@push.rocks/smartnftables 2.2.0 → 2.4.0

package/changelog.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 2026-09-16 - 2.4.0
+
+### Features
+
+- Add optional managed published workload ports to the schema-v2 `routerEgress` scope: the second hop of a published host port compiles its own handoff destination NAT, the handoff ingress classification ahead of the raw capture barrier, and the exact forward and reply admissions, all applied, replaced and released with the generation. Absent and empty publications keep the previous canonical policy, digest and compiled bytes.
+  - Classify both directions of a publication into the default conntrack zone: the workload side is matched on its exact link, published address and published endpoint port ahead of every leased classifier, so a client whose source port equals a leased grant's destination port can use the publication instead of having the workload's reply zoned into that generation and dropped or source-translated. A published `endpointPort` is therefore dedicated to its publication and new outbound flows from that exact address and port are not leased egress.
+
+## 2026-09-16 - 2.3.0
+
+### Features
+
+- Add optional managed published host ports to the schema-v2 `hostTransit` scope: inbound uplink destination NAT plus its exact forward and reply admissions are compiled, applied, replaced and released with the generation. Absent and empty publications keep the previous canonical policy, digest and compiled bytes.
+
 ## 2026-09-15 - 2.2.0
 
 ### Features

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "d997150e9cde38e1ba2c93c5b894c367f9b562a31291ee568ccd1e4a54034b61",
+  "binarySha256": "5fb7ac747d32155fe8577b86107a82405fa7afeb1cf73552e903aa06760660d8",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.2.0",
-    "gitCommit": "32e9f40066053a15f32031e796e3151140e98eca",
+    "projectVersion": "2.4.0",
+    "gitCommit": "8db07b6df0c1c2f6490dd6c7333051afe3a14a2a",
     "gitDirty": false,
-    "builtAt": "2026-09-15T06:33:44.972Z",
+    "builtAt": "2026-09-16T11:32:31.722Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "14a625bdb893667872dad6b339aa77f64c6d7e538158bff3e4b92e5684d70e61",
+  "binarySha256": "33940d9812e48ac705862a3c30c57d652877f1b9abeb9601fd6f20a4fbcdc72d",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.2.0",
-    "gitCommit": "32e9f40066053a15f32031e796e3151140e98eca",
+    "projectVersion": "2.4.0",
+    "gitCommit": "8db07b6df0c1c2f6490dd6c7333051afe3a14a2a",
     "gitDirty": false,
-    "builtAt": "2026-09-15T06:33:49.548Z",
+    "builtAt": "2026-09-16T11:32:31.854Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '2.2.0',
+    version: '2.4.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/managed.egress.types.d.ts

@@ -60,6 +60,22 @@ export interface IManagedNftEgressGenerationV2 extends IManagedNftHandoffAllocat
     conntrackLabel: string;
     grants: IManagedNftEgressGrantV2[];
 }
+/** One inbound handoff publication, compiled inside the same router generation.
+ * It is the second hop of a published host port: the host translates to
+ * `transitSourceAddress:transitPort`, this translates on to the workload. */
+export interface IManagedNftRouterPublishedPortV2 {
+    protocol: 'tcp' | 'udp';
+    /** Published handoff port, 1–65535 and unique per protocol across the scope.
+     * It is the `targetPort` of the matching host-transit publication. */
+    transitPort: number;
+    endpointPort: number;
+    /** Exact current workload endpoint address behind one veth endpoint of this
+     * scope. Never a router-local address, a gateway or a platform endpoint. */
+    endpointAddress: string;
+    /** Exact leased transit source address of one current generation, present on
+     * `handoff`. No wildcard, secondary-address or route inference. */
+    transitSourceAddress: string;
+}
 /** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
 export interface IManagedNftRouterEgressScopeV2 {
     kind: 'routerEgress';
@@ -71,6 +87,23 @@ export interface IManagedNftRouterEgressScopeV2 {
     protection: IManagedNftProtectionV2;
     /** Empty retains private/local enforcement while denying external egress. */
     generations: IManagedNftEgressGenerationV2[];
+    /** Optional inbound destination NAT toward a workload endpoint. Absent and empty
+     * are the same canonical policy and keep the compiled graph unchanged. Every entry
+     * compiles its own handoff DNAT, the handoff ingress classification and the exact
+     * forward and reply admission in this generation, so a failed apply, a target
+     * without it, or release removes it with the generation. */
+    publishedPorts?: IManagedNftRouterPublishedPortV2[];
+}
+/** One inbound uplink publication, compiled inside the same host-transit generation. */
+export interface IManagedNftPublishedPortV2 {
+    protocol: 'tcp' | 'udp';
+    /** Published uplink port, 1–65535 and unique per protocol across the scope. */
+    hostPort: number;
+    targetPort: number;
+    /** Exact leased transit source address of one current allocation; it selects the handoff. */
+    targetAddress: string;
+    /** Exact current uplink address that publishes this port. No wildcard or route inference. */
+    hostIp: string;
 }
 /** Shared-host capture barrier and explicit outer SNAT; Docker forwarding remains a separate owner. */
 export interface IManagedNftHostTransitScopeV2 {
@@ -83,6 +116,11 @@ export interface IManagedNftHostTransitScopeV2 {
     uplink: IManagedNftLocalLinkV2;
     /** Exact current address present on uplink. No masquerade or default-route inference. */
     snatAddress: string;
+    /** Optional inbound destination NAT. Absent and empty are the same canonical policy and
+     * keep the compiled graph unchanged. Every entry compiles its own uplink DNAT plus the
+     * exact forward and reply admission in this generation, so a failed apply, a target
+     * without it, or release removes it with the generation. */
+    publishedPorts?: IManagedNftPublishedPortV2[];
 }
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
  * This has no link dependency or allow grants. It is not allocation-release or boot-order proof. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",
@@ -9,11 +9,11 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "devDependencies": {
-    "@git.zone/cli": "6.13.2",
+    "@git.zone/cli": "6.14.0",
     "@git.zone/tsbuild": "^4.4.3",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tsrust": "1.13.0",
-    "@git.zone/tstest": "6.0.0",
+    "@git.zone/tstest": "6.1.1",
     "@types/node": "26.5.0",
     "typescript": "^7.0.2"
   },

package/readme.md

@@ -264,8 +264,8 @@ allocation-pool guard policy kinds.
 
 | V2 scope | Required authority and behavior |
 | --- | --- |
-| `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. |
-| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. |
+| `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. Optional `publishedPorts` add the inbound second hop from the handoff to a workload endpoint; both directions are classified into the default conntrack zone ahead of every leased classifier, so a published endpoint port is dedicated to its publication and never becomes leased egress. |
+| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation. |
 | `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. |
 
 `allocationPoolGuard` accepts 1–64 canonical, disjoint RFC1918 prefixes. Supply
@@ -313,6 +313,42 @@ so foreign DNAT cannot turn a protected destination into a public exception or
 redirect public traffic into protected space. INPUT diversion, local OUTPUT into
 handoffs, unmatched handoff traffic and IPv6 forwarding are denied.
 
+#### Published host ports
+
+`hostTransit.publishedPorts` is optional. Absent and empty are the same canonical
+policy, so an unpublished scope keeps its exact previous digest and compiled bytes.
+Each entry is `{ protocol, hostPort, targetPort, targetAddress, hostIp }`. `hostIp`
+must be an exact current uplink address, which rtnetlink verifies at apply, recovery
+and inspection; there is no wildcard, secondary-link or default-route inference.
+`targetAddress` must be a current leased `transitSourceAddress` of one allocation,
+and that binding is what selects the handoff link of the admission; an address that
+no active lease holds, a local host address or a bare workload prefix rejects. Ports
+are 1–65535, one `protocol`/`hostPort` is published exactly once across the scope
+including across uplink addresses, and a port published on the `snatAddress` may not
+fall inside any leased outbound source-port range of the same protocol, because outer
+SNAT translates to that same address.
+
+A publication compiles inside the generation: one destination NAT rule in this
+table's own prerouting `nat` chain at priority -100, plus three forward admissions
+placed ahead of the capture barrier — original direction NEW and ESTABLISHED, with
+opening TCP restricted to SYN with FIN/RST/ACK clear, and the ESTABLISHED reply.
+Every admission checks both links, the conntrack protocol, the default zone, the
+direction, the translated current address/port and the original conntrack
+destination, so foreign NAT cannot borrow the exception for another flow. Published
+traffic is not source-translated, so the workload observes the actual client address.
+The chain, its translation and its admissions are created, replaced and deleted with
+the generation: a target without the entry, a failed batch, or release removes them,
+and a caller never needs a separate teardown.
+
+Input bounds are 64 entries, but the atomic graph reserve binds first. A publication
+costs four operations and about 6,000 bytes, so roughly a dozen fit beside a small
+host-transit graph and `prepare()` rejects an excessive set before any kernel work.
+The caller still owns the route to `targetAddress` through that handoff, the
+workload listener, and every other packet owner on the host. As with leased egress,
+an ACCEPT here cannot override Docker's independent FORWARD DROP; the
+`ManagedDockerForwarding` contribution below derives only leased handoff egress from
+the barrier and currently carries no inbound publication.
+
 Each router generation binds an immutable lease reference, transit source address,
 leased TCP/UDP source-port ranges, a nonzero conntrack zone and a 16-byte label.
 Each directed grant selects one exact leased protocol range for SNAT. A grant's
@@ -325,6 +361,57 @@ Opening TCP requires SYN with FIN/RST/ACK clear and permits ECN negotiation.
 Replies must match the labelled original flow and current directed grant.
 There is no broad ESTABLISHED/RELATED bypass.
 
+#### Published workload ports
+
+`routerEgress.publishedPorts` is optional and is the second hop of a published
+host port. Absent and empty are the same canonical policy, so an unpublished scope
+keeps its exact previous digest and compiled bytes. Each entry is `{ protocol,
+transitPort, endpointPort, endpointAddress, transitSourceAddress }`.
+`transitSourceAddress` must be a current leased generation address that is present
+on `handoff`, which rtnetlink verifies at apply, recovery and inspection; the
+handoff can carry several current leased addresses, so the arrival address is
+always explicit and never inferred. `transitPort` is the `targetPort` of the
+matching `hostTransit` publication. `endpointAddress` must be an address of one
+current veth workload endpoint of this scope: a router-local link or gateway
+address, the transit address, a TUN endpoint's private space, a platform endpoint,
+loopback and IPv6 all reject. Ports are 1–65535, one `protocol`/`transitPort` is
+published exactly once across the scope, and a published port may not fall inside
+any leased outbound source-port range of the same protocol on that transit address,
+because source NAT translates to that same address.
+
+A publication compiles inside the generation: one destination NAT rule in this
+table's own prerouting `nat` chain at priority -100, two raw classifications, and
+three forward admissions placed ahead of the capture barrier — original direction
+NEW and ESTABLISHED, with opening TCP restricted to SYN with FIN/RST/ACK clear,
+and the ESTABLISHED reply. The handoff ingress classification precedes the
+barrier's protected-source denial, because the uplink or management network that
+reaches a published port is itself protected space. The endpoint ingress
+classification matches the exact workload link, address and published endpoint
+port, and precedes every leased classifier of every generation: raw runs before
+conntrack, so a client whose source port equals a leased grant's destination port
+would otherwise carry the workload's published packets into that generation, where
+the publication's flow does not exist. Both classifications match the arriving
+tuple only, set no generation zone and leave the flow in the default conntrack
+zone. The private anti-spoof guards still run first, and every admission checks
+both links, the conntrack protocol, the default zone, the direction, the
+translated current address/port and the original conntrack destination.
+
+A published `endpointPort` is therefore dedicated to its publication: a new
+outbound flow that the workload opens from that exact address and port on that
+exact link stays in the default zone too and is not translated by the leased
+outbound source NAT. Published traffic is not source-translated on either hop, so
+the workload observes the actual client address. The chain, its translation, its
+classifications and its admissions are created, replaced and deleted with the
+generation: a target without the entry, a failed batch, or release removes them.
+
+Input bounds are 64 entries, but the atomic graph reserve binds first. A router
+publication costs six operations and about 7,600 bytes, so a combined
+two-endpoint router policy leaves room for roughly five, and `prepare()` rejects an
+excessive set before any kernel work. The caller still owns both hops: the exact
+matching `hostTransit` publication, the route to the workload through this router,
+the workload listener and every other packet owner. A publication grants no egress;
+outbound flows still need their leased grants.
+
 Active overlapping classifiers, duplicate zones/labels and conflicting handoff
 allocations reject. Empty router generations retain private routing while denying
 egress. Input bounds include 32 private endpoints, 128 private rules, 32 active
@@ -442,6 +529,21 @@ local TCP, TUN isolation, observed UDP/TCP handoff ranges, range exhaustion,
 fragment reassembly, ECN SYN and invalid opening flags, protected current/original
 DNAT barriers, nonzero foreign zones, local diversion, IPv6 denial, revocation
 and restoration with disjoint generation ranges while old flows remain retained.
+Published host ports are qualified end to end: translated TCP and UDP delivery to the
+leased transit address with the actual client address preserved, reverse translation
+back to the published address, SYN-only opening, denial of non-SYN openings, denial of
+unpublished workload and uplink ports against a pre-policy positive control, and the
+port going dark with the withdrawn and released generation. Published workload ports
+are qualified across both hops in the same four-namespace topology: TCP and UDP reach
+a listener inside the workload namespace with the client address preserved and both
+translations reversed, only an exact SYN opens the publication against a positive
+control on the same injector, an unpublished transit port and the unpublished
+workload path stay behind the router barrier, and withdrawing only the router
+publication or releasing it takes the port dark while the host publication remains.
+A client whose source port equals a leased grant's destination port on that grant's
+public address completes the published TCP handshake and receives its UDP reply
+from the published address, so the leased classifiers of the same generation cannot
+capture the workload's published packets.
 The arm64 binary is cross-built; native packet qualification is currently x86_64.
 Kernel 6.8 is unsupported. No production activation is implied by these tests.
 

package/rust/src/egress.compile.rs

@@ -248,6 +248,26 @@ fn snat(address: &str, range: Option<(u16, u16)>) -> Result<Vec<Attr>> {
     result.push(expr("nat", data));
     Ok(result)
 }
+/// Published inbound translation. Address and port are always both specified, so
+/// the kernel never picks a port and the graph identity carries explicit registers.
+fn dnat(address: &str, port: u16) -> Result<Vec<Attr>> {
+    Ok(vec![
+        immediate(1, super::address(address)?.to_be_bytes().to_vec()),
+        immediate(2, port.to_be_bytes().to_vec()),
+        expr(
+            "nat",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, 2),
+                Attr::u32(3, 1),
+                Attr::u32(4, 1),
+                Attr::u32(5, 2),
+                Attr::u32(6, 2),
+                Attr::u32(7, 3),
+            ],
+        ),
+    ])
+}
 fn tuple(grant: &Grant, protection: &Protection, reply: bool, original: bool) -> Result<Vec<Attr>> {
     let destination = super::destination(grant, protection)?;
     let mut result = ipv4();

package/rust/src/egress.host.rs

@@ -51,6 +51,69 @@ fn envelope(
     expressions.extend(original_range(range.first, range.last));
     Ok(expressions)
 }
+/// Inbound publication envelope. Both directions check the exact links, the
+/// translated current tuple and the original conntrack destination, so foreign
+/// NAT cannot borrow this admission for another flow.
+fn published_envelope(
+    scope: &HostScope,
+    handoff: &HostHandoff,
+    port: &PublishedPort,
+    reply: bool,
+) -> Result<Vec<Attr>> {
+    let mut expressions = ipv4();
+    expressions.extend(link(&scope.uplink, !reply));
+    expressions.extend(link(&handoff.link, reply));
+    expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+    expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
+    expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+    expressions.extend(ct(1, None, vec![u8::from(reply)]));
+    let target = format!("{}/32", port.target_address);
+    expressions.extend(current_address(&target, reply)?);
+    expressions.extend(current_port(port.target_port, reply));
+    let published = format!("{}/32", port.host_ip);
+    expressions.extend(original_address(&published, false)?);
+    expressions.extend(original_port(port.host_port, false));
+    Ok(expressions)
+}
+fn published(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
+    for port in &scope.published_ports {
+        // Validation admits only leased transit source addresses, and one address
+        // never spans two active handoff links.
+        let handoff = scope
+            .handoffs
+            .iter()
+            .find(|handoff| {
+                handoff
+                    .allocations
+                    .iter()
+                    .any(|allocation| allocation.transit_source_address == port.target_address)
+            })
+            .ok_or(crate::Error::Invalid)?;
+        let original = published_envelope(scope, handoff, port, false)?;
+        for connection_state in [2, 8] {
+            let mut expressions = original.clone();
+            expressions.extend(state(connection_state));
+            if connection_state == 8 && port.protocol == "tcp" {
+                expressions.extend(opening_tcp());
+            }
+            program.end("forward", expressions, 1)?;
+        }
+        let mut reply = published_envelope(scope, handoff, port, true)?;
+        reply.extend(state(2));
+        program.end("forward", reply, 1)?;
+        let mut translation = ipv4();
+        translation.extend(link(&scope.uplink, true));
+        translation.extend(meta(16, vec![protocol(&port.protocol)]));
+        translation.extend(ct(10, None, vec![protocol(&port.protocol)]));
+        translation.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+        translation.extend(ct(1, None, vec![0]));
+        translation.extend(current_address(&format!("{}/32", port.host_ip), false)?);
+        translation.extend(current_port(port.host_port, false));
+        translation.extend(dnat(&port.target_address, port.target_port)?);
+        program.rule("pre", translation)?;
+    }
+    Ok(())
+}
 pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
     // Filtering runs after destination NAT. Docker has independent filter hooks.
     // This table cannot override another owner's DROP; Docker contribution and
@@ -63,11 +126,21 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
     ] {
         program.chain(name, Some((hook, priority, kind)))?;
     }
+    if !scope.published_ports.is_empty() {
+        // Published destination NAT lives in this table's own prerouting chain, so
+        // it is created, replaced and deleted with the exact generation. An empty
+        // publication list keeps the previous chain set and compiled bytes.
+        program.chain("pre", Some((0, -100, "nat")))?;
+    }
     for name in ["protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
     protection(program, scope, false)?;
     protection(program, scope, true)?;
+    // Published admission precedes the capture barrier: the barrier denies every
+    // protected original destination, which includes this uplink address, and an
+    // exact inbound publication is the explicit authority for that exception.
+    published(program, scope)?;
     for handoff in &scope.handoffs {
         program.jump("forward", link(&handoff.link, true), "protected_out")?;
         program.jump("forward", link(&handoff.link, false), "protected_back")?;

package/rust/src/egress.router.rs

@@ -47,6 +47,125 @@ fn raw_return(scope: &RouterScope, grant: &Grant, generation: &Generation) -> Re
     ));
     Ok(result)
 }
+/// The exact veth link of the workload endpoint that holds a published address.
+/// Validation admits only a current endpoint address, and endpoint prefixes are
+/// pairwise disjoint, so one publication never spans two endpoint links.
+fn published_link<'a>(scope: &'a RouterScope, port: &RouterPublishedPort) -> Result<&'a LocalLink> {
+    let target = format!("{}/32", port.endpoint_address);
+    let endpoint = scope
+        .endpoints
+        .iter()
+        .find(|endpoint| {
+            endpoint
+                .source_prefixes
+                .iter()
+                .any(|source| super::super::covers(source, &target) == Ok(true))
+        })
+        .ok_or(crate::Error::Invalid)?;
+    scope
+        .links
+        .iter()
+        .find(|link| link.interface_index == endpoint.interface_index)
+        .ok_or(crate::Error::Invalid)
+}
+/// Inbound publication envelope. Both directions check the exact links, the
+/// translated current tuple and the original conntrack destination, so foreign
+/// NAT cannot borrow this admission for another flow.
+fn published_envelope(
+    scope: &RouterScope,
+    endpoint: &LocalLink,
+    port: &RouterPublishedPort,
+    reply: bool,
+) -> Result<Vec<Attr>> {
+    let mut expressions = ipv4();
+    expressions.extend(link(&scope.handoff, !reply));
+    expressions.extend(link(endpoint, reply));
+    expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+    expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
+    expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+    expressions.extend(ct(1, None, vec![u8::from(reply)]));
+    let target = format!("{}/32", port.endpoint_address);
+    expressions.extend(current_address(&target, reply)?);
+    expressions.extend(current_port(port.endpoint_port, reply));
+    let published = format!("{}/32", port.transit_source_address);
+    expressions.extend(original_address(&published, false)?);
+    expressions.extend(original_port(port.transit_port, false));
+    Ok(expressions)
+}
+/// Handoff ingress classification for an exact current publication. Raw runs
+/// before conntrack, so it matches the arriving tuple only and never sets a
+/// generation zone: a publication is an ordinary default-zone flow.
+fn published_return(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let mut expressions = ipv4();
+        expressions.extend(link(&scope.handoff, true));
+        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+        expressions.extend(current_address(
+            &format!("{}/32", port.transit_source_address),
+            false,
+        )?);
+        expressions.extend(current_port(port.transit_port, false));
+        program.end("raw_return", expressions, 1)?;
+    }
+    Ok(())
+}
+/// Endpoint ingress classification for an exact current publication. The workload
+/// side of a publication is an ordinary default-zone flow too, so it is matched on
+/// its exact link, address and dedicated published port before the leased
+/// classifiers below can zone it: a client whose source port equals a leased
+/// grant's destination port would otherwise move the workload's published packets
+/// into that generation, where they are not its flow. This only classifies; both
+/// the anti-spoof guards and the publication's admissions still decide admission.
+fn published_endpoint(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let mut expressions = ipv4();
+        expressions.extend(link(published_link(scope, port)?, true));
+        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+        expressions.extend(current_address(
+            &format!("{}/32", port.endpoint_address),
+            true,
+        )?);
+        expressions.extend(current_port(port.endpoint_port, true));
+        program.end("raw_in", expressions, 1)?;
+    }
+    Ok(())
+}
+fn published_translation(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let mut expressions = ipv4();
+        expressions.extend(link(&scope.handoff, true));
+        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+        expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
+        expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+        expressions.extend(ct(1, None, vec![0]));
+        expressions.extend(current_address(
+            &format!("{}/32", port.transit_source_address),
+            false,
+        )?);
+        expressions.extend(current_port(port.transit_port, false));
+        expressions.extend(dnat(&port.endpoint_address, port.endpoint_port)?);
+        program.rule("pre", expressions)?;
+    }
+    Ok(())
+}
+fn published_admissions(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let endpoint = published_link(scope, port)?;
+        let original = published_envelope(scope, endpoint, port, false)?;
+        for connection_state in [2, 8] {
+            let mut expressions = original.clone();
+            expressions.extend(state(connection_state));
+            if connection_state == 8 && port.protocol == "tcp" {
+                expressions.extend(opening_tcp());
+            }
+            program.end("forward", expressions, 1)?;
+        }
+        let mut reply = published_envelope(scope, endpoint, port, true)?;
+        reply.extend(state(2));
+        program.end("forward", reply, 1)?;
+    }
+    Ok(())
+}
 fn protected(
     program: &mut Program<'_>,
     chain: &str,
@@ -67,10 +186,19 @@ fn protected(
     program.end(chain, vec![], -5)
 }
 fn raw(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
-    // Handoff ingress must classify only exact leased return envelopes. Unknown
-    // ingress never reaches private/default-zone rules, even after a rename.
+    // Handoff ingress must classify only exact leased return envelopes and exact
+    // inbound publications. Unknown ingress never reaches private/default-zone
+    // rules, even after a rename.
     program.jump("raw_in", link(&scope.handoff, true), "raw_return")?;
     program.deny_link("raw_in", &scope.handoff, true)?;
+    // A publication is the explicit authority for its exact tuple, so it is
+    // classified ahead of the protected-source denial below, exactly as a
+    // platform return envelope is. The host publishes into this address, so its
+    // clients are not confined to unprotected space.
+    published_return(program, scope)?;
+    // Both sides of a publication lead the leased classifiers of every generation,
+    // so neither direction depends on the client's choice of source port.
+    published_endpoint(program, scope)?;
     for platform in [true, false] {
         if !platform {
             for prefix in &scope.protection.prefixes {
@@ -190,6 +318,12 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
     ] {
         program.chain(name, Some((hook, priority, kind)))?;
     }
+    if !scope.published_ports.is_empty() {
+        // Published destination NAT lives in this table's own prerouting chain, so
+        // it is created, replaced and deleted with the exact generation. An empty
+        // publication list keeps the previous chain set and compiled bytes.
+        program.chain("pre", Some((0, -100, "nat")))?;
+    }
     for name in ["raw_return", "protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
@@ -210,9 +344,20 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
     raw(program, scope)?;
     protected(program, "protected_out", scope, false)?;
     protected(program, "protected_back", scope, true)?;
+    published_translation(program, scope)?;
     for chain in ["input", "forward", "output"] {
         let parts = private.filter_rules(chain)?;
-        for expressions in parts.guards.into_iter().chain(parts.grants) {
+        for expressions in parts.guards {
+            program.rule(chain, expressions)?;
+        }
+        // Published admission keeps the private anti-spoof guards ahead of it and
+        // precedes the capture barrier: the barrier denies every protected original
+        // destination, which includes this transit address, and an exact inbound
+        // publication is the explicit authority for that exception.
+        if chain == "forward" {
+            published_admissions(program, scope)?;
+        }
+        for expressions in parts.grants {
             program.rule(chain, expressions)?;
         }
         grants(program, scope, chain, true)?;