@push.rocks/smartnftables 2.3.0 → 2.4.0

package/changelog.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 2026-09-16 - 2.4.0
+
+### Features
+
+- Add optional managed published workload ports to the schema-v2 `routerEgress` scope: the second hop of a published host port compiles its own handoff destination NAT, the handoff ingress classification ahead of the raw capture barrier, and the exact forward and reply admissions, all applied, replaced and released with the generation. Absent and empty publications keep the previous canonical policy, digest and compiled bytes.
+  - Classify both directions of a publication into the default conntrack zone: the workload side is matched on its exact link, published address and published endpoint port ahead of every leased classifier, so a client whose source port equals a leased grant's destination port can use the publication instead of having the workload's reply zoned into that generation and dropped or source-translated. A published `endpointPort` is therefore dedicated to its publication and new outbound flows from that exact address and port are not leased egress.
+
 ## 2026-09-16 - 2.3.0
 
 ### Features

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "a05a20217727664aff94f0dfeeba5215ba8cfdfc3958f962da8384e229b11df3",
+  "binarySha256": "5fb7ac747d32155fe8577b86107a82405fa7afeb1cf73552e903aa06760660d8",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.3.0",
-    "gitCommit": "47dfc97a139c73ecbcb17b86382878153a58189f",
+    "projectVersion": "2.4.0",
+    "gitCommit": "8db07b6df0c1c2f6490dd6c7333051afe3a14a2a",
     "gitDirty": false,
-    "builtAt": "2026-09-16T07:45:32.264Z",
+    "builtAt": "2026-09-16T11:32:31.722Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "c322c2f4444cd6c980453ff7ddab76dfb39f1c0b149ff7401f4d184f491c3d01",
+  "binarySha256": "33940d9812e48ac705862a3c30c57d652877f1b9abeb9601fd6f20a4fbcdc72d",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.3.0",
-    "gitCommit": "47dfc97a139c73ecbcb17b86382878153a58189f",
+    "projectVersion": "2.4.0",
+    "gitCommit": "8db07b6df0c1c2f6490dd6c7333051afe3a14a2a",
     "gitDirty": false,
-    "builtAt": "2026-09-16T07:45:32.403Z",
+    "builtAt": "2026-09-16T11:32:31.854Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '2.3.0',
+    version: '2.4.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/managed.egress.types.d.ts

@@ -60,6 +60,22 @@ export interface IManagedNftEgressGenerationV2 extends IManagedNftHandoffAllocat
     conntrackLabel: string;
     grants: IManagedNftEgressGrantV2[];
 }
+/** One inbound handoff publication, compiled inside the same router generation.
+ * It is the second hop of a published host port: the host translates to
+ * `transitSourceAddress:transitPort`, this translates on to the workload. */
+export interface IManagedNftRouterPublishedPortV2 {
+    protocol: 'tcp' | 'udp';
+    /** Published handoff port, 1–65535 and unique per protocol across the scope.
+     * It is the `targetPort` of the matching host-transit publication. */
+    transitPort: number;
+    endpointPort: number;
+    /** Exact current workload endpoint address behind one veth endpoint of this
+     * scope. Never a router-local address, a gateway or a platform endpoint. */
+    endpointAddress: string;
+    /** Exact leased transit source address of one current generation, present on
+     * `handoff`. No wildcard, secondary-address or route inference. */
+    transitSourceAddress: string;
+}
 /** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
 export interface IManagedNftRouterEgressScopeV2 {
     kind: 'routerEgress';
@@ -71,6 +87,12 @@ export interface IManagedNftRouterEgressScopeV2 {
     protection: IManagedNftProtectionV2;
     /** Empty retains private/local enforcement while denying external egress. */
     generations: IManagedNftEgressGenerationV2[];
+    /** Optional inbound destination NAT toward a workload endpoint. Absent and empty
+     * are the same canonical policy and keep the compiled graph unchanged. Every entry
+     * compiles its own handoff DNAT, the handoff ingress classification and the exact
+     * forward and reply admission in this generation, so a failed apply, a target
+     * without it, or release removes it with the generation. */
+    publishedPorts?: IManagedNftRouterPublishedPortV2[];
 }
 /** One inbound uplink publication, compiled inside the same host-transit generation. */
 export interface IManagedNftPublishedPortV2 {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",
@@ -13,7 +13,7 @@
     "@git.zone/tsbuild": "^4.4.3",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tsrust": "1.13.0",
-    "@git.zone/tstest": "6.1.0",
+    "@git.zone/tstest": "6.1.1",
     "@types/node": "26.5.0",
     "typescript": "^7.0.2"
   },

package/readme.md

@@ -264,7 +264,7 @@ allocation-pool guard policy kinds.
 
 | V2 scope | Required authority and behavior |
 | --- | --- |
-| `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. |
+| `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. Optional `publishedPorts` add the inbound second hop from the handoff to a workload endpoint; both directions are classified into the default conntrack zone ahead of every leased classifier, so a published endpoint port is dedicated to its publication and never becomes leased egress. |
 | `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation. |
 | `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. |
 
@@ -361,6 +361,57 @@ Opening TCP requires SYN with FIN/RST/ACK clear and permits ECN negotiation.
 Replies must match the labelled original flow and current directed grant.
 There is no broad ESTABLISHED/RELATED bypass.
 
+#### Published workload ports
+
+`routerEgress.publishedPorts` is optional and is the second hop of a published
+host port. Absent and empty are the same canonical policy, so an unpublished scope
+keeps its exact previous digest and compiled bytes. Each entry is `{ protocol,
+transitPort, endpointPort, endpointAddress, transitSourceAddress }`.
+`transitSourceAddress` must be a current leased generation address that is present
+on `handoff`, which rtnetlink verifies at apply, recovery and inspection; the
+handoff can carry several current leased addresses, so the arrival address is
+always explicit and never inferred. `transitPort` is the `targetPort` of the
+matching `hostTransit` publication. `endpointAddress` must be an address of one
+current veth workload endpoint of this scope: a router-local link or gateway
+address, the transit address, a TUN endpoint's private space, a platform endpoint,
+loopback and IPv6 all reject. Ports are 1–65535, one `protocol`/`transitPort` is
+published exactly once across the scope, and a published port may not fall inside
+any leased outbound source-port range of the same protocol on that transit address,
+because source NAT translates to that same address.
+
+A publication compiles inside the generation: one destination NAT rule in this
+table's own prerouting `nat` chain at priority -100, two raw classifications, and
+three forward admissions placed ahead of the capture barrier — original direction
+NEW and ESTABLISHED, with opening TCP restricted to SYN with FIN/RST/ACK clear,
+and the ESTABLISHED reply. The handoff ingress classification precedes the
+barrier's protected-source denial, because the uplink or management network that
+reaches a published port is itself protected space. The endpoint ingress
+classification matches the exact workload link, address and published endpoint
+port, and precedes every leased classifier of every generation: raw runs before
+conntrack, so a client whose source port equals a leased grant's destination port
+would otherwise carry the workload's published packets into that generation, where
+the publication's flow does not exist. Both classifications match the arriving
+tuple only, set no generation zone and leave the flow in the default conntrack
+zone. The private anti-spoof guards still run first, and every admission checks
+both links, the conntrack protocol, the default zone, the direction, the
+translated current address/port and the original conntrack destination.
+
+A published `endpointPort` is therefore dedicated to its publication: a new
+outbound flow that the workload opens from that exact address and port on that
+exact link stays in the default zone too and is not translated by the leased
+outbound source NAT. Published traffic is not source-translated on either hop, so
+the workload observes the actual client address. The chain, its translation, its
+classifications and its admissions are created, replaced and deleted with the
+generation: a target without the entry, a failed batch, or release removes them.
+
+Input bounds are 64 entries, but the atomic graph reserve binds first. A router
+publication costs six operations and about 7,600 bytes, so a combined
+two-endpoint router policy leaves room for roughly five, and `prepare()` rejects an
+excessive set before any kernel work. The caller still owns both hops: the exact
+matching `hostTransit` publication, the route to the workload through this router,
+the workload listener and every other packet owner. A publication grants no egress;
+outbound flows still need their leased grants.
+
 Active overlapping classifiers, duplicate zones/labels and conflicting handoff
 allocations reject. Empty router generations retain private routing while denying
 egress. Input bounds include 32 private endpoints, 128 private rules, 32 active
@@ -482,7 +533,17 @@ Published host ports are qualified end to end: translated TCP and UDP delivery t
 leased transit address with the actual client address preserved, reverse translation
 back to the published address, SYN-only opening, denial of non-SYN openings, denial of
 unpublished workload and uplink ports against a pre-policy positive control, and the
-port going dark with the withdrawn and released generation.
+port going dark with the withdrawn and released generation. Published workload ports
+are qualified across both hops in the same four-namespace topology: TCP and UDP reach
+a listener inside the workload namespace with the client address preserved and both
+translations reversed, only an exact SYN opens the publication against a positive
+control on the same injector, an unpublished transit port and the unpublished
+workload path stay behind the router barrier, and withdrawing only the router
+publication or releasing it takes the port dark while the host publication remains.
+A client whose source port equals a leased grant's destination port on that grant's
+public address completes the published TCP handshake and receives its UDP reply
+from the published address, so the leased classifiers of the same generation cannot
+capture the workload's published packets.
 The arm64 binary is cross-built; native packet qualification is currently x86_64.
 Kernel 6.8 is unsupported. No production activation is implied by these tests.
 

package/rust/src/egress.router.rs

@@ -47,6 +47,125 @@ fn raw_return(scope: &RouterScope, grant: &Grant, generation: &Generation) -> Re
     ));
     Ok(result)
 }
+/// The exact veth link of the workload endpoint that holds a published address.
+/// Validation admits only a current endpoint address, and endpoint prefixes are
+/// pairwise disjoint, so one publication never spans two endpoint links.
+fn published_link<'a>(scope: &'a RouterScope, port: &RouterPublishedPort) -> Result<&'a LocalLink> {
+    let target = format!("{}/32", port.endpoint_address);
+    let endpoint = scope
+        .endpoints
+        .iter()
+        .find(|endpoint| {
+            endpoint
+                .source_prefixes
+                .iter()
+                .any(|source| super::super::covers(source, &target) == Ok(true))
+        })
+        .ok_or(crate::Error::Invalid)?;
+    scope
+        .links
+        .iter()
+        .find(|link| link.interface_index == endpoint.interface_index)
+        .ok_or(crate::Error::Invalid)
+}
+/// Inbound publication envelope. Both directions check the exact links, the
+/// translated current tuple and the original conntrack destination, so foreign
+/// NAT cannot borrow this admission for another flow.
+fn published_envelope(
+    scope: &RouterScope,
+    endpoint: &LocalLink,
+    port: &RouterPublishedPort,
+    reply: bool,
+) -> Result<Vec<Attr>> {
+    let mut expressions = ipv4();
+    expressions.extend(link(&scope.handoff, !reply));
+    expressions.extend(link(endpoint, reply));
+    expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+    expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
+    expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+    expressions.extend(ct(1, None, vec![u8::from(reply)]));
+    let target = format!("{}/32", port.endpoint_address);
+    expressions.extend(current_address(&target, reply)?);
+    expressions.extend(current_port(port.endpoint_port, reply));
+    let published = format!("{}/32", port.transit_source_address);
+    expressions.extend(original_address(&published, false)?);
+    expressions.extend(original_port(port.transit_port, false));
+    Ok(expressions)
+}
+/// Handoff ingress classification for an exact current publication. Raw runs
+/// before conntrack, so it matches the arriving tuple only and never sets a
+/// generation zone: a publication is an ordinary default-zone flow.
+fn published_return(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let mut expressions = ipv4();
+        expressions.extend(link(&scope.handoff, true));
+        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+        expressions.extend(current_address(
+            &format!("{}/32", port.transit_source_address),
+            false,
+        )?);
+        expressions.extend(current_port(port.transit_port, false));
+        program.end("raw_return", expressions, 1)?;
+    }
+    Ok(())
+}
+/// Endpoint ingress classification for an exact current publication. The workload
+/// side of a publication is an ordinary default-zone flow too, so it is matched on
+/// its exact link, address and dedicated published port before the leased
+/// classifiers below can zone it: a client whose source port equals a leased
+/// grant's destination port would otherwise move the workload's published packets
+/// into that generation, where they are not its flow. This only classifies; both
+/// the anti-spoof guards and the publication's admissions still decide admission.
+fn published_endpoint(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let mut expressions = ipv4();
+        expressions.extend(link(published_link(scope, port)?, true));
+        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+        expressions.extend(current_address(
+            &format!("{}/32", port.endpoint_address),
+            true,
+        )?);
+        expressions.extend(current_port(port.endpoint_port, true));
+        program.end("raw_in", expressions, 1)?;
+    }
+    Ok(())
+}
+fn published_translation(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let mut expressions = ipv4();
+        expressions.extend(link(&scope.handoff, true));
+        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+        expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
+        expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+        expressions.extend(ct(1, None, vec![0]));
+        expressions.extend(current_address(
+            &format!("{}/32", port.transit_source_address),
+            false,
+        )?);
+        expressions.extend(current_port(port.transit_port, false));
+        expressions.extend(dnat(&port.endpoint_address, port.endpoint_port)?);
+        program.rule("pre", expressions)?;
+    }
+    Ok(())
+}
+fn published_admissions(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let endpoint = published_link(scope, port)?;
+        let original = published_envelope(scope, endpoint, port, false)?;
+        for connection_state in [2, 8] {
+            let mut expressions = original.clone();
+            expressions.extend(state(connection_state));
+            if connection_state == 8 && port.protocol == "tcp" {
+                expressions.extend(opening_tcp());
+            }
+            program.end("forward", expressions, 1)?;
+        }
+        let mut reply = published_envelope(scope, endpoint, port, true)?;
+        reply.extend(state(2));
+        program.end("forward", reply, 1)?;
+    }
+    Ok(())
+}
 fn protected(
     program: &mut Program<'_>,
     chain: &str,
@@ -67,10 +186,19 @@ fn protected(
     program.end(chain, vec![], -5)
 }
 fn raw(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
-    // Handoff ingress must classify only exact leased return envelopes. Unknown
-    // ingress never reaches private/default-zone rules, even after a rename.
+    // Handoff ingress must classify only exact leased return envelopes and exact
+    // inbound publications. Unknown ingress never reaches private/default-zone
+    // rules, even after a rename.
     program.jump("raw_in", link(&scope.handoff, true), "raw_return")?;
     program.deny_link("raw_in", &scope.handoff, true)?;
+    // A publication is the explicit authority for its exact tuple, so it is
+    // classified ahead of the protected-source denial below, exactly as a
+    // platform return envelope is. The host publishes into this address, so its
+    // clients are not confined to unprotected space.
+    published_return(program, scope)?;
+    // Both sides of a publication lead the leased classifiers of every generation,
+    // so neither direction depends on the client's choice of source port.
+    published_endpoint(program, scope)?;
     for platform in [true, false] {
         if !platform {
             for prefix in &scope.protection.prefixes {
@@ -190,6 +318,12 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
     ] {
         program.chain(name, Some((hook, priority, kind)))?;
     }
+    if !scope.published_ports.is_empty() {
+        // Published destination NAT lives in this table's own prerouting chain, so
+        // it is created, replaced and deleted with the exact generation. An empty
+        // publication list keeps the previous chain set and compiled bytes.
+        program.chain("pre", Some((0, -100, "nat")))?;
+    }
     for name in ["raw_return", "protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
@@ -210,9 +344,20 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
     raw(program, scope)?;
     protected(program, "protected_out", scope, false)?;
     protected(program, "protected_back", scope, true)?;
+    published_translation(program, scope)?;
     for chain in ["input", "forward", "output"] {
         let parts = private.filter_rules(chain)?;
-        for expressions in parts.guards.into_iter().chain(parts.grants) {
+        for expressions in parts.guards {
+            program.rule(chain, expressions)?;
+        }
+        // Published admission keeps the private anti-spoof guards ahead of it and
+        // precedes the capture barrier: the barrier denies every protected original
+        // destination, which includes this transit address, and an exact inbound
+        // publication is the explicit authority for that exception.
+        if chain == "forward" {
+            published_admissions(program, scope)?;
+        }
+        for expressions in parts.grants {
             program.rule(chain, expressions)?;
         }
         grants(program, scope, chain, true)?;

package/rust/src/egress.rs

@@ -94,6 +94,15 @@ pub struct Generation {
     pub conntrack_label: String,
     pub grants: Vec<Grant>,
 }
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RouterPublishedPort {
+    pub protocol: String,
+    pub transit_port: u16,
+    pub endpoint_port: u16,
+    pub endpoint_address: String,
+    pub transit_source_address: String,
+}
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RouterScope {
@@ -103,6 +112,10 @@ pub struct RouterScope {
     pub handoff: LocalLink,
     pub protection: Protection,
     pub generations: Vec<Generation>,
+    /// Absent and empty are the same canonical policy, so an unpublished scope
+    /// keeps its exact previous digest and compiled graph.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub published_ports: Vec<RouterPublishedPort>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -380,6 +393,86 @@ pub fn destination(grant: &Grant, protection: &Protection) -> Result<String> {
         }
     }
 }
+/// Inbound publication is bounded by the authority this scope already proves: an
+/// exact leased transit source address present on the handoff, an exact current
+/// workload endpoint address behind one of this scope's veth links, and no overlap
+/// with the leased outbound source ports translated to that same transit address.
+fn normalize_router_published(value: &mut RouterScope) -> Result<()> {
+    let mut ports = std::mem::take(&mut value.published_ports);
+    require(ports.len() <= 64)?;
+    ports.sort();
+    for (index, port) in ports.iter().enumerate() {
+        require(
+            protocol(&port.protocol)
+                && port.transit_port > 0
+                && port.endpoint_port > 0
+                && (index == 0
+                    || ports[index - 1].protocol != port.protocol
+                    || ports[index - 1].transit_port != port.transit_port),
+        )?;
+        // rtnetlink verifies this exact handoff address at apply, recovery and
+        // inspection, and only a current leased transit source address receives a
+        // publication; that binding is what the host publication already targets.
+        require(
+            value
+                .handoff
+                .required_ipv4_addresses
+                .contains(&port.transit_source_address)
+                && value.generations.iter().any(|generation| {
+                    generation.transit_source_address == port.transit_source_address
+                }),
+        )?;
+        unicast(&port.endpoint_address)?;
+        // Endpoint source prefixes are canonical and pairwise disjoint, so at most
+        // one endpoint can hold this address. It must be an actual workload veth
+        // behind this scope, never a router-local address, a gateway, the transit
+        // address or a protected platform endpoint.
+        let target = format!("{}/32", port.endpoint_address);
+        let endpoint = value
+            .endpoints
+            .iter()
+            .find(|endpoint| {
+                endpoint
+                    .source_prefixes
+                    .iter()
+                    .any(|source| covers(source, &target) == Ok(true))
+            })
+            .ok_or(Error::Invalid)?;
+        require(
+            endpoint.interface_kind == "veth"
+                && value
+                    .links
+                    .iter()
+                    .chain(std::iter::once(&value.handoff))
+                    .all(|link| {
+                        !link
+                            .required_ipv4_addresses
+                            .contains(&port.endpoint_address)
+                    })
+                && value
+                    .protection
+                    .platform_endpoints
+                    .iter()
+                    .all(|item| item.address != port.endpoint_address),
+        )?;
+        for generation in &value.generations {
+            if generation.transit_source_address != port.transit_source_address {
+                continue;
+            }
+            for range in &generation.source_port_ranges {
+                // Source NAT translates to this same transit address, so a published
+                // port inside a leased outbound range is a translation conflict.
+                require(
+                    range.protocol != port.protocol
+                        || port.transit_port < range.first
+                        || port.transit_port > range.last,
+                )?;
+            }
+        }
+    }
+    value.published_ports = ports;
+    Ok(())
+}
 fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
     require(value.links.len() <= 32 && value.generations.len() <= 32)?;
     let private = policy::Policy {
@@ -550,7 +643,8 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
             item.transit_source_address.as_str(),
             item.source_port_ranges.as_slice(),
         )
-    }))
+    }))?;
+    normalize_router_published(value)
 }
 fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     require(