Reject conntrack fw DEST without an address in prerouting

Reviewed-on: #23

go.mod

@@ -3,19 +3,18 @@ module git.unkin.net/unkin/tomswall
 go 1.23
 
 require (
-	github.com/google/nftables v0.2.0
-	github.com/mdlayher/netlink v1.7.2
+	github.com/google/nftables v0.3.0
+	github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42
 	github.com/spf13/cobra v1.8.1
-	golang.org/x/sys v0.18.0
+	golang.org/x/sys v0.28.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/josharian/native v1.1.0 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/net v0.23.0 // indirect
+	golang.org/x/net v0.33.0 // indirect
 	golang.org/x/sync v0.6.0 // indirect
 )

go.sum

@@ -1,14 +1,12 @@
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/nftables v0.2.0 h1:PbJwaBmbVLzpeldoeUKGkE2RjstrjPKMl6oLrfEJ6/8=
-github.com/google/nftables v0.2.0/go.mod h1:Beg6V6zZ3oEn0JuiUQ4wqwuyqqzasOltcoXPtgLbFp4=
+github.com/google/nftables v0.3.0 h1:bkyZ0cbpVeMHXOrtlFc8ISmfVqq5gPJukoYieyVmITg=
+github.com/google/nftables v0.3.0/go.mod h1:BCp9FsrbF1Fn/Yu6CLUc9GGZFw/+hsxfluNXXmxBfRM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
-github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
-github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
-github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
+github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 h1:A1Cq6Ysb0GM0tpKMbdCXCIfBclan4oHk1Jb+Hrejirg=
+github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42/go.mod h1:BB4YCPDOzfy7FniQ/lxuYQ3dgmM2cZumHbK8RpTjN2o=
 github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
 github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
@@ -16,14 +14,14 @@ github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
 github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc h1:R83G5ikgLMxrBvLh22JhdfI8K6YXEPHx5P03Uu3DRs4=
-github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
-golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
-golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
+github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
 golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

internal/config/blrules.go

@@ -55,28 +55,11 @@ func (c *Config) validateBlrules() error {
 			return fmt.Errorf("blrules[%d]: dest required", i)
 		}
 
-		if r.Source != "all" && r.Source != "any" && r.Source != "none" &&
-			!hasPrefix(r.Source, "all!") && !hasPrefix(r.Source, "any!") {
-			for _, zs := range SplitZoneList(r.Source) {
-				if _, ok := c.Zones[zs.Zone]; !ok {
-					return fmt.Errorf("blrules[%d]: source zone %q not defined", i, zs.Zone)
-				}
-				if !validAddrList(zs.Addr) {
-					return fmt.Errorf("blrules[%d]: source %q: '!' may only prefix the whole address list", i, zs.Addr)
-				}
-			}
+		if err := c.validateZoneRef(r.Source); err != nil {
+			return fmt.Errorf("blrules[%d]: source %w", i, err)
 		}
-
-		if r.Dest != "all" && r.Dest != "any" && r.Dest != "none" &&
-			!hasPrefix(r.Dest, "all!") && !hasPrefix(r.Dest, "any!") {
-			for _, zs := range SplitZoneList(r.Dest) {
-				if _, ok := c.Zones[zs.Zone]; !ok {
-					return fmt.Errorf("blrules[%d]: dest zone %q not defined", i, zs.Zone)
-				}
-				if !validAddrList(zs.Addr) {
-					return fmt.Errorf("blrules[%d]: dest %q: '!' may only prefix the whole address list", i, zs.Addr)
-				}
-			}
+		if err := c.validateZoneRef(r.Dest); err != nil {
+			return fmt.Errorf("blrules[%d]: dest %w", i, err)
 		}
 	}
 	return nil

internal/config/conntrack.go

@@ -1,6 +1,9 @@
 package config
 
-import "fmt"
+import (
+	"fmt"
+	"strings"
+)
 
 type ConntrackAction string
 
@@ -68,8 +71,14 @@ func (c *Config) validateConntrack() error {
 			return fmt.Errorf("conntrack[%d]: helper name required for helper action", i)
 		}
 
-		if ct.Source == "" && ct.Dest == "" && ct.Action != ConntrackHelper {
-			return fmt.Errorf("conntrack[%d]: source or dest required", i)
+		if HasZoneExclusion(ct.Source) || HasZoneExclusion(ct.Dest) {
+			return fmt.Errorf("conntrack[%d]: zone exclusions are not supported in conntrack entries", i)
+		}
+		if err := c.validateZoneRef(ct.Source); err != nil {
+			return fmt.Errorf("conntrack[%d]: source %w", i, err)
+		}
+		if err := c.validateZoneRef(ct.Dest); err != nil {
+			return fmt.Errorf("conntrack[%d]: dest %w", i, err)
 		}
 
 		if ct.User != "" {
@@ -84,3 +93,9 @@ func (c *Config) validateConntrack() error {
 	}
 	return nil
 }
+
+// HasZoneExclusion reports an all/any zone ref with a "+" or "!" modifier (all+, all!x, any+!x, ...).
+func HasZoneExclusion(spec string) bool {
+	zones, _, _ := strings.Cut(spec, ":")
+	return (strings.HasPrefix(zones, "all") || strings.HasPrefix(zones, "any")) && strings.ContainsAny(zones[3:], "+!")
+}

internal/config/extras_test.go

@@ -53,11 +53,52 @@ func TestValidateConntrack(t *testing.T) {
 			},
 		},
 		{
-			name: "source or dest required for non-helper",
-			rules: []ConntrackRule{
-				{Action: ConntrackDrop},
-			},
-			wantErr: "source or dest required",
+			name:  "omitted source and dest is valid",
+			rules: []ConntrackRule{{Action: ConntrackNoTrack, Proto: "udp", DPort: PortSpec{"53"}}},
+		},
+		{
+			name:    "unknown source zone",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "nte"}},
+			wantErr: `source zone "nte" not defined`,
+		},
+		{
+			name:    "unknown dest zone",
+			rules:   []ConntrackRule{{Action: ConntrackDrop, Source: "net", Dest: "nte:192.0.2.1"}},
+			wantErr: `dest zone "nte" not defined`,
+		},
+		{
+			name:  "all and plain zone forms are valid",
+			rules: []ConntrackRule{{Action: ConntrackNoTrack, Source: "net,fw", Dest: "all:192.0.2.1"}},
+		},
+		{
+			name:    "Source all!net rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "all!net"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "Dest all!net:192.0.2.1 rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Dest: "all!net:192.0.2.1"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "Source all+ rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "all+"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "Dest all+!net rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Dest: "all+!net"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "Source any!net rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "any!net"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "Dest any+ rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Dest: "any+"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
 		},
 		{
 			name: "helper without source/dest is valid",

internal/config/rules.go

@@ -173,29 +173,13 @@ func (c *Config) validateRules() error {
 			return fmt.Errorf("rule[%d]: dest required", i)
 		}
 
-		if r.Source != "all" && r.Source != "any" && r.Source != "none" &&
-			!hasPrefix(r.Source, "all+") && !hasPrefix(r.Source, "all!") && !hasPrefix(r.Source, "any!") {
-			for _, zs := range SplitZoneList(r.Source) {
-				if _, ok := c.Zones[zs.Zone]; !ok {
-					return fmt.Errorf("rule[%d]: source zone %q not defined", i, zs.Zone)
-				}
-				if !validAddrList(zs.Addr) {
-					return fmt.Errorf("rule[%d]: source %q: '!' may only prefix the whole address list", i, zs.Addr)
-				}
-			}
+		if err := c.validateZoneRef(r.Source); err != nil {
+			return fmt.Errorf("rule[%d]: source %w", i, err)
 		}
 
 		if r.Action != RuleDNAT && r.Action != RuleRedirect && r.Action != RuleNoNAT {
-			if r.Dest != "all" && r.Dest != "any" && r.Dest != "none" &&
-				!hasPrefix(r.Dest, "all+") && !hasPrefix(r.Dest, "all!") && !hasPrefix(r.Dest, "any!") {
-				for _, zs := range SplitZoneList(r.Dest) {
-					if _, ok := c.Zones[zs.Zone]; !ok {
-						return fmt.Errorf("rule[%d]: dest zone %q not defined", i, zs.Zone)
-					}
-					if !validAddrList(zs.Addr) {
-						return fmt.Errorf("rule[%d]: dest %q: '!' may only prefix the whole address list", i, zs.Addr)
-					}
-				}
+			if err := c.validateZoneRef(r.Dest); err != nil {
+				return fmt.Errorf("rule[%d]: dest %w", i, err)
 			}
 		}
 
@@ -264,6 +248,32 @@ func zoneFromSpec(spec string) string {
 	return spec
 }
 
-func hasPrefix(s, prefix string) bool {
-	return len(s) >= len(prefix) && s[:len(prefix)] == prefix
+// validateZoneRef checks a SOURCE/DEST spec: all/any[+][!excluded,...][:addr], none, or a declared zone list.
+func (c *Config) validateZoneRef(spec string) error {
+	zones, addr, _ := strings.Cut(spec, ":")
+	base, excl, isExcl := strings.Cut(zones, "!")
+	switch base {
+	case "", "none", "all", "all+", "any", "any+":
+		if base == "" && isExcl {
+			return fmt.Errorf("%q: exclusion needs all or any", spec)
+		}
+		for _, z := range strings.Split(excl, ",") {
+			if _, ok := c.Zones[strings.TrimSpace(z)]; isExcl && !ok {
+				return fmt.Errorf("excluded zone %q not defined", z)
+			}
+		}
+		if !validAddrList(addr) {
+			return fmt.Errorf("%q: '!' may only prefix the whole address list", addr)
+		}
+		return nil
+	}
+	for _, zs := range SplitZoneList(spec) {
+		if _, ok := c.Zones[zs.Zone]; !ok {
+			return fmt.Errorf("zone %q not defined", zs.Zone)
+		}
+		if !validAddrList(zs.Addr) {
+			return fmt.Errorf("%q: '!' may only prefix the whole address list", zs.Addr)
+		}
+	}
+	return nil
 }

internal/nftables/compiler.go

@@ -205,7 +205,7 @@ func (c *Compiler) compileBlrules(state *FirewallState) error {
 		}
 		if err := c.compileOneRule(state, tag, rule.Source, rule.Dest,
 			rule.Proto, rule.DPort, rule.SPort,
-			action, rule.Log, "", fwZone, ""); err != nil {
+			action, rule.Log, "", "", fwZone, ""); err != nil {
 			return fmt.Errorf("blrule[%d]: %w", i, err)
 		}
 	}
@@ -213,35 +213,82 @@ func (c *Compiler) compileBlrules(state *FirewallState) error {
 }
 
 func (c *Compiler) compileConntrack(state *FirewallState) error {
+	fwZone := c.cfg.FirewallZone()
 	for i, ct := range c.cfg.Conntrack {
 		tag := fmt.Sprintf("conntrack:%d", i)
-
-		chains := []string{"prerouting"}
-		switch ct.Chain {
-		case config.ConntrackOutput:
-			chains = []string{"output"}
-		case config.ConntrackBoth:
-			chains = []string{"prerouting", "output"}
+		if config.HasZoneExclusion(ct.Source) || config.HasZoneExclusion(ct.Dest) {
+			return fmt.Errorf("conntrack[%d]: zone exclusions are not supported in conntrack entries", i)
+		}
+		srcs, dsts := c.zoneSpecs(ct.Source), c.zoneSpecs(ct.Dest)
+		if len(srcs) == 0 {
+			srcs = []config.ZoneSpec{{}}
+		}
+		if len(dsts) == 0 {
+			dsts = []config.ZoneSpec{{}}
 		}
 
-		matches, err := l4Matches(ct.Proto, ct.DPort, nil)
-		if err != nil {
-			return fmt.Errorf("conntrack[%d]: %w", i, err)
+		for _, src := range srcs {
+			if src.Zone == "all" || src.Zone == "any" {
+				src.Zone = ""
+			}
+			chains := []string{"raw_prerouting"}
+			switch {
+			case ct.Chain == config.ConntrackOutput && src.Zone != fwZone && src.Zone != "":
+				return fmt.Errorf("conntrack[%d]: chain output needs SOURCE %s, got %q", i, fwZone, src.Zone)
+			case ct.Chain == config.ConntrackPrerouting && src.Zone == fwZone:
+				return fmt.Errorf("conntrack[%d]: SOURCE %s cannot use chain prerouting", i, fwZone)
+			case ct.Chain != config.ConntrackPrerouting && src.Zone == fwZone, ct.Chain == config.ConntrackOutput:
+				chains = []string{"raw_output"}
+			case ct.Chain == config.ConntrackBoth && src.Zone == "":
+				chains = []string{"raw_prerouting", "raw_output"}
+			}
+			for _, srcAddr := range splitAddrs(src.Addr) {
+				for _, dst := range dsts {
+					for _, dstAddr := range splitAddrs(dst.Addr) {
+						for _, chain := range chains {
+							if err := c.compileConntrackPair(state, tag, chain, ct, src.Zone, srcAddr, dst.Zone, dstAddr); err != nil {
+								return fmt.Errorf("conntrack[%d]: %w", i, err)
+							}
+						}
+					}
+				}
+			}
 		}
+	}
+	return nil
+}
 
-		for _, chain := range chains {
+// compileConntrackPair matches iif of the source zone in raw_prerouting and oif of the dest zone in raw_output.
+func (c *Compiler) compileConntrackPair(state *FirewallState, tag, chain string, ct config.ConntrackRule,
+	srcZone, srcAddr, dstZone, dstAddr string) error {
+	if ct.Action == config.ConntrackHelper {
+		return nil
+	}
+	if _, ok := c.cfg.Zones[dstZone]; ok && chain == "raw_prerouting" &&
+		(dstAddr == "" || strings.HasPrefix(dstAddr, "!")) {
+		return fmt.Errorf("conntrack DEST zone %q needs an address in prerouting", dstZone)
+	}
+	srcIfaces, dstIfaces := c.resolveZoneInterfaces(srcZone, srcAddr), []string{""}
+	if chain == "raw_prerouting" && c.resolveZoneInterfaces(dstZone, dstAddr) == nil {
+		return nil
+	}
+	if chain == "raw_output" {
+		srcIfaces, dstIfaces = []string{""}, c.resolveZoneInterfaces(dstZone, dstAddr)
+	}
+	for _, srcIface := range srcIfaces {
+		for _, dstIface := range dstIfaces {
+			matches, err := c.buildMatchExprs(srcIface, dstIface, chain, ct.Proto, ct.DPort, ct.SPort, srcAddr, dstAddr)
+			if err != nil {
+				return err
+			}
 			for _, m := range matches {
-				exprs := append([]expr.Any{}, m.exprs...)
-
+				exprs := m.exprs
 				switch ct.Action {
 				case config.ConntrackNoTrack:
 					exprs = append(exprs, &expr.Notrack{})
-				case config.ConntrackHelper:
-					continue
 				case config.ConntrackDrop:
 					exprs = append(exprs, &expr.Verdict{Kind: expr.VerdictDrop})
 				}
-
 				state.Rules[chain] = append(state.Rules[chain], ManagedRule{
 					Chain: chain,
 					Exprs: exprs,
@@ -276,14 +323,14 @@ func (c *Compiler) compileRules(state *FirewallState) error {
 			if err != nil {
 				return fmt.Errorf("rule[%d]: %w", i, err)
 			}
-			if len(matches)*specCount(rule.Source, rule.Dest, rule.Action) > 1 {
+			if len(matches)*c.specCount(rule.Source, rule.Dest, rule.OrigDest, rule.Action) > 1 {
 				return fmt.Errorf("rule[%d]: ratelimit/connlimit cannot be combined with proto, port, zone or address lists (each expanded rule would get its own limiter)", i)
 			}
 		}
 
 		if err := c.compileOneRule(state, tag, rule.Source, rule.Dest,
 			proto, dports, sport,
-			rule.Action, rule.Log, rule.Dest, fwZone, rule.Section); err != nil {
+			rule.Action, rule.Log, rule.Dest, rule.OrigDest, fwZone, rule.Section); err != nil {
 			return fmt.Errorf("rule[%d]: %w", i, err)
 		}
 
@@ -360,22 +407,29 @@ func (c *Compiler) applyChainExtras(state *FirewallState, chain, tag string, rul
 
 func (c *Compiler) compileOneRule(state *FirewallState, tag, srcSpec, dstSpec, proto string,
 	dports, sports config.PortSpec, action config.RuleAction, logLevel string,
-	dnatDest string, fwZone string, section config.RuleSection) error {
+	dnatDest, origDest string, fwZone string, section config.RuleSection) error {
 
-	for _, src := range zoneSpecs(srcSpec) {
+	for _, src := range c.zoneSpecs(srcSpec) {
 		for _, srcAddr := range splitAddrs(src.Addr) {
-			if action == config.RuleDNAT || action == config.RuleRedirect {
-				if err := c.compileDNATRule(state, tag, src.Zone, srcAddr, dstSpec, proto, dports, action, logLevel); err != nil {
-					return err
-				}
-				continue
-			}
-			for _, dst := range zoneSpecs(dstSpec) {
-				for _, dstAddr := range splitAddrs(dst.Addr) {
-					if err := c.compileZonePair(state, tag, src.Zone, srcAddr, dst.Zone, dstAddr, proto,
-						dports, sports, action, logLevel, fwZone, section); err != nil {
+			for _, od := range splitAddrs(origDest) {
+				if action == config.RuleDNAT || action == config.RuleRedirect {
+					if err := c.compileDNATRule(state, tag, src.Zone, srcAddr, od, dstSpec, proto, dports, action, logLevel); err != nil {
 						return err
 					}
+					continue
+				}
+				for _, dst := range c.zoneSpecs(dstSpec) {
+					// Exclusion expansion never pairs fw with itself, and pairs a zone with itself only for "all+".
+					if src.Zone == dst.Zone && (isZoneExclusion(srcSpec) || isZoneExclusion(dstSpec)) &&
+						(src.Zone == fwZone || !strings.Contains(srcSpec, "+!") && !strings.Contains(dstSpec, "+!")) {
+						continue
+					}
+					for _, dstAddr := range splitAddrs(dst.Addr) {
+						if err := c.compileZonePair(state, tag, src.Zone, srcAddr, dst.Zone, dstAddr, od, proto,
+							dports, sports, action, logLevel, fwZone, section); err != nil {
+							return err
+						}
+					}
 				}
 			}
 		}
@@ -384,26 +438,40 @@ func (c *Compiler) compileOneRule(state *FirewallState, tag, srcSpec, dstSpec, p
 }
 
 // specCount is how many zone/address combinations compileOneRule expands src and dst into.
-func specCount(srcSpec, dstSpec string, action config.RuleAction) int {
+func (c *Compiler) specCount(srcSpec, dstSpec, origDest string, action config.RuleAction) int {
 	count := func(spec string) (n int) {
-		for _, z := range zoneSpecs(spec) {
+		for _, z := range c.zoneSpecs(spec) {
 			n += len(splitAddrs(z.Addr))
 		}
 		return n
 	}
+	n := count(srcSpec) * len(splitAddrs(origDest))
 	if action == config.RuleDNAT || action == config.RuleRedirect {
-		return count(srcSpec)
+		return n
 	}
-	return count(srcSpec) * count(dstSpec)
+	return n * count(dstSpec)
 }
 
-// zoneSpecs expands a comma zone list; "all"/"any" forms keep their own comma (exclusion) syntax.
-func zoneSpecs(spec string) []config.ZoneSpec {
+// zoneSpecs expands a comma zone list; "all"/"any" stay global and "all!x,y" becomes every zone but x and y.
+func (c *Compiler) zoneSpecs(spec string) []config.ZoneSpec {
 	zone, addr := splitZoneSpec(spec)
-	if base, _, _ := strings.Cut(strings.TrimSuffix(zone, "+"), "!"); base == "all" || base == "any" {
-		return []config.ZoneSpec{{Zone: zone, Addr: addr}}
+	if !isZoneExclusion(zone) {
+		if base := strings.TrimSuffix(zone, "+"); base == "all" || base == "any" {
+			return []config.ZoneSpec{{Zone: zone, Addr: addr}}
+		}
+		return config.SplitZoneList(spec)
 	}
-	return config.SplitZoneList(spec)
+	var out []config.ZoneSpec
+	for _, z := range c.expandZoneRef(zone) {
+		out = append(out, config.ZoneSpec{Zone: z, Addr: addr})
+	}
+	return out
+}
+
+func isZoneExclusion(spec string) bool {
+	base, _, ok := strings.Cut(spec, "!")
+	base = strings.TrimSuffix(base, "+")
+	return ok && (base == "all" || base == "any")
 }
 
 // splitAddrs yields one alternative per listed address; a negated list stays one AND-ed match.
@@ -414,12 +482,16 @@ func splitAddrs(addr string) []string {
 	return strings.Split(addr, ",")
 }
 
-func (c *Compiler) compileZonePair(state *FirewallState, tag, srcZone, srcAddr, dstZone, dstAddr, proto string,
+func (c *Compiler) compileZonePair(state *FirewallState, tag, srcZone, srcAddr, dstZone, dstAddr, origDest, proto string,
 	dports, sports config.PortSpec, action config.RuleAction, logLevel string,
 	fwZone string, section config.RuleSection) error {
-	srcIfaces := c.resolveZoneInterfaces(srcZone)
-	dstIfaces := c.resolveZoneInterfaces(dstZone)
+	srcIfaces := c.resolveZoneInterfaces(srcZone, srcAddr)
+	dstIfaces := c.resolveZoneInterfaces(dstZone, dstAddr)
 	chain := c.selectChain(srcZone, dstZone, fwZone)
+	// ponytail: forward daddr is post-DNAT; lift with `ct original daddr` (expr.Ct Direction, google/nftables v0.3.0).
+	if origDest != "" && chain == "forward" {
+		return fmt.Errorf("origdest: ORIGDEST on forwarded rules is not supported yet")
+	}
 
 	for _, srcIface := range srcIfaces {
 		for _, dstIface := range dstIfaces {
@@ -427,6 +499,15 @@ func (c *Compiler) compileZonePair(state *FirewallState, tag, srcZone, srcAddr,
 			if err != nil {
 				return err
 			}
+			if origDest != "" {
+				od, err := matchOrigDest(origDest)
+				if err != nil {
+					return fmt.Errorf("origdest: %w", err)
+				}
+				for i := range matches {
+					matches[i].exprs = append(matches[i].exprs, od...)
+				}
+			}
 
 			for _, m := range matches {
 				exprs := m.exprs
@@ -455,7 +536,7 @@ func (c *Compiler) compileZonePair(state *FirewallState, tag, srcZone, srcAddr,
 	return nil
 }
 
-func (c *Compiler) compileDNATRule(state *FirewallState, tag, srcZone, srcAddr, dstSpec, proto string,
+func (c *Compiler) compileDNATRule(state *FirewallState, tag, srcZone, srcAddr, origDest, dstSpec, proto string,
 	dports config.PortSpec, action config.RuleAction, logLevel string) error {
 	chain := "prerouting"
 
@@ -474,7 +555,15 @@ func (c *Compiler) compileDNATRule(state *FirewallState, tag, srcZone, srcAddr,
 		dnatPort = uint16(p)
 	}
 
-	srcIfaces := c.resolveZoneInterfaces(srcZone)
+	srcIfaces := c.resolveZoneInterfaces(srcZone, srcAddr)
+
+	var odExprs []expr.Any
+	if origDest != "" {
+		var err error
+		if odExprs, err = matchOrigDest(origDest); err != nil {
+			return fmt.Errorf("origdest: %w", err)
+		}
+	}
 
 	matches, err := l4Matches(proto, dports, nil)
 	if err != nil {
@@ -501,6 +590,7 @@ func (c *Compiler) compileDNATRule(state *FirewallState, tag, srcZone, srcAddr,
 				}
 				exprs = append(exprs, src...)
 			}
+			exprs = append(exprs, odExprs...)
 
 			exprs = append(exprs, m.exprs...)
 
@@ -538,6 +628,7 @@ func (c *Compiler) compileDNATRule(state *FirewallState, tag, srcZone, srcAddr,
 						)
 						natExpr.RegProtoMin = 2
 						natExpr.RegProtoMax = 2
+						natExpr.Specified = true
 					}
 					exprs = append(exprs, natExpr)
 				} else {
@@ -558,6 +649,7 @@ func (c *Compiler) compileDNATRule(state *FirewallState, tag, srcZone, srcAddr,
 						)
 						natExpr.RegProtoMin = 2
 						natExpr.RegProtoMax = 2
+						natExpr.Specified = true
 					}
 					exprs = append(exprs, natExpr)
 				}
@@ -589,8 +681,8 @@ func (c *Compiler) compilePolicies(state *FirewallState) error {
 				}
 
 				chain := c.selectChain(sz, dz, fwZone)
-				srcIfaces := c.resolveZoneInterfaces(sz)
-				dstIfaces := c.resolveZoneInterfaces(dz)
+				srcIfaces := c.resolveZoneInterfaces(sz, "")
+				dstIfaces := c.resolveZoneInterfaces(dz, "")
 
 				for _, si := range srcIfaces {
 					for _, di := range dstIfaces {
@@ -599,7 +691,7 @@ func (c *Compiler) compilePolicies(state *FirewallState) error {
 						if si != "" {
 							exprs = append(exprs, matchIfaceName(true, si)...)
 						}
-						if di != "" && chain == "forward" {
+						if di != "" && chain != "input" {
 							exprs = append(exprs, matchIfaceName(false, di)...)
 						}
 
@@ -932,34 +1024,34 @@ func (c *Compiler) selectChain(srcZone, dstZone, fwZone string) string {
 	return "forward"
 }
 
-func (c *Compiler) resolveZoneInterfaces(zone string) []string {
-	if zone == "all" || zone == "" {
+// resolveZoneInterfaces returns nil (fail closed) for an unknown zone, or one with no interfaces unless a non-negated address match narrows the rule.
+func (c *Compiler) resolveZoneInterfaces(zone, addr string) []string {
+	switch zone {
+	case "", "all", "all+", "any", "any+":
 		return []string{""}
 	}
-	ifaces := c.cfg.ZoneInterfaces(zone)
-	if len(ifaces) > 0 {
-		return ifaces
-	}
-	if z, ok := c.cfg.Zones[zone]; ok && z.Type == config.ZoneIP && !c.zoneHasHosts(zone) {
-		if !c.warned[zone] {
-			if c.warned == nil {
-				c.warned = map[string]bool{}
-			}
-			c.warned[zone] = true
-			slog.Warn("compiler: zone has no interfaces, skipping its rules", "zone", zone)
-		}
+	z, ok := c.cfg.Zones[zone]
+	if !ok {
+		slog.Warn("compiler: unknown zone, skipping its rules", "zone", zone)
 		return nil
 	}
-	return []string{""}
-}
-
-func (c *Compiler) zoneHasHosts(zone string) bool {
-	for _, h := range c.cfg.Hosts {
-		if h.Zone == zone {
-			return true
-		}
+	if z.Type == config.ZoneFirewall {
+		return []string{""}
 	}
-	return false
+	if ifaces := c.cfg.ZoneInterfaces(zone); len(ifaces) > 0 {
+		return ifaces
+	}
+	if addr != "" && !strings.HasPrefix(addr, "!") {
+		return []string{""}
+	}
+	if !c.warned[zone] {
+		if c.warned == nil {
+			c.warned = map[string]bool{}
+		}
+		c.warned[zone] = true
+		slog.Warn("compiler: zone has no interfaces, skipping its rules", "zone", zone)
+	}
+	return nil
 }
 
 func (c *Compiler) expandZoneRef(ref string) []string {
@@ -977,7 +1069,7 @@ func (c *Compiler) expandZoneRef(ref string) []string {
 		}
 	}
 
-	if base == "all" || base == "all+" {
+	if base == "all" || base == "all+" || base == "any" || base == "any+" {
 		var zones []string
 		for name := range c.cfg.Zones {
 			if excluded != nil && excluded[name] {
@@ -997,7 +1089,7 @@ func (c *Compiler) buildMatchExprs(srcIface, dstIface, chain, proto string, dpor
 	if srcIface != "" {
 		exprs = append(exprs, matchIfaceName(true, srcIface)...)
 	}
-	if dstIface != "" && chain == "forward" {
+	if dstIface != "" && chain != "input" {
 		exprs = append(exprs, matchIfaceName(false, dstIface)...)
 	}
 
@@ -1386,6 +1478,30 @@ func matchDestCIDR(cidr string) ([]expr.Any, error) {
 	return matchAddrCIDR(cidr, false)
 }
 
+// matchOrigDest guards the daddr match with the address's nfproto so it is family-correct in the inet table.
+func matchOrigDest(addr string) ([]expr.Any, error) {
+	var proto byte
+	for i, a := range strings.Split(strings.TrimPrefix(addr, "!"), ",") {
+		a, _, _ = strings.Cut(a, "/")
+		p := byte(unix.NFPROTO_IPV6)
+		if ip := net.ParseIP(a); ip != nil && ip.To4() != nil {
+			p = unix.NFPROTO_IPV4
+		}
+		if i > 0 && p != proto {
+			return nil, fmt.Errorf("%q mixes IPv4 and IPv6 addresses", addr)
+		}
+		proto = p
+	}
+	dst, err := matchDestCIDR(addr)
+	if err != nil {
+		return nil, err
+	}
+	return append([]expr.Any{
+		&expr.Meta{Key: expr.MetaKeyNFPROTO, Register: 1},
+		&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{proto}},
+	}, dst...), nil
+}
+
 func matchAddrCIDR(cidr string, isSrc bool) ([]expr.Any, error) {
 	negated := false
 	if strings.HasPrefix(cidr, "!") {

internal/nftables/compiler_test.go

@@ -1,8 +1,11 @@
 package nftables
 
 import (
+	"bytes"
 	"encoding/binary"
 	"fmt"
+	"log/slog"
+	"net"
 	"reflect"
 	"strings"
 	"testing"
@@ -141,17 +144,17 @@ func TestCompiler_ResolveZoneInterfaces(t *testing.T) {
 	}
 	c := NewCompiler(cfg)
 
-	ifaces := c.resolveZoneInterfaces("net")
+	ifaces := c.resolveZoneInterfaces("net", "")
 	if len(ifaces) != 1 || ifaces[0] != "eth0" {
 		t.Errorf("resolveZoneInterfaces(net) = %v, want [eth0]", ifaces)
 	}
 
-	ifaces = c.resolveZoneInterfaces("all")
+	ifaces = c.resolveZoneInterfaces("all", "")
 	if len(ifaces) != 1 || ifaces[0] != "" {
 		t.Errorf("resolveZoneInterfaces(all) = %v, want [\"\"]", ifaces)
 	}
 
-	ifaces = c.resolveZoneInterfaces("fw")
+	ifaces = c.resolveZoneInterfaces("fw", "")
 	if len(ifaces) != 1 || ifaces[0] != "" {
 		t.Errorf("resolveZoneInterfaces(fw) = %v, want [\"\"]", ifaces)
 	}
@@ -453,15 +456,19 @@ func TestCompile_DNAT(t *testing.T) {
 		t.Fatalf("Compile() error: %v", err)
 	}
 
-	found := false
+	var nat *expr.NAT
 	for _, r := range state.Rules["prerouting"] {
 		if r.Tag == "rule:0" {
-			found = true
+			nat, _ = r.Exprs[len(r.Exprs)-1].(*expr.NAT)
 			break
 		}
 	}
-	if !found {
-		t.Error("no DNAT rule found in prerouting chain")
+	if nat == nil {
+		t.Fatal("no DNAT rule found in prerouting chain")
+	}
+	// The kernel reports PROTO_SPECIFIED whenever a port register is set.
+	if nat.RegProtoMin != 2 || !nat.Specified {
+		t.Errorf("DNAT with port must set RegProtoMin and Specified to match kernel readback, got %+v", nat)
 	}
 }
 
@@ -576,7 +583,7 @@ func TestCompile_ConntrackNoTrack(t *testing.T) {
 			{
 				Action: config.ConntrackNoTrack,
 				Source: "net",
-				Dest:   "fw",
+				Dest:   "fw:192.0.2.1",
 				Proto:  "udp",
 				DPort:  config.PortSpec{"53"},
 			},
@@ -590,14 +597,17 @@ func TestCompile_ConntrackNoTrack(t *testing.T) {
 	}
 
 	found := false
-	for _, r := range state.Rules["prerouting"] {
-		if r.Tag == "conntrack:0:prerouting" {
+	for _, r := range state.Rules["raw_prerouting"] {
+		if r.Tag == "conntrack:0:raw_prerouting" {
 			found = true
 			break
 		}
 	}
 	if !found {
-		t.Error("no notrack rule found in prerouting chain")
+		t.Error("no notrack rule found in raw_prerouting chain")
+	}
+	if len(state.Rules["prerouting"]) != 0 {
+		t.Error("conntrack rule leaked into the nat prerouting chain")
 	}
 }
 
@@ -1758,6 +1768,83 @@ func TestCompile_PortAndProtoLists(t *testing.T) {
 	}
 }
 
+func TestCompile_OutputPolicyMatchesOif(t *testing.T) {
+	cfg := listCfg(func(c *config.Config) {
+		c.Zones["lan"] = config.Zone{Type: config.ZoneIP}
+		c.Interfaces = append(c.Interfaces, config.Interface{Zone: "lan", Interface: "eth1"})
+		c.Policy = []config.Policy{{Source: "fw", Dest: "lan", Action: config.PolicyAccept}}
+	})
+	got := taggedRules(mustCompile(t, cfg), "output", "policy:0")
+	if len(got) != 1 || describeRule(got[0]) != "oif=eth1" {
+		t.Fatalf("fw->lan policy = %v, want one rule oif=eth1", got)
+	}
+}
+
+func TestCompile_InterfacelessZonesFailClosed(t *testing.T) {
+	ipsec := func(c *config.Config) { c.Zones["ips"] = config.Zone{Type: config.ZoneIPSec} }
+	rule := func(dest string) func(*config.Config) {
+		return func(c *config.Config) {
+			ipsec(c)
+			c.Rules = []config.Rule{{Action: config.RuleAccept, Source: "fw", Dest: dest}}
+		}
+	}
+	tests := []struct {
+		name  string
+		mod   func(*config.Config)
+		tag   string
+		want  int
+		warns []string
+	}{
+		{"ipsec zone without interface", func(c *config.Config) {
+			ipsec(c)
+			c.Policy = []config.Policy{{Source: "fw", Dest: "ips", Action: config.PolicyAccept}}
+		}, "policy:0", 0, []string{"ips"}},
+		{"hosts-only zone", func(c *config.Config) {
+			c.Zones["hst"] = config.Zone{Type: config.ZoneIP}
+			c.Hosts = []config.Host{{Zone: "hst", Interface: "eth0", Addresses: []string{"192.0.2.0/24"}}}
+			c.Policy = []config.Policy{{Source: "fw", Dest: "hst", Action: config.PolicyAccept}}
+		}, "policy:0", 0, []string{"hst"}},
+		{"fw all expansion keeps zones with interfaces", func(c *config.Config) {
+			ipsec(c)
+			c.Zones["hst"] = config.Zone{Type: config.ZoneIP}
+			c.Hosts = []config.Host{{Zone: "hst", Interface: "eth0", Addresses: []string{"192.0.2.0/24"}}}
+			c.Policy = []config.Policy{{Source: "fw", Dest: "all", Action: config.PolicyDrop}}
+		}, "policy:0", 1, []string{"hst", "ips"}},
+		{"negated address does not scope", rule("ips:!192.0.2.1"), "rule:0", 0, []string{"ips"}},
+		{"address scopes", rule("ips:192.0.2.1"), "rule:0", 1, []string{"ips"}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var logs bytes.Buffer
+			prev := slog.Default()
+			slog.SetDefault(slog.New(slog.NewTextHandler(&logs, nil)))
+			defer slog.SetDefault(prev)
+
+			state := mustCompile(t, listCfg(tt.mod))
+			got := 0
+			for chain := range state.Rules {
+				for _, r := range taggedRules(state, chain, tt.tag) {
+					got++
+					if describeRule(r) == "" {
+						t.Errorf("%s: un-scoped rule", chain)
+					}
+				}
+			}
+			if got != tt.want {
+				t.Errorf("got %d %s rules, want %d", got, tt.tag, tt.want)
+			}
+			if n := strings.Count(logs.String(), "zone has no interfaces"); n != len(tt.warns) {
+				t.Errorf("got %d warnings, want %d:\n%s", n, len(tt.warns), logs.String())
+			}
+			for _, z := range tt.warns {
+				if n := strings.Count(logs.String(), "zone="+z+"\n"); n != 1 {
+					t.Errorf("zone %s warned %d times, want 1", z, n)
+				}
+			}
+		})
+	}
+}
+
 // describeRule renders a rule's iif/oif/saddr/daddr matches, e.g. "iif=eth1 oif=eth2 daddr=192.0.2.1".
 func describeRule(r ManagedRule) string {
 	var parts []string
@@ -1781,12 +1868,15 @@ func describeRule(r ManagedRule) string {
 				parts = append(parts, "oif="+strings.TrimRight(string(cmp.Data), "\x00"))
 			}
 		case *expr.Payload:
-			if m.Base == expr.PayloadBaseNetworkHeader && m.Len == 4 {
-				name := map[uint32]string{12: "saddr", 16: "daddr"}[m.Offset]
+			if m.Base == expr.PayloadBaseNetworkHeader && (m.Len == 4 || m.Len == 16) {
+				name := map[uint32]string{12: "saddr", 16: "daddr", 8: "saddr", 24: "daddr"}[m.Offset]
 				if cmp.Op == expr.CmpOpNeq {
 					name = "!" + name
 				}
-				parts = append(parts, fmt.Sprintf("%s=%d.%d.%d.%d", name, cmp.Data[0], cmp.Data[1], cmp.Data[2], cmp.Data[3]))
+				parts = append(parts, name+"="+net.IP(cmp.Data).String())
+			}
+			if m.Base == expr.PayloadBaseTransportHeader && m.Offset == 0 && m.Len == 2 && cmp.Op == expr.CmpOpEq {
+				parts = append(parts, fmt.Sprintf("sport=%d", binary.BigEndian.Uint16(cmp.Data)))
 			}
 		}
 	}
@@ -1803,7 +1893,7 @@ func TestCompile_CommaZoneLists(t *testing.T) {
 		{
 			name: "fw in source list goes to output",
 			rule: config.Rule{Action: config.RuleAccept, Source: "fw,lan", Dest: "svr", Proto: "tcp", DPort: config.PortSpec{"22"}},
-			want: map[string][]string{"output": {""}, "forward": {"iif=eth1 oif=eth2"}},
+			want: map[string][]string{"output": {"oif=eth2"}, "forward": {"iif=eth1 oif=eth2"}},
 		},
 		{
 			name: "dest list with fw splits input and forward",
@@ -1846,9 +1936,54 @@ func TestCompile_CommaZoneLists(t *testing.T) {
 			want: map[string][]string{"forward": {"iif=eth1 oif=eth3", "iif=eth1 oif=eth0"}},
 		},
 		{
-			name: "interface-less ipsec zone keeps zone-agnostic rule, ip zone skipped",
+			name: "interface-less zones are skipped",
 			rule: config.Rule{Action: config.RuleAccept, Source: "lan", Dest: "vpn,dmz"},
-			want: map[string][]string{"forward": {"iif=eth1"}},
+			want: map[string][]string{},
+		},
+		{
+			name: "interface-less zone kept when address narrows it",
+			rule: config.Rule{Action: config.RuleAccept, Source: "lan", Dest: "vpn:192.0.2.1"},
+			want: map[string][]string{"forward": {"iif=eth1 daddr=192.0.2.1"}},
+		},
+		{
+			name: "fw source matches dest zone oif",
+			rule: config.Rule{Action: config.RuleAccept, Source: "fw", Dest: "lan,vpn,dmz", Proto: "tcp", DPort: config.PortSpec{"22"}},
+			want: map[string][]string{"output": {"oif=eth1"}},
+		},
+		{
+			name: "fw to all has no oif",
+			rule: config.Rule{Action: config.RuleAccept, Source: "fw", Dest: "all:192.0.2.1"},
+			want: map[string][]string{"output": {"daddr=192.0.2.1"}},
+		},
+		{
+			name: "dnat origdest",
+			rule: config.Rule{Action: config.RuleDNAT, Source: "net", Dest: "svr:192.0.2.17", Proto: "tcp", DPort: config.PortSpec{"80"}, OrigDest: "203.0.113.5"},
+			want: map[string][]string{"prerouting": {"iif=eth0 daddr=203.0.113.5"}},
+		},
+		{
+			name: "dnat origdest list",
+			rule: config.Rule{Action: config.RuleDNAT, Source: "net", Dest: "svr:192.0.2.17", Proto: "tcp", DPort: config.PortSpec{"80"}, OrigDest: "203.0.113.5,203.0.113.6"},
+			want: map[string][]string{"prerouting": {"iif=eth0 daddr=203.0.113.5", "iif=eth0 daddr=203.0.113.6"}},
+		},
+		{
+			name: "dnat negated origdest list",
+			rule: config.Rule{Action: config.RuleDNAT, Source: "net", Dest: "svr:192.0.2.17", Proto: "tcp", DPort: config.PortSpec{"80"}, OrigDest: "!203.0.113.5,203.0.113.6"},
+			want: map[string][]string{"prerouting": {"iif=eth0 !daddr=203.0.113.5 !daddr=203.0.113.6"}},
+		},
+		{
+			name: "accept origdest",
+			rule: config.Rule{Action: config.RuleAccept, Source: "net", Dest: "fw", Proto: "tcp", DPort: config.PortSpec{"22"}, OrigDest: "203.0.113.5"},
+			want: map[string][]string{"input": {"iif=eth0 daddr=203.0.113.5"}},
+		},
+		{
+			name: "origdest does not scope interface-less zone",
+			rule: config.Rule{Action: config.RuleAccept, Source: "vpn", Dest: "fw", Proto: "tcp", DPort: config.PortSpec{"22"}, OrigDest: "203.0.113.5"},
+			want: map[string][]string{},
+		},
+		{
+			name: "accept ipv6 origdest",
+			rule: config.Rule{Action: config.RuleAccept, Source: "net", Dest: "fw", Proto: "tcp", DPort: config.PortSpec{"22"}, OrigDest: "2001:db8::5"},
+			want: map[string][]string{"input": {"iif=eth0 daddr=2001:db8::5"}},
 		},
 		{
 			name:   "blrule zone list",
@@ -2052,7 +2187,7 @@ func TestCompile_ListExpansionCounts(t *testing.T) {
 		}, "postrouting", "snat:0", 4},
 		{"conntrack dport list", func(c *config.Config) {
 			c.Conntrack = []config.ConntrackRule{{Action: config.ConntrackNoTrack, Proto: "udp", DPort: config.PortSpec{"53", "123"}}}
-		}, "prerouting", "conntrack:0:prerouting", 2},
+		}, "raw_prerouting", "conntrack:0:raw_prerouting", 2},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -2228,7 +2363,7 @@ func TestCompile_ColonRanges(t *testing.T) {
 		}, "postrouting", "snat:0", 2},
 		{"conntrack dport", func(c *config.Config) {
 			c.Conntrack = []config.ConntrackRule{{Action: config.ConntrackNoTrack, Proto: "udp", DPort: config.PortSpec{"1024:2048"}}}
-		}, "prerouting", "conntrack:0:prerouting", 2},
+		}, "raw_prerouting", "conntrack:0:raw_prerouting", 2},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -2255,3 +2390,270 @@ func TestCompile_ColonRanges(t *testing.T) {
 		})
 	}
 }
+
+func TestMatchOrigDest_FamilyGuard(t *testing.T) {
+	for addr, want := range map[string]byte{
+		"203.0.113.5":               unix.NFPROTO_IPV4,
+		"!203.0.113.0/24,192.0.2.1": unix.NFPROTO_IPV4,
+		"2001:db8::5":               unix.NFPROTO_IPV6,
+	} {
+		e, err := matchOrigDest(addr)
+		if err != nil {
+			t.Fatalf("%s: %v", addr, err)
+		}
+		if m, ok := e[0].(*expr.Meta); !ok || m.Key != expr.MetaKeyNFPROTO || e[1].(*expr.Cmp).Data[0] != want {
+			t.Errorf("%s: missing nfproto %d guard: %v", addr, want, e[:2])
+		}
+	}
+	if _, err := matchOrigDest("!203.0.113.5,2001:db8::5"); err == nil {
+		t.Error("mixed IPv4/IPv6 origdest: want error")
+	}
+}
+
+func TestCompile_OrigDestForwardRejected(t *testing.T) {
+	cfg := &config.Config{
+		Settings:   config.Settings{TableName: "test", AddressFamily: config.FamilyINET},
+		Zones:      map[string]config.Zone{"fw": {Type: config.ZoneFirewall}, "net": {Type: config.ZoneIP}, "svr": {Type: config.ZoneIP}},
+		Interfaces: []config.Interface{{Zone: "net", Interface: "eth0"}, {Zone: "svr", Interface: "eth2"}},
+		Rules:      []config.Rule{{Action: config.RuleAccept, Source: "net", Dest: "svr", Proto: "tcp", DPort: config.PortSpec{"80"}, OrigDest: "203.0.113.5"}},
+		PortGroups: make(map[string]config.PortGroup),
+	}
+	_, err := NewCompiler(cfg).Compile()
+	if err == nil || !strings.Contains(err.Error(), "not supported yet") {
+		t.Fatalf("Compile() error = %v, want forwarded ORIGDEST rejection", err)
+	}
+}
+
+func TestCompile_ConntrackZones(t *testing.T) {
+	tests := []struct {
+		name    string
+		ct      config.ConntrackRule
+		want    map[string][]string
+		wantErr string
+	}{
+		{
+			name: "source zone matches iif",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Proto: "udp", DPort: config.PortSpec{"53"}},
+			want: map[string][]string{"raw_prerouting": {"iif=eth0"}},
+		},
+		{
+			name: "source and dest addresses",
+			ct:   config.ConntrackRule{Action: config.ConntrackDrop, Source: "net:192.0.2.1,198.51.100.1", Dest: "fw:203.0.113.1"},
+			want: map[string][]string{"raw_prerouting": {"iif=eth0 saddr=192.0.2.1 daddr=203.0.113.1", "iif=eth0 saddr=198.51.100.1 daddr=203.0.113.1"}},
+		},
+		{
+			name: "fw source goes to raw_output with dest oif",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "fw", Dest: "net,lan"},
+			want: map[string][]string{"raw_output": {"oif=eth0", "oif=eth1"}},
+		},
+		{
+			name: "all matches no interface",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all", Dest: "fw:192.0.2.53"},
+			want: map[string][]string{"raw_prerouting": {"daddr=192.0.2.53"}},
+		},
+		{
+			name: "interface-less zone fails closed",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "dmz"},
+			want: map[string][]string{},
+		},
+		{
+			name: "chain output with fw source matches dest oif",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "fw", Dest: "net", Chain: config.ConntrackOutput},
+			want: map[string][]string{"raw_output": {"oif=eth0"}},
+		},
+		{
+			name:    "chain output with non-fw source is rejected",
+			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Dest: "fw", Chain: config.ConntrackOutput},
+			wantErr: "chain output needs SOURCE fw",
+		},
+		{
+			name:    "chain prerouting with fw source is rejected",
+			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "fw", Dest: "net", Chain: config.ConntrackPrerouting},
+			wantErr: "SOURCE fw cannot use chain prerouting",
+		},
+		{
+			name: "omitted source and dest is global in both chains",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
+			want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
+		},
+		{
+			name: "all source with chain both is global in both chains",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
+			want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
+		},
+		{
+			name: "all source with chain output is global in raw_output",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackOutput},
+			want: map[string][]string{"raw_output": {""}},
+		},
+		{
+			name: "any source with chain both is global in both chains",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "any", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
+			want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
+		},
+		{
+			name: "any source with chain output is global in raw_output",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "any", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackOutput},
+			want: map[string][]string{"raw_output": {""}},
+		},
+		{
+			name: "chain both with non-fw source emits prerouting only",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
+			want: map[string][]string{"raw_prerouting": {"iif=eth0"}},
+		},
+		{
+			name: "chain both with fw source emits output only",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "fw", Dest: "lan", Chain: config.ConntrackBoth},
+			want: map[string][]string{"raw_output": {"oif=eth1"}},
+		},
+		{
+			name: "negated addresses stay one AND-ed match",
+			ct:   config.ConntrackRule{Action: config.ConntrackDrop, Source: "net:!192.0.2.1,198.51.100.1"},
+			want: map[string][]string{"raw_prerouting": {"iif=eth0 !saddr=192.0.2.1 !saddr=198.51.100.1"}},
+		},
+		{
+			name: "sport",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Proto: "udp", SPort: config.PortSpec{"123"}},
+			want: map[string][]string{"raw_prerouting": {"iif=eth0 sport=123"}},
+		},
+		{
+			name:    "dest zone without address is rejected in prerouting",
+			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Dest: "lan"},
+			wantErr: `conntrack DEST zone "lan" needs an address in prerouting`,
+		},
+		{
+			name:    "fw dest zone without address is rejected in prerouting",
+			ct:      config.ConntrackRule{Action: config.ConntrackDrop, Source: "net", Dest: "fw"},
+			wantErr: `conntrack DEST zone "fw" needs an address in prerouting`,
+		},
+		{
+			name: "fw dest zone with address matches daddr",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Dest: "fw:192.0.2.1"},
+			want: map[string][]string{"raw_prerouting": {"iif=eth0 daddr=192.0.2.1"}},
+		},
+		{
+			name: "unknown zone fails closed",
+			ct:   config.ConntrackRule{Action: config.ConntrackDrop, Source: "nte"},
+			want: map[string][]string{},
+		},
+		{
+			name: "unknown dest zone fails closed in prerouting",
+			ct:   config.ConntrackRule{Action: config.ConntrackDrop, Source: "net", Dest: "typo"},
+			want: map[string][]string{},
+		},
+		{
+			name: "none dest zone yields no rule",
+			ct:   config.ConntrackRule{Action: config.ConntrackDrop, Source: "net", Dest: "none"},
+			want: map[string][]string{},
+		},
+		{
+			name:    "all!net rejected",
+			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all!net"},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "all!net rejected",
+			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Dest: "all!net"},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "all+ rejected",
+			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all+"},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "all+!net rejected",
+			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Dest: "all+!net"},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "any!net rejected",
+			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "any!net"},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "any+ rejected",
+			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Dest: "any+"},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name: "omitted source and dest is global",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Proto: "udp", DPort: config.PortSpec{"53"}},
+			want: map[string][]string{"raw_prerouting": {""}},
+		},
+		{
+			name: "dest zone with address matches daddr",
+			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Dest: "lan:203.0.113.10"},
+			want: map[string][]string{"raw_prerouting": {"iif=eth0 daddr=203.0.113.10"}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := listCfg(func(cfg *config.Config) {
+				cfg.Zones["lan"] = config.Zone{Type: config.ZoneIP}
+				cfg.Zones["dmz"] = config.Zone{Type: config.ZoneIP}
+				cfg.Interfaces = append(cfg.Interfaces, config.Interface{Zone: "lan", Interface: "eth1"})
+				cfg.Conntrack = []config.ConntrackRule{tt.ct}
+			})
+			if tt.wantErr != "" {
+				if _, err := NewCompiler(cfg).Compile(); err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+					t.Fatalf("Compile() error = %v, want %q", err, tt.wantErr)
+				}
+				return
+			}
+			state := mustCompile(t, cfg)
+			got := map[string][]string{}
+			for _, chain := range []string{"raw_prerouting", "raw_output"} {
+				for _, r := range taggedRules(state, chain, "conntrack:0:"+chain) {
+					got[chain] = append(got[chain], describeRule(r))
+				}
+			}
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("rules = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCompile_RuleZoneExclusionExpands(t *testing.T) {
+	cfg := listCfg(func(cfg *config.Config) {
+		cfg.Zones["lan"] = config.Zone{Type: config.ZoneIP}
+		cfg.Interfaces = append(cfg.Interfaces, config.Interface{Zone: "lan", Interface: "eth1"})
+		cfg.Rules = []config.Rule{
+			{Source: "all!net", Dest: "fw", Action: config.RuleAccept, Proto: "tcp", DPort: config.PortSpec{"22"}},
+			{Source: "nte", Dest: "fw", Action: config.RuleAccept},
+		}
+	})
+	state := mustCompile(t, cfg)
+	var got []string
+	for _, r := range taggedRules(state, "input", "rule:0") {
+		got = append(got, describeRule(r))
+	}
+	if want := []string{"iif=eth1"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("all!net -> fw input rules = %v, want %v", got, want)
+	}
+	if r := taggedRules(state, "input", "rule:1"); len(r) != 0 {
+		t.Errorf("unknown zone compiled %d rules, want 0", len(r))
+	}
+}
+
+func TestCompile_RuleZoneExclusionIntraZoneSymmetric(t *testing.T) {
+	cfg := listCfg(func(cfg *config.Config) {
+		cfg.Zones["lan"] = config.Zone{Type: config.ZoneIP}
+		cfg.Interfaces = append(cfg.Interfaces, config.Interface{Zone: "lan", Interface: "eth1"})
+		cfg.Rules = []config.Rule{
+			{Source: "lan", Dest: "all+!net", Action: config.RuleAccept},
+			{Source: "lan", Dest: "all!net", Action: config.RuleAccept},
+		}
+	})
+	state := mustCompile(t, cfg)
+	for i, want := range []bool{true, false} {
+		got := false
+		for _, r := range taggedRules(state, "forward", fmt.Sprintf("rule:%d", i)) {
+			got = got || describeRule(r) == "iif=eth1 oif=eth1"
+		}
+		if got != want {
+			t.Errorf("rule:%d lan->lan forward = %v, want %v", i, got, want)
+		}
+	}
+}

internal/nftables/engine.go

@@ -69,6 +69,22 @@ func (e *Engine) ensureChains(table *nftables.Table, policies map[string]nftable
 			Hooknum:  nftables.ChainHookPrerouting,
 			Priority: nftables.ChainPriorityNATDest,
 		},
+		"raw_prerouting": {
+			Name:     "raw_prerouting",
+			Table:    table,
+			Type:     nftables.ChainTypeFilter,
+			Hooknum:  nftables.ChainHookPrerouting,
+			Priority: nftables.ChainPriorityRaw,
+			Policy:   policyPtr(nftables.ChainPolicyAccept),
+		},
+		"raw_output": {
+			Name:     "raw_output",
+			Table:    table,
+			Type:     nftables.ChainTypeFilter,
+			Hooknum:  nftables.ChainHookOutput,
+			Priority: nftables.ChainPriorityRaw,
+			Policy:   policyPtr(nftables.ChainPolicyAccept),
+		},
 	}
 
 	for name, chain := range chains {

internal/nftables/snapshot_test.go

@@ -243,3 +243,17 @@ func testEngine(t *testing.T, dial func([]netlink.Message) ([]netlink.Message, e
 	}
 	return &Engine{cfg: &config.Config{Settings: config.Settings{TableName: "tomswall"}}, conn: conn}
 }
+
+func TestEnsureChainsRawPriority(t *testing.T) {
+	e := testEngine(t, nil)
+	chains := e.ensureChains(e.ensureTable(), nil)
+	for name, hook := range map[string]*nftables.ChainHook{"raw_prerouting": nftables.ChainHookPrerouting, "raw_output": nftables.ChainHookOutput} {
+		c, ok := chains[name]
+		if !ok {
+			t.Fatalf("%s chain not declared", name)
+		}
+		if *c.Priority != *nftables.ChainPriorityRaw || *c.Hooknum != *hook || c.Type != nftables.ChainTypeFilter || *c.Policy != nftables.ChainPolicyAccept {
+			t.Errorf("%s: got type %s hook %d prio %d", name, c.Type, *c.Hooknum, *c.Priority)
+		}
+	}
+}

tomswall.example.yaml

@@ -191,7 +191,7 @@ snat:
 # conntrack:
 #   - action: notrack
 #     source: net
-#     dest: fw
+#     dest: fw:203.0.113.1
 #     proto: udp
 #     dport: [53]
 #     comment: "Skip conntrack for DNS"