diff --git a/nix/nixos-module/container/upstream.nix b/nix/nixos-module/container/upstream.nix
index 2e3a040..bbe7e2f 100644
--- a/nix/nixos-module/container/upstream.nix
+++ b/nix/nixos-module/container/upstream.nix
@@ -105,14 +105,14 @@ in
             -j DNAT --to-destination ${fwd.destination}
 
           iptables -t nat -A nixos-nat-post \
-            -d ${fwd.destination} -p ${fwd.proto} \
+            -d ${lib.elemAt (builtins.match "([0-9.]+):([0-9-]+)" fwd.destination) 0} -p ${fwd.proto} \
             --dport ${builtins.toString fwd.destination} \
             -s ${config.site.net.core.subnet4} -j MASQUERADE
 
           iptables -t nat -A nixos-nat-post \
-            -d ${fwd.destination} -p ${fwd.proto} \
+            -d ${lib.elemAt (builtins.match "([0-9.]+):([0-9-]+)" fwd.destination) 0} -p ${fwd.proto} \
             --dport ${builtins.toString fwd.destination} \
-            -s ${config.site.net.c3d2.subnets4} -j MASQUERADE
+            -s ${config.site.net.c3d2.subnet4} -j MASQUERADE
         '')  config.networking.nat.forwardPorts}
       ''}