diff --git a/hosts/fw.cloonar.com/modules/firewall.nix b/hosts/fw.cloonar.com/modules/firewall.nix
index 46d2728..9ae0c4c 100644
--- a/hosts/fw.cloonar.com/modules/firewall.nix
+++ b/hosts/fw.cloonar.com/modules/firewall.nix
@@ -70,7 +70,7 @@
             # Allow networks to access the dns and dhcp
             iifname {
               "lan",
-              "vb-gitea",
+              "vb-*",
               "podman0",
               "infrastructure",
               "wg_cloonar",
@@ -80,7 +80,7 @@
             iifname {
               "lan",
               "podman0",
-              "vb-gitea",
+              "vb-*",
               "infrastructure",
               "wg_cloonar",
               "smart",
@@ -111,14 +111,14 @@
 
             # lan and vpn to any
             # TODO: disable wan when finished
-            iifname { "wan", "lan", "vb-gitea", "podman0", "wg_cloonar" } oifname { "lan", "vb-gitea", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept
+            iifname { "wan", "lan", "vb-*", "podman0", "wg_cloonar" } oifname { "lan", "vb-*", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept
             iifname { "infrastructure" } oifname { "podman0", "vb-omada" } counter accept
 
             # Allow trusted network WAN access
             iifname {
               "lan",
               "infrastructure",
-              "vb-gitea",
+              "vb-*",
               "podman0",
               "multimedia",
               "smart",
@@ -131,7 +131,7 @@
 
         table ip nat {
           chain post {
-            iifname { "vb-*" } oifname { "server" } 10.42.97.1 comment "from internal interfaces"
+            iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces"
           }
           chain prerouting {
             type nat hook prerouting priority filter; policy accept;
@@ -140,7 +140,7 @@
           # Setup NAT masquerading on external interfaces
           chain postrouting {
             type nat hook postrouting priority filter; policy accept;
-            oifname { "wan", "server", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
+            oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
           }
         }
       '';