureMSSClamping() error {
 				// Convert exit status 1 to string for better logging
 				if exitErr, ok := err.(*exec.ExitError); ok {
 					logger.Debug("Deletion stopped for chain %s: %v (output: %s)",
-						chain, exitErr.String(), string(out))
+						rule.chain, exitErr.String(), string(out))
 				}
 				break // No more rules to delete
 			}
-			logger.Info("Deleted MSS clamping rule for chain %s (attempt %d)", chain, i+1)
+			logger.Info("Deleted MSS clamping rule for chain %s (attempt %d)", rule.chain, i+1)
 		}
 	}
 
 	// Then add the new rules
 	var errors []error
-	for _, chain := range chains {
+	for _, rule := range rules {
 		addCmd := exec.Command("/usr/sbin/iptables",
 			"-t", "mangle",
-			"-A", chain,
+			"-A", rule.chain,
+			rule.flag, interfaceName,
 			"-p", "tcp",
 			"--tcp-flags", "SYN,RST", "SYN",
 			"-j", "TCPMSS",
 			"--set-mss", fmt.Sprintf("%d", mssValue))
 
-		logger.Info("Adding MSS clamping rule for chain %s", chain)
+		logger.Info("Adding MSS clamping rule for chain %s (%s %s)", rule.chain, rule.flag, interfaceName)
 
 		if out, err := addCmd.CombinedOutput(); err != nil {
 			errMsg := fmt.Sprintf("Failed to add MSS clamping rule for chain %s: %v (output: %s)",
-				chain, err, string(out))
+				rule.chain, err, string(out))
 			logger.Error("%s", errMsg)
 			errors = append(errors, fmt.Errorf("%s", errMsg))
 			continue
@@ -1051,7 +1065,8 @@ func ensureMSSClamping() error {
 		// Verify the rule was added
 		checkCmd := exec.Command("/usr/sbin/iptables",
 			"-t", "mangle",
-			"-C", chain,
+			"-C", rule.chain,
+			rule.flag, interfaceName,
 			"-p", "tcp",
 			"--tcp-flags", "SYN,RST", "SYN",
 			"-j", "TCPMSS",
@@ -1059,13 +1074,13 @@ func ensureMSSClamping() error {
 
 		if out, err := checkCmd.CombinedOutput(); err != nil {
 			errMsg := fmt.Sprintf("Rule verification failed for chain %s: %v (output: %s)",
-				chain, err, string(out))
+				rule.chain, err, string(out))
 			logger.Error("%s", errMsg)
 			errors = append(errors, fmt.Errorf("%s", errMsg))
 			continue
 		}
 
-		logger.Info("Successfully added and verified MSS clamping rule for chain %s", chain)
+		logger.Info("Successfully added and verified MSS clamping rule for chain %s", rule.chain)
 	}
 
 	// If we encountered any errors, return them combined