diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/setup-dnat/tasks/main.yml b/ansible/playbooks/roles/vhosts/vpn-overlay/setup-dnat/tasks/main.yml
index 9c9de4e4..cdf8718c 100644
--- a/ansible/playbooks/roles/vhosts/vpn-overlay/setup-dnat/tasks/main.yml
+++ b/ansible/playbooks/roles/vhosts/vpn-overlay/setup-dnat/tasks/main.yml
@@ -1,15 +1,21 @@
 ---
-- name: 加载 overlay 配置
-  include_vars:
-    file: "{{ overlay_config_path }}"
-    name: overlay
+- name: 加载 overlay 配置（标准 YAML）
+  set_fact:
+    overlay_data: "{{ lookup('file', overlay_config_path) | from_yaml }}"
+
+- name: 提取当前节点信息（作为 current_node）
+  set_fact:
+    current_node: >-
+      {{ (overlay_data.sites + overlay_data.hubs)
+         | selectattr('name', 'equalto', inventory_hostname)
+         | list | first }}
 
 - name: 设置本节点 DNAT 所需变量
   set_fact:
-    dnat_public_ip: "{{ overlay.nodes[inventory_hostname].public_ip }}"
-    dnat_internal_ip: "{{ overlay.nodes[inventory_hostname].internal_ip }}"
-    pod_cidr: "{{ overlay.nodes[inventory_hostname].pod_cidr }}"
-    wireguard_cidr: "{{ overlay.nodes[inventory_hostname].wireguard_cidr }}"
+    dnat_public_ip: "{{ current_node.public_ip }}"
+    dnat_internal_ip: "{{ current_node.wg_ip }}"
+    pod_cidr: "{{ current_node.pod_cidr }}"
+    wireguard_cidr: "{{ current_node.wireguard_cidr }}"
 
 - name: 模板渲染 DNAT 脚本
   template:
diff --git a/ansible/playbooks/vpn-overlay-dnat.yaml b/ansible/playbooks/vpn-overlay-dnat.yaml
index 79e39a50..c09c17e9 100644
--- a/ansible/playbooks/vpn-overlay-dnat.yaml
+++ b/ansible/playbooks/vpn-overlay-dnat.yaml
@@ -1,8 +1,8 @@
 - name: Setup DNAT rules
-  hosts: ingress-nodes
+  hosts: all
   become: yes
   gather_facts: no
   vars:
     overlay_config_path: "{{ playbook_dir }}/../../config/sit/vpn-overlay.yaml"
   roles:
-    - role: setup-dnat
+    - vhosts/vpn-overlay/setup-dnat
diff --git a/config/sit/vpn-overlay.yaml b/config/sit/vpn-overlay.yaml
index 27d40c65..3b2657c2 100644
--- a/config/sit/vpn-overlay.yaml
+++ b/config/sit/vpn-overlay.yaml
@@ -17,6 +17,8 @@ hubs:
   - name: cn-hub
     interface: eth0
     public_ip: 1.15.155.245
+    pod_cidr: 10.42.0.0/16
+    wireguard_cidr: 172.30.0.0/16
     wg_ip: 172.30.0.1
     br_ip: 10.253.253.1
     local_ip: 172.30.0.1
@@ -118,6 +120,8 @@ sites:
     interface: eth0
     public_ip: 47.120.61.35
     wg_ip: 172.30.0.11
+    pod_cidr: 10.42.0.0/16
+    wireguard_cidr: 172.30.0.0/16
     br_ip: 10.253.253.11
     local_ip: 172.30.0.11
     remote_ip: 172.30.0.1
@@ -134,6 +138,8 @@ sites:
   - name: icp-huawei
     interface: eth0
     public_ip: 139.9.139.22
+    pod_cidr: 10.42.0.0/16
+    wireguard_cidr: 172.30.0.0/16
     wg_ip: 172.30.0.12
     br_ip: 10.253.253.12
     local_ip: 172.30.0.12