diff --git a/docs/TRAVEL-ROUTERS.md b/docs/TRAVEL-ROUTERS.md
index 9c942c1..16700ae 100644
--- a/docs/TRAVEL-ROUTERS.md
+++ b/docs/TRAVEL-ROUTERS.md
@@ -40,9 +40,12 @@ DNS = 172.31.9.1                  # Technitium — AD names resolve
 [Peer]
 PublicKey = <RACKNERD_WG_PUBLIC_KEY>      # printed by setup/playbook
 Endpoint = vpn.atlashorizon.net:51820
-# Split tunnel: both sites + the hub nets. Use 0.0.0.0/0 instead for
-# full tunnel (all hotel traffic exits via the VPS).
-AllowedIPs = 192.168.20.0/24, 192.168.7.0/24, 172.31.9.0/24, 172.31.255.1/32
+# FULL TUNNEL (GL.iNet's default, and usually what you want on hotel
+# wifi): everything rides the VPN; internet egresses via the VPS
+# (masqueraded by the hub firewall).
+AllowedIPs = 0.0.0.0/0
+# Split-tunnel alternative — only AD/hub networks ride the VPN:
+#AllowedIPs = 192.168.20.0/24, 192.168.7.0/24, 172.31.9.0/24, 172.31.255.1/32
 PersistentKeepalive = 25
 ```
 
diff --git a/host/rules.v4.template b/host/rules.v4.template
index 6c24887..b8da2e9 100644
--- a/host/rules.v4.template
+++ b/host/rules.v4.template
@@ -47,12 +47,24 @@
 -A FORWARD -i wg0 -o wg0 -s 172.31.9.0/24 -d 192.168.20.0/24 -j ACCEPT
 -A FORWARD -i wg0 -o wg0 -s 172.31.9.0/24 -d 192.168.7.0/24 -j ACCEPT
 
+# Travel routers in FULL-TUNNEL mode (AllowedIPs 0.0.0.0/0, the GL.iNet
+# default): internet egress via this box, masqueraded below in *nat.
+-A FORWARD -i wg0 -o ${PUBIF} -s 172.31.9.0/24 -j ACCEPT
+
 # Site -> client NEW connections (e.g. RDP/RSAT from a DC to a roaming
 # laptop). Off by default; uncomment if you need it.
 #-A FORWARD -i wg0 -o tun0 -d 172.31.8.0/24 -j ACCEPT
 
 COMMIT
 
+# Internet egress NAT for full-tunnel travel routers ONLY — site-bound
+# traffic (192.168.x, 172.31.x) never matches this because it leaves via
+# wg0, not ${PUBIF}. OpenVPN clients stay split-tunnel/unNATed.
+*nat
+:POSTROUTING ACCEPT [0:0]
+-A POSTROUTING -s 172.31.9.0/24 -o ${PUBIF} -j MASQUERADE
+COMMIT
+
 # ── Fallback per project brief ─────────────────────────────────────────
 # If site-side return routing for 172.31.8.0/24 becomes a pain, NAT the
 # clients behind the wg0 address instead (DCs then see 172.31.255.1):