diff --git a/internal/nftables/compiler.go b/internal/nftables/compiler.go
index d57c16d..ed90cd5 100644
--- a/internal/nftables/compiler.go
+++ b/internal/nftables/compiler.go
@@ -228,6 +228,9 @@ func (c *Compiler) compileConntrack(state *FirewallState) error {
 		}
 
 		for _, src := range srcs {
+			if src.Zone == "all" || src.Zone == "any" {
+				src.Zone = ""
+			}
 			chains := []string{"raw_prerouting"}
 			switch {
 			case ct.Chain == config.ConntrackOutput && src.Zone != fwZone && src.Zone != "":
diff --git a/internal/nftables/compiler_test.go b/internal/nftables/compiler_test.go
index 11408e9..04bb4f3 100644
--- a/internal/nftables/compiler_test.go
+++ b/internal/nftables/compiler_test.go
@@ -2476,6 +2476,26 @@ func TestCompile_ConntrackZones(t *testing.T) {
 			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
 			want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
 		},
+		{
+			name: "all source with chain both is global in both chains",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
+			want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
+		},
+		{
+			name: "all source with chain output is global in raw_output",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackOutput},
+			want: map[string][]string{"raw_output": {""}},
+		},
+		{
+			name: "any source with chain both is global in both chains",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "any", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
+			want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
+		},
+		{
+			name: "any source with chain output is global in raw_output",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "any", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackOutput},
+			want: map[string][]string{"raw_output": {""}},
+		},
 		{
 			name: "chain both with non-fw source emits prerouting only",
 			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Dest: "fw", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},