From 22434897b6d23b76e6f77d752e35e784b7bd946c Mon Sep 17 00:00:00 2001 From: riccardom Date: Mon, 6 Jul 2026 11:03:17 +0200 Subject: [PATCH] [client] Fix lazy-conn exclusion for ingress forward peers peerRoutesAddr compared AllowedIPs (CIDR, e.g. a peer's overlay IP as /32) against the unmasked TranslatedAddress string, so the match never fired and forward-target peers were never excluded from lazy connections. Use prefix containment so a routed address matches the peer's AllowedIP. Co-Authored-By: Claude Opus 4.8 --- client/internal/engine.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/client/internal/engine.go b/client/internal/engine.go index 5f10166a2..6efbc7b73 100644 --- a/client/internal/engine.go +++ b/client/internal/engine.go @@ -2580,7 +2580,11 @@ func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers // peerRoutesAddr verifies if the peer is a router for a given address. func peerRoutesAddr(p *mgmProto.RemotePeerConfig, addr netip.Addr) bool { for _, allowedIP := range p.GetAllowedIps() { - if allowedIP == addr.String() { + prefix, err := netip.ParsePrefix(allowedIP) + if err != nil { + continue + } + if prefix.Contains(addr) { return true } }