@push.rocks/smartnftables 4.0.0 → 4.1.0

package/changelog.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 2026-10-01 - 4.1.0
+
+### Features
+
+- Add optional exclusive forwarding to the schema-v2 `hostTransit` scope: `exclusiveForwarding: true` ends the scope's forward chain in one unconditional drop, so the host forwards exactly the scope's leased, published and symmetric handoff flows and their replies, and every other forwarded packet drops, IPv4 and IPv6, on every pair of links, including flows established before the member was applied. It is the host-wide forwarding default-deny that Docker's FORWARD policy DROP used to provide, for hosts where this table is the only forwarding owner: a drop in any table's forward chain is final, so it also denies forwarding other owners accept. With no `handoffs` the scope forwards nothing. The drop is created, verified, adopted, recovered, replaced and released with the table in one batch; this package sets no sysctl. Absent and `false` are the same canonical policy, digest and compiled bytes. `ManagedDockerForwarding.prepare()` refuses an exclusive barrier as `INVALID`, because its drop would deny Docker's own container forwarding.
+
+### Maintenance
+
+- Release tooling currency: `packageManager` `pnpm@12.6.0`, `@git.zone/cli` 8.1.0, `@git.zone/tsrust` 2.0.1 and `@git.zone/tsrun` `^3.0.2`; `@git.zone/tsbuild` 5.0.0 and `@git.zone/tstest` 6.3.2 are already current, and `@types/node` stays at 26.6.2 because 26.6.3 is younger than seven days. tsrust 2 builds only the host architecture in a plain `tsrust`, so the new `build:release` script builds both configured musl targets with `tsrust --configured-targets` and checks the set with `tsrust verify`, and `release.preflight.buildCommand` runs it, so a release still ships the amd64 and arm64 binaries. The 36 lock entries recorded with SHA-1 integrity are restored to the SHA-512 integrity registry.npmjs.org publishes, after each SHA-1 matched the npmjs shasum.
+
+## 2026-09-28 - 4.0.1
+
+### Fixes
+
+- Accept a `hostTransit` scope whose uplink addresses lie outside `protection.prefixes`. Every local address had to be inside the protected union, including the uplink lease and `snatAddress`, but the protected authority is cluster-wide and covers pools, resolvers, platform endpoints and the VPN, not a node's uplink lease, which is usually public; so every node with an uplink outside the plan was refused `INVALID` on each preparation. The host barrier now protects the uplink addresses itself: each one no protected prefix covers joins `protected_out` and `protected_back` as a `/32`, after the authority's prefixes, so a forwarded flow whose live or originally tracked destination is the host's uplink lease, or one sourced from it toward a handoff, is still denied, and the scope compiles exactly as if the authority had named that `/32`. Handoff addresses must still be protected, and a platform endpoint on an uplink address must still be protected and declared in `localPlatformEndpoints`. A scope whose uplink is covered keeps its exact digest and compiled bytes.
+
 ## 2026-09-28 - 4.0.0
 
 ### Breaking Changes

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "e879efc88997e38bb45c045fae690c3a07a3ff515c2a2581689466e3088ca236",
+  "binarySha256": "31265adcd734d687d19c98508332ec591f36afd9581c27a3c7b7fac647620b07",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.0.0",
-    "gitCommit": "7c66795f5e0edea87f2c9f7f1f70455cdf7e6bab",
+    "projectVersion": "4.1.0",
+    "gitCommit": "71cf6d5ee0d229b03b01f85901f5d50984b570a3",
     "gitDirty": false,
-    "builtAt": "2026-09-28T03:45:45.694Z",
-    "tsrustVersion": "1.15.1",
+    "builtAt": "2026-10-01T18:44:25.782Z",
+    "tsrustVersion": "2.0.1",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"
   }

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "268d3371a7986e7f1efcd6fb7fdd02b04635060a3e845c0ef45baec75e16a32a",
+  "binarySha256": "a6d37a21727fed45c2a4079261930682fbb136b67ac1b24971015725b2b4ada5",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.0.0",
-    "gitCommit": "7c66795f5e0edea87f2c9f7f1f70455cdf7e6bab",
+    "projectVersion": "4.1.0",
+    "gitCommit": "71cf6d5ee0d229b03b01f85901f5d50984b570a3",
     "gitDirty": false,
-    "builtAt": "2026-09-28T03:45:55.540Z",
-    "tsrustVersion": "1.15.1",
+    "builtAt": "2026-10-01T18:44:34.745Z",
+    "tsrustVersion": "2.0.1",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '4.0.0',
+    version: '4.1.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/managed.egress.types.d.ts

@@ -175,6 +175,8 @@ export interface IManagedNftHostTransitScopeV2 {
         link: IManagedNftLocalLinkV2;
         allocations: IManagedNftHandoffAllocationV2[];
     }>;
+    /** Its addresses need not lie in `protection.prefixes`; the host barrier protects each
+     * uncovered one as a `/32` destination. Handoff addresses must be protected. */
     uplink: IManagedNftLocalLinkV2;
     /** Exact current address present on uplink. No masquerade or default-route inference. */
     snatAddress: string;
@@ -194,6 +196,11 @@ export interface IManagedNftHostTransitScopeV2 {
      * leased source address and a source port of the allocation's range for the endpoint's protocol; its
      * ESTABLISHED replies return. Absent and empty are the same canonical policy, digest and compiled graph. */
     localPlatformEndpoints?: string[];
+    /** Optional: this table is the host's only forwarding owner. Every forwarded packet the scope does not
+     * admit (its leased, published and symmetric handoff flows) drops, IPv4 and IPv6, on every pair of
+     * interfaces, including forwarding that another table would accept. With no `handoffs` the host forwards
+     * nothing. It sets no sysctl. Absent and `false` are the same canonical policy, digest and compiled graph. */
+    exclusiveForwarding?: boolean;
 }
 /** One loopback TCP service that only one local user may dial. Every packet the host sends to the
  * exact address and port from a socket of any other user is rejected with a TCP reset, after ordinary

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",
@@ -9,10 +9,10 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "devDependencies": {
-    "@git.zone/cli": "7.3.0",
+    "@git.zone/cli": "8.1.0",
     "@git.zone/tsbuild": "^5.0.0",
-    "@git.zone/tsrun": "^3.0.1",
-    "@git.zone/tsrust": "1.15.1",
+    "@git.zone/tsrun": "^3.0.2",
+    "@git.zone/tsrust": "2.0.1",
     "@git.zone/tstest": "6.3.2",
     "@types/node": "26.6.2",
     "typescript": "^7.0.2"
@@ -66,6 +66,7 @@
   "scripts": {
     "test": "(tstest test/**/test*.ts --verbose --timeout 60)",
     "build": "(tsbuild tsfolders) && (tsrust)",
+    "build:release": "(tsbuild tsfolders) && (tsrust --configured-targets) && (tsrust verify)",
     "format": "(gitzone format)",
     "buildDocs": "tsdoc"
   }

package/readme.md

@@ -321,7 +321,7 @@ allocation-pool guard policy kinds.
 | V2 scope | Required authority and behavior |
 | --- | --- |
 | `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. Optional `publishedPorts` add the inbound second hop from the handoff to a workload endpoint, one port or a port range; both directions are classified into the default conntrack zone ahead of every leased classifier, so a published endpoint port is dedicated to its publication and never becomes leased egress. A `symmetric` publication also lets the workload open flows from its published ports. Optional `hostGrants` forward exact host-origin flows from the handoff to a workload endpoint. Optional `workloadGrants` let one workload open one exact port of another, one way. |
-| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation, one port or a port range, and a `symmetric` publication also carries the workload's own flows from its published ports out through the uplink. Optional `hostGrants` let the host's own address on a handoff dial exact workload ports. Optional `localPlatformEndpoints` serve platform endpoints on the host's own addresses to leased flows. |
+| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation, one port or a port range, and a `symmetric` publication also carries the workload's own flows from its published ports out through the uplink. Optional `hostGrants` let the host's own address on a handoff dial exact workload ports. Optional `localPlatformEndpoints` serve platform endpoints on the host's own addresses to leased flows. Optional `exclusiveForwarding` makes the table the host's only forwarding owner: every other forwarded packet drops. |
 | `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. Optional `hostGrants` are its only exceptions. Optional `localTcpPortOwners` restrict loopback TCP ports to one local user each. |
 
 `allocationPoolGuard` accepts 1–64 canonical, disjoint RFC1918 prefixes. Supply
@@ -333,7 +333,9 @@ source, then return; all remaining packets check their current destination. This
 denies DNAT into or away from a pool and untracked current-destination traffic,
 while permitting reverse-SNAT replies to authorized transit sources. It grants no
 egress permissions; exact `hostTransit` and router policies remain separate owners.
-Unrelated host traffic and IPv6 retain their existing behavior.
+Unrelated host traffic and IPv6 retain their existing behavior; the guard never denies
+forwarding between other links. On a host that forwards only for the handoffs, see
+[Exclusive forwarding](#exclusive-forwarding).
 
 For example, a guard policy is `{ schemaVersion: 2, revision: 1, scope: {
 kind: 'allocationPoolGuard', authorityDigest, prefixes: ['10.240.0.0/16',
@@ -369,6 +371,15 @@ so foreign DNAT cannot turn a protected destination into a public exception or
 redirect public traffic into protected space. INPUT diversion, local OUTPUT into
 handoffs, unmatched handoff traffic and IPv6 forwarding are denied.
 
+Every handoff address and platform endpoint lies in the protected prefixes. The
+`hostTransit` uplink addresses need not: the authority is the platform's address
+space, and a node's uplink lease and `snatAddress` is usually a public address
+outside it. The host barrier protects the uplink addresses itself, adding each one
+no protected prefix covers as a `/32` after the authority's prefixes, so a
+forwarded flow whose current or original destination is the host's uplink address,
+or one sourced from it toward a handoff, is denied like any protected destination.
+A scope whose uplink the prefixes already cover compiles exactly as before.
+
 #### Published host ports
 
 `hostTransit.publishedPorts` is optional. Absent and empty are the same canonical
@@ -494,7 +505,8 @@ the ESTABLISHED original direction, a NEW opening per protocol with opening TCP
 restricted to SYN with FIN/RST/ACK clear, and the ESTABLISHED reply. The handoff
 ingress classification precedes the
 barrier's protected-source denial, because the uplink or management network that
-reaches a published port is itself protected space. The endpoint ingress
+reaches a published port can itself be protected space (an uplink address outside
+the protected prefixes is still guarded as a /32). The endpoint ingress
 classification matches the exact workload link, address and published endpoint
 port, and precedes every leased classifier of every generation: raw runs before
 conntrack, so a client whose source port equals a leased grant's destination port
@@ -642,6 +654,61 @@ rules. Absent and empty are the same canonical policy, digest and compiled bytes
 caller keeps a declared endpoint's address outside every guarded allocation pool and
 owns the listener.
 
+#### Exclusive forwarding
+
+A host that forwards IPv4 (`net.ipv4.conf.all.forwarding=1`) routes between all of its
+links. On a Docker host, Docker set that switch and also the iptables FORWARD policy
+DROP, and `ManagedDockerForwarding` admits the handoff flows through it. On a host
+without Docker nothing denies forwarding that does not touch a handoff: host transit
+governs only handoff traffic, and the allocation-pool guard only pool destinations,
+so a LAN peer could use the host as its gateway, the uplink could hairpin, and two
+other links could exchange traffic. `hostTransit.exclusiveForwarding: true` closes
+that path inside the barrier's own table:
+
+```typescript
+const transit: IManagedNftPolicyV2 = { schemaVersion: 2, revision, scope: {
+  kind: 'hostTransit', protection, handoffs, uplink, snatAddress, exclusiveForwarding: true } };
+```
+
+The forward chain ends in one unconditional drop, after every rule of the scope.
+The host then forwards exactly what the scope admits: the leased flows of each
+handoff to the uplink with their ESTABLISHED replies, the inbound publications and
+their replies, and the symmetric publications' flows. Everything else that reaches
+the forward hook drops, whatever its links: IPv4 between the uplink, a LAN or any
+other link, a hairpin through the uplink, flows that were established before the
+member was applied, and forwarded IPv6. There is no ESTABLISHED/RELATED bypass, as
+everywhere in this scope, so ICMP errors for leased flows stay denied as before.
+Allocation pools need no exception: pool addresses are routed inside the router
+namespace and leave it translated to the transit source, so on the host only
+transit addresses cross the forward hook, and the pool guard denies pool
+destinations there anyway. IPv6 is dropped because the scope's packet model is
+IPv4 only; a host whose IPv6 forwarding is off never presents IPv6 to the hook.
+Input, output and NAT are unchanged, and so are the host's own flows: host grants
+and host-local platform endpoints are INPUT and OUTPUT traffic. With no `handoffs`
+the scope forwards nothing at all.
+
+nftables runs the forward base chain of every table, and a drop in any one of them
+is final, while an accept only ends its own chain. The member therefore drops
+forwarding that another owner (Docker, a container or VM bridge, a VPN router, a
+second routing daemon) accepts, and accepting in this table still cannot override
+another owner's drop. Use it only on a host where this table is the sole forwarding
+owner; on a Docker host keep it absent and use the Docker contribution below, which
+refuses an exclusive barrier. The
+member does not fence flowtable offload, packet queues, proxies or anything outside
+the forward hook.
+
+The drop is part of the scope's graph: it is created, verified, adopted, recovered,
+replaced and released with the rest of the table in one batch, and a replacement
+without the member or `release()` removes it, so forwarding resumes for every link
+the moment the table goes. This package sets no sysctl. The denial holds only while
+an exclusive table is applied, so the caller enables host forwarding only after an
+exclusive scope is enforced and disables it before releasing that scope, or keeps
+an exclusive scope applied between generations (with no handoffs it is a pure
+host-wide forwarding denial) and replaces it in place. Persistent forwarding in
+`sysctl.d` would make the host forward unfiltered after every boot until the scope
+is applied again, so leave the boot default off. Absent and `false` are the same
+canonical policy, digest and compiled bytes; the member adds one rule.
+
 #### Workload grants
 
 `routerEgress.workloadGrants` is optional: a stateful one-way flow between two
@@ -845,7 +912,9 @@ an explicit `/32` has different hidden match bytes in these frontends. A
 semantically equal rewrite with a different exact representation rejects, as does
 an early ACCEPT that the frontend reconstructs as the same command.
 The contribution never creates, flushes, adopts or deletes a Docker table/chain,
-and never changes a host forwarding policy.
+and never changes a host forwarding policy. `prepare()` refuses a barrier with
+`exclusiveForwarding` as `INVALID`: its drop would also deny Docker's own container
+forwarding.
 
 Each contributed rule binds the handoff and uplink names, current and original
 transit source, exact leased TCP/UDP port range, packet direction and connection
@@ -960,6 +1029,14 @@ another destination workload, the destination's TCP and UDP openings toward the
 source stay dark; withdrawal stops new flows and the established one; release reopens
 the path. A set of 1024 grants persists across owner loss, is re-verified element by
 element and survives lost-ACK replay.
+Exclusive forwarding is qualified on a host namespace with a handoff, an uplink and
+a LAN link: against positive controls with no policy and with the scope without the
+member, the member denies the LAN's IPv4 to the uplink peer, the peer's way back into
+the LAN, the LAN's IPv6 and a LAN flow established before it, while leased egress
+still leaves translated and an unleased port stays denied; without handoffs leased
+egress drops too; replacing it with a scope without the member and releasing an
+exclusive scope both reopen the LAN path. The same probe fails against a compiler
+without the drop.
 Loopback TCP port owners are qualified against pre-policy positive controls on the
 same listeners: the owning uid (root, and uid 1000 for a second port) connects, every
 other uid is reset with `ECONNREFUSED`, an unowned port and another loopback address

package/rust/src/docker.policy.rs

@@ -63,7 +63,11 @@ impl Policy {
             return Err(Error::Invalid);
         }
         self.barrier.prepared.validate()?;
-        self.scope()?;
+        // The contribution admits handoff flows through Docker's FORWARD path; an
+        // exclusive barrier would drop Docker's own container forwarding.
+        if self.scope()?.exclusive_forwarding {
+            return Err(Error::Invalid);
+        }
         let receipt = &self.barrier.receipt;
         let handle = receipt.table_handle.parse::<u64>().map_err(|_| Error::Invalid)?;
         if handle == 0 || handle.to_string() != receipt.table_handle

package/rust/src/docker_tests.rs

@@ -30,6 +30,9 @@ fn docker_prepare_rejects_router_receipts_bad_hashes_and_unbounded_restore() {
     let mut value=policy();value.schema_version=2;assert!(value.prepare("v1.8.11 (nf_tables)".into()).is_err());
     let mut value=policy();value.barrier.receipt.digest="sha256:wrong".into();assert!(value.prepare("v1.8.11 (nf_tables)".into()).is_err());
     let mut value=policy();value.barrier.prepared.policy=crate::managed::Policy::Egress(serde_json::from_value(crate::egress::tests::router()).unwrap());assert!(value.prepare("v1.8.11 (nf_tables)".into()).is_err());
+    let mut exclusive=crate::egress::tests::host();exclusive["scope"]["exclusiveForwarding"]=json!(true);
+    let prepared:crate::managed::Prepared=serde_json::from_value::<crate::egress::Policy>(exclusive).unwrap().prepare().unwrap().into();
+    let mut value=policy();value.barrier.receipt.digest=prepared.digest.clone();value.barrier.prepared=prepared;assert!(value.prepare("v1.8.11 (nf_tables)".into()).is_err());
     let value=serde_json::to_value(policy()).unwrap();
     let mut extra=value.clone();extra["rules"]=json!([]);assert!(serde_json::from_value::<policy::Policy>(extra).is_err());
     let mut extra=value;extra["barrier"]["receipt"]["tableHandle"]=json!("01");assert!(serde_json::from_value::<policy::Policy>(extra).unwrap().prepare("v1.8.11 (nf_tables)".into()).is_err());

package/rust/src/egress.host.rs

@@ -1,5 +1,22 @@
 use super::*;
 
+/// The host's own uplink addresses are protected destinations of this scope. A
+/// forwarded packet never reaches them, so a live or originally tracked tuple
+/// holding one is a translation into the host, and a forwarded one sourced from
+/// one is a spoof. The protected authority is cluster-wide and need not cover a
+/// node's uplink lease, which is usually public, so every uplink address outside
+/// it joins the barrier as a /32, in the uplink's canonical address order. An address the authority
+/// covers meets its prefix already, so a covered uplink compiles exactly as
+/// before.
+fn uplink_barrier(scope: &HostScope) -> Result<Vec<String>> {
+    let mut barrier = Vec::new();
+    for ip in &scope.uplink.required_ipv4_addresses {
+        if !covers_address(&scope.protection.prefixes, ip)? {
+            barrier.push(format!("{ip}/32"));
+        }
+    }
+    Ok(barrier)
+}
 fn protection(program: &mut Program<'_>, scope: &HostScope, reply: bool) -> Result<()> {
     let chain = if reply {
         "protected_back"
@@ -17,7 +34,8 @@ fn protection(program: &mut Program<'_>, scope: &HostScope, reply: bool) -> Resu
         expressions.extend(original_port(endpoint.port, false));
         program.end(chain, expressions, -5)?;
     }
-    for prefix in &scope.protection.prefixes {
+    let barrier = uplink_barrier(scope)?;
+    for prefix in scope.protection.prefixes.iter().chain(&barrier) {
         for original in [false, true] {
             let mut expressions = ipv4();
             expressions.extend(if original {
@@ -254,5 +272,14 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
         program.deny_link("forward", &handoff.link, true)?;
         program.deny_link("forward", &handoff.link, false)?;
     }
+    // Exclusive forwarding: everything the forward chain has not accepted by now
+    // drops, of every family and on every pair of interfaces, so the host
+    // forwards exactly this scope's leased, published and symmetric handoff
+    // flows. nftables runs every table's forward base chain, and a drop in any
+    // one is final: this denies forwarding that other owners would accept, and
+    // accepting here still cannot override their drops.
+    if scope.exclusive_forwarding {
+        program.end("forward", vec![], 0)?;
+    }
     Ok(())
 }

package/rust/src/egress.rs

@@ -210,6 +210,11 @@ pub struct HostScope {
     /// bound links. Absent and empty are the same canonical policy.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub local_platform_endpoints: Vec<String>,
+    /// This table is the host's only forwarding owner: every forwarded packet,
+    /// IPv4 or IPv6, that the scope does not admit drops, instead of passing to
+    /// other owners. Absent and false are the same canonical policy.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub exclusive_forwarding: bool,
 }
 /// One loopback TCP service that only one local user may dial: packets the host
 /// sends to the exact address and port from a socket of any other user reject,
@@ -1102,13 +1107,14 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
             .ok_or(Error::Invalid)?;
         require(local_addresses.contains(&endpoint.address))?;
     }
+    // Handoff addresses lie in protected space, checked per handoff below. An
+    // uplink address need not: the uplink lease and SNAT address is the host's
+    // public side, usually outside the protected authority, and the compiler
+    // adds each uncovered one to the host barrier as a protected destination.
     for ip in &local_addresses {
-        require(
-            covers_address(&value.protection.prefixes, ip)?
-                && value.protection.platform_endpoints.iter().all(|endpoint| {
-                    endpoint.address != *ip || value.local_platform_endpoints.contains(&endpoint.id)
-                }),
-        )?;
+        require(value.protection.platform_endpoints.iter().all(|endpoint| {
+            endpoint.address != *ip || value.local_platform_endpoints.contains(&endpoint.id)
+        }))?;
     }
     for handoff in &mut value.handoffs {
         normalize_link(&mut handoff.link)?;
@@ -1167,6 +1173,9 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
     )
 }
 
+#[cfg(test)]
+#[path = "egress_exclusiveforwarding_tests.rs"]
+mod exclusiveforwarding_tests;
 #[cfg(test)]
 #[path = "egress_hostgrant_tests.rs"]
 pub(crate) mod hostgrant_tests;
@@ -1186,6 +1195,9 @@ mod routerequivalence_tests;
 #[path = "egress_tests.rs"]
 pub(crate) mod tests;
 #[cfg(test)]
+#[path = "egress_uplink_tests.rs"]
+mod uplink_tests;
+#[cfg(test)]
 #[path = "egress_workloadgrant_tests.rs"]
 pub(crate) mod workloadgrant_tests;
 impl Policy {

package/rust/src/egress_exclusiveforwarding_tests.rs

@@ -0,0 +1,256 @@
+//! Exclusive forwarding in host transit: the host forwards exactly the scope's
+//! leased, published and symmetric handoff flows, and every other forwarded
+//! packet drops instead of passing to other owners.
+use super::hostgrant_tests::{
+    bytes, chains, decide, normalized, opening, prepared, Flow, ACK, ESTABLISHED,
+};
+use super::tests::{host, pool_guard, published_host, published_port, router};
+use super::Prepared;
+use crate::policy::verdict;
+use serde_json::{json, Value};
+
+const TRANSIT: [u8; 4] = [10, 240, 0, 2];
+const UPLINK: [u8; 4] = [192, 0, 2, 2];
+const PUBLIC: [u8; 4] = [198, 51, 100, 200];
+const CLIENT: [u8; 4] = [198, 51, 100, 9];
+const LAN_PEER: [u8; 4] = [172, 16, 0, 9];
+const HANDOFF: Option<(u32, &str)> = Some((4, "handoff"));
+const UPLINK_LINK: Option<(u32, &str)> = Some((2, "ens18"));
+/// Another host link that no scope binds: a management LAN, a second uplink.
+const LAN: Option<(u32, &str)> = Some((7, "lan0"));
+
+fn exclusive(mut value: Value) -> Value {
+    value["scope"]["exclusiveForwarding"] = json!(true);
+    value
+}
+/// The fixture with one symmetric UDP publication of the transit address.
+fn published() -> Value {
+    let mut port = published_port("udp", 5060, 5060);
+    port["symmetric"] = json!(true);
+    published_host(json!([published_port("tcp", 443, 8443), port]))
+}
+/// One forwarded packet; the originally tracked tuple equals the live one.
+fn forwarded(
+    input: Option<(u32, &'static str)>,
+    output: Option<(u32, &'static str)>,
+    (source, source_port): ([u8; 4], u16),
+    (destination, destination_port): ([u8; 4], u16),
+) -> Flow {
+    Flow {
+        input,
+        output,
+        source,
+        destination,
+        source_port,
+        destination_port,
+        original: (source, destination, source_port, destination_port),
+        ..opening(input, output)
+    }
+}
+/// The answer to `flow` on the reverse links.
+fn answer(flow: Flow) -> Flow {
+    Flow {
+        input: flow.output,
+        output: flow.input,
+        source: flow.destination,
+        destination: flow.source,
+        source_port: flow.destination_port,
+        destination_port: flow.source_port,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..flow
+    }
+}
+/// Forwarded traffic no scope admits: the host as a gateway between its other
+/// links and the uplink, a hairpin back out of the uplink, and traffic between
+/// two links the scope does not bind, in both directions and both protocols.
+fn unadmitted() -> Vec<Flow> {
+    let mut result = Vec::new();
+    for flow in [
+        forwarded(LAN, UPLINK_LINK, (LAN_PEER, 40000), (PUBLIC, 443)),
+        forwarded(UPLINK_LINK, LAN, (CLIENT, 40000), (LAN_PEER, 22)),
+        forwarded(UPLINK_LINK, UPLINK_LINK, (CLIENT, 40000), (PUBLIC, 443)),
+        forwarded(
+            LAN,
+            Some((8, "lan1")),
+            (LAN_PEER, 40000),
+            ([172, 17, 0, 9], 80),
+        ),
+    ] {
+        result.extend([
+            flow,
+            answer(flow),
+            Flow {
+                protocol: 17,
+                ..flow
+            },
+        ]);
+    }
+    result
+}
+/// Every flow the scope forwards: leased TCP and UDP egress with replies,
+/// published inbound TCP and UDP with replies, and symmetric UDP outbound.
+fn admitted() -> Vec<Flow> {
+    let leased = forwarded(HANDOFF, UPLINK_LINK, (TRANSIT, 10500), (PUBLIC, 443));
+    let inbound = Flow {
+        original: (CLIENT, UPLINK, 40000, 443),
+        ..forwarded(UPLINK_LINK, HANDOFF, (CLIENT, 40000), (TRANSIT, 8443))
+    };
+    let signalling = Flow {
+        protocol: 17,
+        original: (CLIENT, UPLINK, 40001, 5060),
+        ..forwarded(UPLINK_LINK, HANDOFF, (CLIENT, 40001), (TRANSIT, 5060))
+    };
+    let symmetric = Flow {
+        protocol: 17,
+        ..forwarded(HANDOFF, UPLINK_LINK, (TRANSIT, 5060), (CLIENT, 5060))
+    };
+    let mut result = Vec::new();
+    for flow in [
+        leased,
+        Flow {
+            protocol: 17,
+            ..leased
+        },
+        inbound,
+        signalling,
+        symmetric,
+    ] {
+        result.extend([
+            flow,
+            Flow {
+                state: ESTABLISHED,
+                tcp_flags: ACK,
+                ..flow
+            },
+            answer(flow),
+        ]);
+    }
+    result
+}
+
+#[test]
+fn exclusive_forwarding_absent_and_false_keep_the_host_digest_and_compiled_bytes() {
+    let baseline = prepared(host());
+    assert!(!serde_json::to_string(&baseline.policy)
+        .unwrap()
+        .contains("exclusiveForwarding"));
+    let mut value = host();
+    value["scope"]["exclusiveForwarding"] = json!(false);
+    let explicit = prepared(value);
+    assert_eq!(explicit, baseline);
+    assert_eq!(bytes(&explicit), bytes(&baseline));
+    let with = prepared(exclusive(host()));
+    assert_ne!(with.digest, baseline.digest);
+    assert!(serde_json::to_string(&with.policy)
+        .unwrap()
+        .contains("\"exclusiveForwarding\":true"));
+}
+
+#[test]
+fn exclusive_forwarding_appends_one_unconditional_forward_drop_and_nothing_else() {
+    for fixture in [host(), published()] {
+        let baseline = chains(&prepared(fixture.clone()));
+        let with = chains(&prepared(exclusive(fixture)));
+        assert_eq!(
+            with.keys().collect::<Vec<_>>(),
+            baseline.keys().collect::<Vec<_>>()
+        );
+        for (name, rules) in &baseline {
+            if name != "forward" {
+                assert_eq!(&with[name], rules, "{name}");
+            }
+        }
+        // The previous forward rules keep their order and the drop follows them.
+        // It has no family or interface match: forwarded IPv6 and every link
+        // pair drop like forwarded IPv4.
+        let forward = &with["forward"];
+        assert_eq!(&forward[..forward.len() - 1], &baseline["forward"][..]);
+        assert_eq!(forward.last().unwrap(), &vec![verdict(0, None)]);
+    }
+}
+
+#[test]
+fn exclusive_forwarding_denies_every_unadmitted_forward_and_keeps_every_admitted_one() {
+    for fixture in [host(), published()] {
+        let baseline = prepared(fixture.clone());
+        let with = prepared(exclusive(fixture));
+        // Without the member another owner's forwarding passes this table.
+        for (index, flow) in unadmitted().iter().enumerate() {
+            let decision = decide(&baseline, "forward", flow);
+            assert_eq!(
+                (decision.verdict, decision.chain.as_str()),
+                (1, "policy"),
+                "baseline {index}"
+            );
+            let decision = decide(&with, "forward", flow);
+            assert_eq!(
+                (decision.verdict, decision.chain.as_str()),
+                (0, "forward"),
+                "exclusive {index}"
+            );
+        }
+        // Every flow the scope forwards keeps its exact decision, and so does
+        // every handoff flow it already denies.
+        let handoff = [
+            forwarded(HANDOFF, LAN, (TRANSIT, 10500), (LAN_PEER, 443)),
+            forwarded(LAN, HANDOFF, (LAN_PEER, 40000), (TRANSIT, 8443)),
+            forwarded(HANDOFF, UPLINK_LINK, (TRANSIT, 9999), (PUBLIC, 443)),
+            forwarded(
+                HANDOFF,
+                UPLINK_LINK,
+                (TRANSIT, 10500),
+                ([10, 250, 0, 2], 443),
+            ),
+        ];
+        for (index, flow) in admitted().iter().chain(&handoff).enumerate() {
+            assert_eq!(
+                decide(&with, "forward", flow),
+                decide(&baseline, "forward", flow),
+                "flow {index}"
+            );
+        }
+    }
+    // The positive controls are real admissions of the published fixture.
+    let published = prepared(exclusive(published()));
+    for (index, flow) in admitted().iter().enumerate() {
+        assert_eq!(
+            decide(&published, "forward", flow).verdict,
+            1,
+            "admitted {index}"
+        );
+    }
+}
+
+#[test]
+fn exclusive_forwarding_without_handoffs_forwards_nothing() {
+    let mut value = exclusive(host());
+    value["scope"]["handoffs"] = json!([]);
+    let empty = prepared(value);
+    assert_eq!(chains(&empty)["forward"], vec![vec![verdict(0, None)]]);
+    let leased = forwarded(HANDOFF, UPLINK_LINK, (TRANSIT, 10500), (PUBLIC, 443));
+    for flow in unadmitted().into_iter().chain([leased, answer(leased)]) {
+        assert_eq!(decide(&empty, "forward", &flow).verdict, 0);
+    }
+    // Without the member an empty scope forwards everything, as before.
+    let mut value = host();
+    value["scope"]["handoffs"] = json!([]);
+    let open = prepared(value);
+    assert!(chains(&open)["forward"].is_empty());
+    assert_eq!(decide(&open, "forward", &leased).verdict, 1);
+}
+
+#[test]
+fn exclusive_forwarding_is_a_host_transit_boolean_only() {
+    for fixture in [router(), pool_guard()] {
+        assert!(normalized(exclusive(fixture)).is_err());
+    }
+    for invalid in [json!(1), json!("true"), json!(null)] {
+        let mut value = host();
+        value["scope"]["exclusiveForwarding"] = invalid;
+        assert!(normalized(value).is_err());
+    }
+    let restored: Prepared = prepared(exclusive(host()));
+    assert_eq!(restored.clone().policy.prepare().unwrap(), restored);
+}

package/rust/src/egress_uplink_tests.rs

@@ -0,0 +1,159 @@
+//! Host transit on an uplink whose own addresses lie outside the protected
+//! authority: the cluster-wide authority covers pools, resolvers, platform
+//! endpoints and the VPN, not a node's uplink lease, which is usually public.
+//! The scope prepares, and the host barrier protects the uplink addresses itself.
+use super::hostgrant_tests::{
+    chains, decide, normalized, opening, prepared, Flow, ACK, ESTABLISHED,
+};
+use super::tests::host;
+use serde_json::{json, Value};
+
+const TRANSIT: [u8; 4] = [10, 240, 0, 2];
+const UPLINK: [u8; 4] = [198, 51, 100, 7];
+const PUBLIC: [u8; 4] = [198, 51, 100, 200];
+const HANDOFF_LINK: Option<(u32, &str)> = Some((4, "handoff"));
+const UPLINK_LINK: Option<(u32, &str)> = Some((2, "ens18"));
+
+/// The `preparePolicy` request Pallet 35.1.0 sent pallet-guard on a lab node,
+/// captured on the native IPC (lab-only private addresses). Its uplink lease and
+/// SNAT address 10.92.26.30 lies outside the protected prefix 10.240.0.0/12; the
+/// two other uplink addresses hold host-local platform endpoints inside it.
+fn captured() -> Value {
+    json!({"schemaVersion":2,"revision":1,"scope":{"kind":"hostTransit",
+        "protection":{
+            "authorityDigest":"sha256:f436a15c8c8f4d4f0f23bc9fc69f45a8c9137a9586db1d2c2be8c09dac3467c9",
+            "prefixes":["10.240.0.0/12"],
+            "platformEndpoints":[
+                {"id":"5aaa706266a3c4e9b0cc99eb354496a732f88cdf3d36fd5911ab6fbb98ef7489","address":"10.244.0.30","port":8443,"protocol":"udp"},
+                {"id":"0298aa0b89b4248e058b7a279abc9d9c1793d2d012752432e95881367b43d6ac","address":"10.245.0.30","port":27017,"protocol":"tcp"},
+                {"id":"f0808a59e876a51c1a8a5b8cf38e0fc323dd5309dec3a8890468a1afc69dc9ff","address":"10.245.0.30","port":9000,"protocol":"tcp"},
+                {"id":"f4744ddb8e7d63883a7fbd4635f3ee4a031650effaaf5c13a1c664182b2b0501","address":"10.245.0.30","port":8443,"protocol":"tcp"},
+                {"id":"8933bdd0997dc2b230b0be7960c1708a57d72a0fa9481ec4aa56b9311ae68751","address":"10.243.0.1","port":53,"protocol":"tcp"},
+                {"id":"6e88da7a803f69d77d8d8fd86c5952ae87c26c3172b2f9a751662793e0ee8a7e","address":"10.243.0.1","port":53,"protocol":"udp"}]},
+        "handoffs":[{
+            "link":{"interfaceIndex":11,"interfaceName":"phc05f15afde9d","interfaceKind":"veth",
+                "macAddress":"4a:d5:5b:95:91:fa","interfaceLinkIndex":2,"requiredIpv4Addresses":["10.240.0.0"]},
+            "allocations":[{
+                "lease":{"id":"049eda6820b222e7e371bb4d1e24a325ac92422cff1900443c1e74a9efbb5d5e","generation":1,
+                    "digest":"sha256:9a5635b213263796ac3b883cce942a0ca45161d9412ec6c6c9a5d748c22a3a7c"},
+                "transitSourceAddress":"10.240.0.1",
+                "sourcePortRanges":[{"protocol":"tcp","first":1024,"last":65535},{"protocol":"udp","first":1024,"last":65535}]}]}],
+        "uplink":{"interfaceIndex":2,"interfaceName":"enp1s0","interfaceKind":"ethernet",
+            "macAddress":"52:54:00:92:26:30","interfaceLinkIndex":2,
+            "requiredIpv4Addresses":["10.244.0.30","10.245.0.30","10.92.26.30"]},
+        "snatAddress":"10.92.26.30",
+        "localPlatformEndpoints":[
+            "0298aa0b89b4248e058b7a279abc9d9c1793d2d012752432e95881367b43d6ac",
+            "5aaa706266a3c4e9b0cc99eb354496a732f88cdf3d36fd5911ab6fbb98ef7489",
+            "f0808a59e876a51c1a8a5b8cf38e0fc323dd5309dec3a8890468a1afc69dc9ff",
+            "f4744ddb8e7d63883a7fbd4635f3ee4a031650effaaf5c13a1c664182b2b0501"]}})
+}
+/// The host fixture on a public uplink lease outside every protected prefix.
+fn public() -> Value {
+    let mut value = host();
+    value["scope"]["uplink"]["requiredIpv4Addresses"] = json!(["198.51.100.7"]);
+    value["scope"]["snatAddress"] = json!("198.51.100.7");
+    value
+}
+/// A leased opening from the handoff out through the uplink, to `destination`
+/// in the live tuple and `original` in the originally tracked one.
+fn egress(destination: [u8; 4], original: [u8; 4]) -> Flow {
+    Flow {
+        source: TRANSIT,
+        destination,
+        source_port: 10500,
+        destination_port: 443,
+        original: (TRANSIT, original, 10500, 443),
+        ..opening(HANDOFF_LINK, UPLINK_LINK)
+    }
+}
+
+#[test]
+fn host_transit_prepares_the_captured_lab_request_with_an_unprotected_uplink_lease() {
+    // Refused INVALID by 4.0.0: the uplink lease was required to be protected.
+    let lab = prepared(captured());
+    // The lease joins the barrier as a /32, exactly as if the authority had
+    // named it; the covered uplink addresses meet their prefix already.
+    let mut value = captured();
+    value["scope"]["protection"]["prefixes"] = json!(["10.240.0.0/12", "10.92.26.30/32"]);
+    assert_eq!(chains(&lab), chains(&prepared(value)));
+}
+
+#[test]
+fn host_transit_uplink_addresses_need_no_protected_prefix_but_handoff_addresses_do() {
+    assert!(normalized(public()).is_ok());
+    // A handoff address outside the authority still refuses; the control
+    // covering it prepares.
+    let handoff = |prefix: &str| {
+        let mut value = public();
+        value["scope"]["protection"]["prefixes"] =
+            json!([prefix, "192.0.2.0/24", "203.0.113.10/32"]);
+        normalized(value)
+    };
+    assert!(handoff("10.240.0.2/32").is_err());
+    assert!(handoff("10.240.0.0/30").is_ok());
+    // A platform endpoint on the uplink lease lies in protected space, and it
+    // still refuses unless declared host-local.
+    let mut value = public();
+    value["scope"]["protection"]["prefixes"] =
+        json!(["10.0.0.0/8", "192.0.2.0/24", "198.51.100.7/32"]);
+    value["scope"]["protection"]["platformEndpoints"] = json!([
+        {"id":"hub","address":"198.51.100.7","protocol":"tcp","port":8443}]);
+    assert!(normalized(value.clone()).is_err());
+    value["scope"]["localPlatformEndpoints"] = json!(["hub"]);
+    assert!(normalized(value).is_ok());
+}
+
+#[test]
+fn host_transit_barrier_protects_an_unprotected_uplink_lease_as_a_destination() {
+    let with = prepared(public());
+    // Positive control: leased egress to public space passes, including a flow
+    // another owner translated between two public destinations.
+    for flow in [egress(PUBLIC, PUBLIC), egress(PUBLIC, [198, 51, 100, 201])] {
+        assert_eq!(decide(&with, "forward", &flow).verdict, 1);
+    }
+    // A flow whose live or originally tracked destination is the host's own
+    // uplink lease is a translation into the host: the barrier refuses it.
+    for flow in [egress(PUBLIC, UPLINK), egress(UPLINK, PUBLIC)] {
+        let decision = decide(&with, "forward", &flow);
+        assert_eq!(
+            (decision.verdict, decision.chain.as_str()),
+            (0, "protected_out")
+        );
+    }
+    // A packet forwarded toward the handoff from the uplink lease is a spoof.
+    let reply = Flow {
+        input: UPLINK_LINK,
+        output: HANDOFF_LINK,
+        source: UPLINK,
+        destination: TRANSIT,
+        source_port: 443,
+        destination_port: 10500,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..egress(PUBLIC, PUBLIC)
+    };
+    let decision = decide(&with, "forward", &reply);
+    assert_eq!(
+        (decision.verdict, decision.chain.as_str()),
+        (0, "protected_back")
+    );
+    let reply = Flow {
+        source: PUBLIC,
+        ..reply
+    };
+    assert_eq!(decide(&with, "forward", &reply).verdict, 1);
+}
+
+#[test]
+fn host_transit_covered_uplink_compiles_exactly_the_authority_barrier() {
+    // The fixture's uplink lies inside the authority: no address joins the
+    // barrier, and its compiled bytes stay frozen by the golden host test.
+    let covered = chains(&prepared(host()));
+    let public = chains(&prepared(public()));
+    for name in ["protected_out", "protected_back"] {
+        // One /32 adds a live and an originally tracked destination check.
+        assert_eq!(public[name].len(), covered[name].len() + 2, "{name}");
+    }
+}

package/rust/src/owner_exclusiveforwarding_tests.rs

@@ -0,0 +1,200 @@
+//! Exclusive forwarding qualified on a host namespace that forwards IPv4 and
+//! IPv6 between a handoff, an uplink and a LAN link no scope binds.
+use super::egress_traffic_tests::{connect, host_policy, ns_ip, roundtrip, socket};
+use super::host_traffic_tests::{control, ipv6_pair};
+use super::*;
+use crate::egress;
+use std::net::UdpSocket;
+use std::time::Duration;
+
+const SOURCE: &str = "xf_source";
+const HOST: &str = "xf_host";
+const PEER: &str = "xf_peer";
+const LAN: &str = "xf_lan";
+
+/// The fixture host policy at `revision`, with the member and the handoffs
+/// chosen. It reads the bound links, so it runs in the host namespace.
+fn policy(revision: u64, exclusive: bool, handoffs: bool) -> Prepared {
+    let mut policy = host_policy();
+    policy.revision = revision;
+    let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.exclusive_forwarding = exclusive;
+    if !handoffs {
+        scope.handoffs.clear();
+    }
+    let target: Prepared = policy.prepare().unwrap().into();
+    target
+        .validate_interfaces()
+        .expect("exclusive forwarding fixture binding");
+    target
+}
+/// A UDP socket in `ns` on an address built at run time.
+fn bound(ns: &str, address: String) -> UdpSocket {
+    let socket = in_namespace(ns, move || UdpSocket::bind(address).unwrap());
+    socket
+        .set_read_timeout(Some(Duration::from_millis(250)))
+        .unwrap();
+    socket
+}
+/// Every forward this host performs for the LAN link: the host as the LAN's
+/// gateway to the uplink peer, the peer's way back into the LAN, and the same
+/// gateway for IPv6. Fresh ports per call give each probe its own conntrack entry.
+fn lan_probes(port: u16, allowed: bool) {
+    for (from, source, to, destination) in [
+        (
+            LAN,
+            format!("172.16.0.2:{port}"),
+            PEER,
+            format!("192.0.2.3:{port}"),
+        ),
+        (
+            PEER,
+            format!("192.0.2.3:{}", port + 1),
+            LAN,
+            format!("172.16.0.2:{}", port + 1),
+        ),
+        (
+            LAN,
+            format!("[fd00:16::2]:{port}"),
+            PEER,
+            format!("[2001:db8:190::3]:{port}"),
+        ),
+    ] {
+        let target = bound(to, destination.clone());
+        control(&bound(from, source), &destination, &target, allowed);
+    }
+}
+/// Replaces the applied policy with `policy(revision, exclusive, handoffs)`,
+/// bound in the host namespace that holds the links.
+fn reconcile(
+    owner: Owner,
+    previous: Applied,
+    (revision, exclusive, handoffs): (u64, bool, bool),
+) -> (Owner, Applied) {
+    in_namespace(HOST, move || {
+        let mut owner = owner;
+        let applied = owner
+            .reconcile(Transition {
+                previous: Some(previous),
+                target: policy(revision, exclusive, handoffs),
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    })
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_exclusive_forwarding_forwards_only_the_scope_and_withdraws_cleanly() {
+    isolated();
+    for name in [SOURCE, HOST, PEER, LAN] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap();
+            std::fs::write("/proc/sys/net/ipv6/conf/all/forwarding", "1").unwrap();
+        });
+    }
+    connect(
+        SOURCE,
+        "source",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    connect(
+        HOST,
+        "lanlink",
+        "172.16.0.1/24",
+        LAN,
+        "lanpeer",
+        "172.16.0.2/24",
+    );
+    ns_ip(SOURCE, &["route", "add", "default", "via", "10.240.0.1"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    ns_ip(LAN, &["route", "add", "default", "via", "172.16.0.1"]);
+    ipv6_pair(
+        HOST,
+        "uplink",
+        "2001:db8:190::108",
+        PEER,
+        "underlay",
+        "2001:db8:190::3",
+    );
+    ipv6_pair(HOST, "lanlink", "fd00:16::1", LAN, "lanpeer", "fd00:16::2");
+    ns_ip(
+        PEER,
+        &["-6", "route", "add", "default", "via", "2001:db8:190::108"],
+    );
+    ns_ip(LAN, &["-6", "route", "add", "default", "via", "fd00:16::1"]);
+    // The leased egress path: the transit source and a leased port to the
+    // uplink peer's platform endpoint, answered through outer SNAT.
+    let leased = socket(SOURCE, "10.240.0.2:10000");
+    let platform = socket(PEER, "192.0.2.3:5300");
+    let unleased = socket(SOURCE, "10.240.0.2:9999");
+    // Positive controls: without any policy the host forwards for the LAN in
+    // both directions and both families.
+    lan_probes(41000, true);
+    // The scope without the member leaves forwarding outside its handoffs to
+    // other owners, so every later denial is caused by the member.
+    let (owner, applied) = in_namespace(HOST, || {
+        let mut owner = Owner::new(options("host_exclusive")).unwrap();
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target: policy(1, false, true),
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
+    lan_probes(41010, true);
+    assert_eq!(roundtrip(&leased, &platform).ip().to_string(), "192.0.2.2");
+    // A LAN flow already established through the host before the member.
+    let established = socket(LAN, "172.16.0.2:41100");
+    let established_target = socket(PEER, "192.0.2.3:41100");
+    assert_eq!(
+        roundtrip(&established, &established_target)
+            .ip()
+            .to_string(),
+        "172.16.0.2"
+    );
+    // Exclusive: only the scope's leased handoff flows still cross the host.
+    let (owner, applied) = reconcile(owner, applied, (2, true, true));
+    lan_probes(41020, false);
+    control(&established, "192.0.2.3:41100", &established_target, false);
+    assert_eq!(roundtrip(&leased, &platform).ip().to_string(), "192.0.2.2");
+    control(&unleased, "192.0.2.3:5300", &platform, false);
+    // Without handoffs the exclusive scope forwards nothing at all.
+    let (owner, applied) = reconcile(owner, applied, (3, true, false));
+    lan_probes(41030, false);
+    control(&leased, "192.0.2.3:5300", &platform, false);
+    // Replacing it with a scope without the member reopens the LAN path.
+    let (owner, applied) = reconcile(owner, applied, (4, false, true));
+    lan_probes(41040, true);
+    assert_eq!(roundtrip(&leased, &platform).ip().to_string(), "192.0.2.2");
+    // Release of an exclusive scope reopens it as well.
+    let (owner, applied) = reconcile(owner, applied, (5, true, true));
+    lan_probes(41050, false);
+    in_namespace(HOST, move || {
+        let mut owner = owner;
+        assert!(owner.inspect().enforced);
+        owner.release(applied).unwrap();
+    });
+    lan_probes(41060, true);
+    let reopened = socket(SOURCE, "10.240.0.2:10001");
+    control(&reopened, "192.0.2.3:5300", &platform, true);
+    println!("V2_HOST_EXCLUSIVE_FORWARDING_PROOF positive_controls=true member_absent_lan_forwarded=true lan_ipv4_denied=true lan_reverse_denied=true lan_ipv6_denied=true established_foreign_flow_stopped=true leased_egress_kept=true unleased_port_denied=true empty_scope_forwards_nothing=true replacement_reopens=true release_reopens=true");
+}

package/rust/src/owner_host_traffic_tests.rs

@@ -121,7 +121,7 @@ pub(super) fn control(source: &UdpSocket, destination: &str, target: &UdpSocket,
         assert!(target.recv(&mut [0; 64]).is_err());
     }
 }
-fn ipv6_pair(a: &str, aname: &str, aip: &str, b: &str, bname: &str, bip: &str) {
+pub(super) fn ipv6_pair(a: &str, aname: &str, aip: &str, b: &str, bname: &str, bip: &str) {
     let aname_owned = aname.to_owned();
     let bname_owned = bname.to_owned();
     let amac = in_namespace(a, move || packet_fixture::mac(&aname_owned));

package/rust/src/owner_tests.rs

@@ -21,6 +21,9 @@ mod packet_fixture;
 #[path = "owner_host_traffic_tests.rs"]
 mod host_traffic_tests;
 
+#[path = "owner_exclusiveforwarding_tests.rs"]
+mod exclusiveforwarding_tests;
+
 #[path = "owner_router_traffic_tests.rs"]
 mod router_traffic_tests;
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '4.0.0',
+  version: '4.1.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/managed.egress.types.ts

@@ -172,6 +172,8 @@ export interface IManagedNftHostTransitScopeV2 {
   kind: 'hostTransit';
   protection: IManagedNftProtectionV2;
   handoffs: Array<{ link: IManagedNftLocalLinkV2; allocations: IManagedNftHandoffAllocationV2[] }>;
+  /** Its addresses need not lie in `protection.prefixes`; the host barrier protects each
+   * uncovered one as a `/32` destination. Handoff addresses must be protected. */
   uplink: IManagedNftLocalLinkV2;
   /** Exact current address present on uplink. No masquerade or default-route inference. */
   snatAddress: string;
@@ -191,6 +193,11 @@ export interface IManagedNftHostTransitScopeV2 {
    * leased source address and a source port of the allocation's range for the endpoint's protocol; its
    * ESTABLISHED replies return. Absent and empty are the same canonical policy, digest and compiled graph. */
   localPlatformEndpoints?: string[];
+  /** Optional: this table is the host's only forwarding owner. Every forwarded packet the scope does not
+   * admit (its leased, published and symmetric handoff flows) drops, IPv4 and IPv6, on every pair of
+   * interfaces, including forwarding that another table would accept. With no `handoffs` the host forwards
+   * nothing. It sets no sysctl. Absent and `false` are the same canonical policy, digest and compiled graph. */
+  exclusiveForwarding?: boolean;
 }
 
 /** One loopback TCP service that only one local user may dial. Every packet the host sends to the