Treat conntrack SOURCE all/any as global like an omitted source

2026-10-03 23:54:37 +10:00
parent 90d2875301
commit da65c5d0a8
2 changed files with 23 additions and 0 deletions
@@ -228,6 +228,9 @@ func (c *Compiler) compileConntrack(state *FirewallState) error {
 		}

 		for _, src := range srcs {
+			if src.Zone == "all" || src.Zone == "any" {
+				src.Zone = ""
+			}
 			chains := []string{"raw_prerouting"}
 			switch {
 			case ct.Chain == config.ConntrackOutput && src.Zone != fwZone && src.Zone != "":