From f29606ae870e8df84f59b6e326f93cdac1060b41 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 23 Mar 2026 20:41:55 +0100
Subject: [PATCH] fix(build): allow /31 and /32 CIDR with out-of-subnet gateway
 (#13231)

---
 misc/build.func | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/misc/build.func b/misc/build.func
index 73dfb7bc4..10aac9927 100644
--- a/misc/build.func
+++ b/misc/build.func
@@ -529,6 +529,10 @@ validate_gateway_in_subnet() {
   local ip="${static_ip%%/*}"
   local cidr="${static_ip##*/}"
 
+  # /31 and /32 are valid point-to-point / zero-trust DMZ configurations
+  # where the gateway is technically outside the subnet — skip validation
+  ((cidr >= 31)) && return 0
+
   # Convert CIDR to netmask bits
   local mask=$((0xFFFFFFFF << (32 - cidr) & 0xFFFFFFFF))