@push.rocks/smartproxy 30.0.1 → 31.0.0

package/ts/proxies/smart-proxy/smart-proxy.ts

@@ -19,7 +19,7 @@ import { Mutex } from './utils/mutex.js';
 import { ConcurrencySemaphore } from './utils/concurrency-semaphore.js';
 
 // Types
-import type { ISmartProxyOptions, ISmartProxySecurityPolicy, TSmartProxyCertProvisionObject, IAcmeOptions, ICertProvisionEventComms, ICertificateIssuedEvent, ICertificateFailedEvent, ISmartProxyCertProvisionCertificate, IActiveConnectionSnapshot, IActiveConnectionSnapshotOptions, IActiveConnectionSnapshotPage } from './models/interfaces.js';
+import type { ISmartProxyOptions, ISmartProxySecurityPolicy, TSmartProxyCertProvisionObject, ICertProvisionEventComms, ICertificateIssuedEvent, ICertificateFailedEvent, ISmartProxyCertProvisionCertificate, IActiveConnectionSnapshot, IActiveConnectionSnapshotOptions, IActiveConnectionSnapshotPage } from './models/interfaces.js';
 import type { IRouteConfig } from './models/route-types.js';
 import type { IMetrics, IMetricsHistory } from './models/metrics-types.js';
 import type { IRustCertificateStatus, IRustChallengeOptions, IRustProxyOptions, IRustStatistics } from './models/rust-types.js';
@@ -77,8 +77,12 @@ export class SmartProxy extends plugins.EventEmitter {
       maxConnectionLifetime: settingsArg.maxConnectionLifetime || 3_600_000,
       inactivityTimeout: settingsArg.inactivityTimeout || 75_000,
       gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30_000,
-      maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100,
-      connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300,
+      // Only an omitted value takes the default: `null` means no per-IP limit (so neither `||`
+      // nor `??` fits), and 0 or a negative value is refused by the settings validation below.
+      maxConnectionsPerIP: settingsArg.maxConnectionsPerIP === undefined ? 100 : settingsArg.maxConnectionsPerIP,
+      connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute === undefined
+        ? 300
+        : settingsArg.connectionRateLimitPerMinute,
       keepAliveTreatment: settingsArg.keepAliveTreatment || 'standard',
       keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 4,
       extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 3_600_000,
@@ -210,16 +214,14 @@ export class SmartProxy extends plugins.EventEmitter {
       // Preprocess routes (strip JS functions, convert socket-handler routes)
       const rustRoutes = this.preprocessor.preprocessForRust(this.settings.routes);
 
-      // When certProvisionFunction handles cert provisioning,
-      // disable Rust's built-in ACME to prevent race condition.
-      let acmeForRust = this.settings.acme;
-      if (this.settings.certProvisionFunction && acmeForRust?.enabled) {
-        acmeForRust = { ...acmeForRust, enabled: false };
-        logger.log('info', 'Rust ACME disabled — certProvisionFunction will handle certificate provisioning', { component: 'smart-proxy' });
+      // When certProvisionFunction handles cert provisioning, the engine's ACME
+      // client orders only what it is asked to (buildRustProxyOptions).
+      if (this.settings.certProvisionFunction && this.settings.acme?.enabled) {
+        logger.log('info', 'Rust ACME orders certificates only on request — certProvisionFunction handles certificate provisioning', { component: 'smart-proxy' });
       }
 
       // Build Rust config
-      const config = this.buildRustConfig(rustRoutes, acmeForRust);
+      const config = this.buildRustConfig(rustRoutes);
 
       // Start the Rust proxy
       await this.bridge.startProxy(config, RouteValidator.getRouteLabels(this.settings.routes));
@@ -385,6 +387,10 @@ export class SmartProxy extends plugins.EventEmitter {
       // Preprocess for Rust
       const rustRoutes = this.preprocessor.preprocessForRust(newRoutes);
 
+      // Swap the kernel rules first: a refused rule leaves the running routes untouched
+      const previousRoutes = this.settings.routes;
+      await this.replaceNftablesRules(newRoutes, previousRoutes);
+
       try {
         if (hasChallengeRoutes) {
           await this.ensureChallengeProviderRelay();
@@ -403,6 +409,9 @@ export class SmartProxy extends plugins.EventEmitter {
           this.challengeProviderRelayServer = null;
           this.challengeRuntimeOptions = undefined;
         }
+        await this.replaceNftablesRules(previousRoutes).catch((restoreErr) => {
+          logger.log('error', `Failed to restore the previous NFTables rules: ${(restoreErr as Error).message}`, { component: 'smart-proxy' });
+        });
         throw err;
       }
 
@@ -449,13 +458,6 @@ export class SmartProxy extends plugins.EventEmitter {
         this.challengeRuntimeOptions = undefined;
       }
 
-      // Update NFTables rules
-      if (this.nftablesManager) {
-        await this.nftablesManager.cleanup();
-        this.nftablesManager = null;
-      }
-      await this.applyNftablesRules(newRoutes);
-
       // Update stored routes
       this.settings.routes = newRoutes;
 
@@ -653,16 +655,57 @@ export class SmartProxy extends plugins.EventEmitter {
   }
 
   /**
-   * Apply NFTables rules for routes using the nftables forwarding engine.
+   * Replace the current NFTables rules with those of `routes`. When a rule fails, the
+   * rules of `fallbackRoutes` are applied again before the error is rethrown.
+   */
+  private async replaceNftablesRules(routes: IRouteConfig[], fallbackRoutes?: IRouteConfig[]): Promise<void> {
+    if (this.nftablesManager) {
+      await this.nftablesManager.cleanup();
+      this.nftablesManager = null;
+    }
+    try {
+      await this.applyNftablesRules(routes);
+    } catch (err) {
+      if (fallbackRoutes) {
+        await this.applyNftablesRules(fallbackRoutes).catch((restoreErr) => {
+          logger.log('error', `Failed to restore the previous NFTables rules: ${(restoreErr as Error).message}`, { component: 'smart-proxy' });
+        });
+      }
+      throw err;
+    }
+  }
+
+  /**
+   * Apply NFTables rules for the enabled routes using the nftables forwarding engine.
+   * A rule that fails removes the rules applied before it.
    */
   private async applyNftablesRules(routes: IRouteConfig[]): Promise<void> {
-    const nftRoutes = routes.filter(r => r.action.forwardingEngine === 'nftables');
+    const nftRoutes = routes.filter(r => r.enabled !== false && r.action.forwardingEngine === 'nftables');
     if (nftRoutes.length === 0) return;
 
     const tableName = nftRoutes.find(r => r.action.nftables?.tableName)?.action.nftables?.tableName ?? 'smartproxy';
     const nft = new plugins.smartnftables.SmartNftables({ tableName });
-    await nft.initialize();
+    // Hold the manager before applying, so every rule that lands has a cleanup handle
+    this.nftablesManager = nft;
+    try {
+      await nft.initialize();
+      await this.addNftablesRules(nft, nftRoutes);
+    } catch (err) {
+      this.nftablesManager = null;
+      // Forced: a failed initialize() may have created the table without marking it initialized
+      await nft.cleanup({ force: true }).catch((cleanupErr) => {
+        logger.log('warn', `Failed to clean NFTables after a failed rule: ${(cleanupErr as Error).message}`, { component: 'smart-proxy' });
+      });
+      throw err;
+    }
+    logger.log('info', `Applied NFTables rules for ${nftRoutes.length} route(s)`, { component: 'smart-proxy' });
+  }
 
+  /** Add the port-forwarding rules of each route, one per listed port and target. */
+  private async addNftablesRules(
+    nft: InstanceType<typeof plugins.smartnftables.SmartNftables>,
+    nftRoutes: IRouteConfig[],
+  ): Promise<void> {
     for (const route of nftRoutes) {
       const routeId = route.name || 'unnamed';
       const targets = route.action.targets;
@@ -692,16 +735,13 @@ export class SmartProxy extends plugins.EventEmitter {
         }
       }
     }
-
-    this.nftablesManager = nft;
-    logger.log('info', `Applied NFTables rules for ${nftRoutes.length} route(s)`, { component: 'smart-proxy' });
   }
 
   /**
    * Build the Rust configuration object from TS settings.
    */
-  private buildRustConfig(routes: IRustProxyOptions['routes'], acmeOverride?: IAcmeOptions): IRustProxyOptions {
-    return buildRustProxyOptions(this.settings, routes, acmeOverride, this.challengeRuntimeOptions);
+  private buildRustConfig(routes: IRustProxyOptions['routes']): IRustProxyOptions {
+    return buildRustProxyOptions(this.settings, routes, this.challengeRuntimeOptions);
   }
 
   private hasChallengeRoutes(routes: IRouteConfig[]): boolean {
@@ -981,8 +1021,9 @@ export class SmartProxy extends plugins.EventEmitter {
   /**
    * Record the validity window of a certificate loaded into Rust.
    * Prefers an explicit validUntil; otherwise parses the PEM.
+   * @returns the recorded end of validity, or undefined if it is unknown
    */
-  private recordCertValidity(domain: string, publicKeyPem: string, validUntil?: number): void {
+  private recordCertValidity(domain: string, publicKeyPem: string, validUntil?: number): number | undefined {
     let resolved = validUntil;
     if (!resolved && publicKeyPem) {
       try {
@@ -994,7 +1035,9 @@ export class SmartProxy extends plugins.EventEmitter {
     }
     if (resolved && Number.isFinite(resolved)) {
       this.certValidity.set(domain, resolved);
+      return resolved;
     }
+    return undefined;
   }
 
   /** Whether the domain has a loaded cert that is not yet inside the renewal window. */
@@ -1125,6 +1168,9 @@ export class SmartProxy extends plugins.EventEmitter {
     };
 
     const timeoutMs = this.settings.certProvisionTimeout ?? 300_000; // 5 min default
+    // Set when the domain's certificate is ordered through Rust ACME, so a failed
+    // order is not placed a second time as the ACME fallback.
+    let orderedThroughAcme = false;
 
     try {
       const result: TSmartProxyCertProvisionObject = await this.withTimeout(
@@ -1142,15 +1188,14 @@ export class SmartProxy extends plugins.EventEmitter {
       }
 
       if (result === 'http01') {
-        if (route.name) {
-          try {
-            await this.bridge.provisionCertificate(route.name);
-            logger.log('info', `Triggered Rust ACME for ${domain} (route: ${route.name})`, { component: 'smart-proxy' });
-          } catch (provisionErr: any) {
-            logger.log('warn', `Cannot provision cert for ${domain} — callback returned 'http01' but Rust ACME failed: ${provisionErr.message}. ` +
-              'Note: Rust ACME is disabled when certProvisionFunction is set.', { component: 'smart-proxy' });
-          }
-        }
+        orderedThroughAcme = true;
+        const acmeExpiryDate = await this.provisionThroughRustAcme(domain, route);
+        logger.log('info', `Certificate issued through Rust ACME for ${domain} (route: ${route.name})`, { component: 'smart-proxy' });
+        this.emit('certificate-issued', {
+          domain,
+          expiryDate: acmeExpiryDate,
+          source,
+        } satisfies ICertificateIssuedEvent);
         return 'http01';
       }
 
@@ -1190,7 +1235,8 @@ export class SmartProxy extends plugins.EventEmitter {
       }
       return 'unrecognized';
     } catch (err: any) {
-      logger.log('warn', `certProvisionFunction failed for ${domain}: ${err.message}`, { component: 'smart-proxy' });
+      const failedStep = orderedThroughAcme ? 'Rust ACME order' : 'certProvisionFunction';
+      logger.log('warn', `${failedStep} failed for ${domain}: ${err.message}`, { component: 'smart-proxy' });
 
       // Start the per-domain failure cooldown so subsequent sweeps skip this
       // domain instead of re-running ACME orders back to back.
@@ -1202,11 +1248,16 @@ export class SmartProxy extends plugins.EventEmitter {
         source,
       } satisfies ICertificateFailedEvent);
 
-      // Fallback to ACME if enabled and route has a name
-      if (this.settings.certProvisionFallbackToAcme !== false && route.name) {
+      // Fall back to Rust ACME, unless the attempt that failed was that order.
+      if (this.settings.certProvisionFallbackToAcme !== false && !orderedThroughAcme) {
         try {
-          await this.bridge.provisionCertificate(route.name);
-          logger.log('info', `Falling back to Rust ACME for ${domain} (route: ${route.name})`, { component: 'smart-proxy' });
+          const acmeExpiryDate = await this.provisionThroughRustAcme(domain, route);
+          logger.log('info', `Certificate issued through the Rust ACME fallback for ${domain} (route: ${route.name})`, { component: 'smart-proxy' });
+          this.emit('certificate-issued', {
+            domain,
+            expiryDate: acmeExpiryDate,
+            source: 'acme',
+          } satisfies ICertificateIssuedEvent);
         } catch (acmeErr: any) {
           logger.log('warn', `ACME fallback also failed for ${domain}: ${acmeErr.message}` +
             (this.settings.disableDefaultCert
@@ -1218,6 +1269,30 @@ export class SmartProxy extends plugins.EventEmitter {
     }
   }
 
+  /**
+   * Order a domain's certificate through the engine's ACME client (HTTP-01 on
+   * `acme.port`), for an 'http01' callback result or the ACME fallback. The engine
+   * serves the certificate; its recorded validity lets sweeps skip the domain until
+   * the renewal window.
+   * @returns the certificate's expiry date (ISO 8601), if its PEM parses
+   */
+  private async provisionThroughRustAcme(domain: string, route: IRouteConfig): Promise<string | undefined> {
+    if (!this.settings.acme?.enabled) {
+      throw new Error(`Rust ACME cannot order a certificate for ${domain}: acme is not configured`);
+    }
+    if (!route.name) {
+      throw new Error(`Rust ACME cannot order a certificate for ${domain}: its route has no name`);
+    }
+    const issued = await this.bridge.provisionCertificate(
+      route.name,
+      domain,
+      this.settings.certProvisionTimeout ?? 300_000,
+    );
+    this.certFailureAt.delete(domain);
+    const validUntil = this.recordCertValidity(domain, issued.cert);
+    return validUntil ? new Date(validUntil).toISOString() : undefined;
+  }
+
   /**
    * Race a promise against a timeout. Rejects with the given message if the timeout fires first.
    */

package/ts/proxies/smart-proxy/utils/route-validator.ts

@@ -1,3 +1,4 @@
+import * as plugins from '../../../plugins.js';
 import { logger } from '../../../core/utils/logger.js';
 import {
   checkAssignedIpEntry,
@@ -5,7 +6,7 @@ import {
   checkSourceMatchIpEntry,
   describeRefusedIpEntry,
 } from './ip-entry-validation.js';
-import type { IInboundProxyProtocolPolicy, IRouteConfig, IRouteMatch, IRouteAction, TPortRange, TTransportProtocol } from '../models/route-types.js';
+import type { IInboundProxyProtocolPolicy, IRouteBackendTls, IRouteConfig, IRouteMatch, IRouteAction, TPortRange, TTlsMode, TTransportProtocol } from '../models/route-types.js';
 import type { ISmartProxyOptions, ISmartProxySecurityPolicy } from '../models/interfaces.js';
 import { RouteValidationError, type IRouteValidationErrorEntry } from './route-validation-error.js';
 
@@ -211,6 +212,8 @@ export class RouteValidator {
         }
       }
 
+      errors.push(...this.getBackendTlsErrors(route));
+
       // QUIC routes require TLS with termination (QUIC mandates TLS 1.3)
       if (route.action.udp?.quic && route.action.type === 'forward') {
         if (!route.action.tls) {
@@ -277,6 +280,11 @@ export class RouteValidator {
         }
       }
 
+      // No enforcement reads security.authentication; accepting it would serve the route unauthenticated
+      if (route.security.authentication) {
+        errors.push('security.authentication is not supported; use security.basicAuth or security.jwtAuth');
+      }
+
       // Validate rate limits
       if (route.security.rateLimit) {
         if (route.security.rateLimit.maxRequests && route.security.rateLimit.maxRequests < 0) {
@@ -338,6 +346,33 @@ export class RouteValidator {
       }
     }
 
+    // Raw-forwarded traffic never reaches the HTTP layer that enforces these controls
+    const httpControl = this.httpSecurityControl(route);
+    const rawForwarding = httpControl ? this.rawForwardingReason(route) : null;
+    if (httpControl && rawForwarding) {
+      errors.push(
+        `${httpControl} is enforced only on HTTP traffic, but ${rawForwarding.reason}; ${rawForwarding.alternative}`,
+      );
+    }
+
+    // The TypeScript relay that serves dynamic targets cannot honour these settings
+    if (this.hasDynamicTarget(route)) {
+      for (const { setting, reason } of this.getDynamicTargetConflicts(route)) {
+        errors.push(
+          `${setting} is not supported with a dynamic target (a function host or port): ${reason}; use static targets`,
+        );
+      }
+    }
+
+    // The kernel forwards nftables routes before the proxy sees their packets
+    if (route.action?.forwardingEngine === 'nftables') {
+      for (const { setting, reason } of this.getNftablesConflicts(route)) {
+        errors.push(
+          `${setting} is not supported with forwardingEngine "nftables": ${reason}; use the default forwarding engine`,
+        );
+      }
+    }
+
     // Validate priority
     if (route.priority !== undefined && (route.priority < 0 || route.priority > 10000)) {
       errors.push('Priority must be between 0 and 10000');
@@ -349,6 +384,269 @@ export class RouteValidator {
     };
   }
 
+  /**
+   * The config path of the first access control the route sets that only the
+   * HTTP layer enforces. Mirrors `RouteConfig::http_security_control` in Rust.
+   */
+  private static httpSecurityControl(route: IRouteConfig): string | null {
+    const security = route.security;
+    if (security?.basicAuth?.enabled === true) {
+      return 'security.basicAuth';
+    }
+    if (security?.jwtAuth?.enabled === true) {
+      return 'security.jwtAuth';
+    }
+    if (security?.rateLimit?.enabled === true) {
+      return 'security.rateLimit';
+    }
+    if (security?.challenge) {
+      return 'security.challenge';
+    }
+    if ((route.action?.websocket?.allowedOrigins?.length ?? 0) > 0) {
+      return 'action.websocket.allowedOrigins';
+    }
+    return null;
+  }
+
+  /**
+   * Why the route forwards its traffic without the HTTP layer, and what to
+   * configure instead. Mirrors `raw_forwarding_reason` in Rust, which sees a
+   * dynamic-target route as the socket-handler route the preprocessor makes of it.
+   */
+  private static rawForwardingReason(route: IRouteConfig): { reason: string; alternative: string } | null {
+    if (route.action?.type === 'socket-handler') {
+      return {
+        reason: 'a socket-handler route hands the raw connection to its handler',
+        alternative: 'enforce it in the handler or use a forward route',
+      };
+    }
+    if (this.hasDynamicTarget(route)) {
+      return {
+        reason: 'a dynamic target (a function host or port) is served by a relay that forwards the raw connection',
+        alternative: 'use static targets',
+      };
+    }
+    if (this.tlsMode(route) === 'passthrough') {
+      return {
+        reason: 'TLS passthrough forwards the encrypted stream unread',
+        alternative: 'use tls.mode "terminate" or "terminate-and-reencrypt"',
+      };
+    }
+    if (route.match?.protocol === 'tcp') {
+      return {
+        reason: 'match.protocol "tcp" matches only non-HTTP traffic',
+        alternative: 'use match.protocol "http"',
+      };
+    }
+    const transport = route.match?.transport;
+    if ((transport === 'udp' || transport === 'all') && route.action?.udp?.quic?.enableHttp3 !== true) {
+      return {
+        reason: 'UDP and QUIC traffic without HTTP/3 is forwarded raw',
+        alternative: 'set action.udp.quic.enableHttp3 or serve UDP from a separate route',
+      };
+    }
+    return null;
+  }
+
+  /**
+   * The route's TLS mode: `action.tls`, else the first target's `tls`. Mirrors
+   * `RouteConfig::tls_mode` in Rust.
+   */
+  private static tlsMode(route: IRouteConfig): TTlsMode | undefined {
+    return route.action?.tls ? route.action.tls.mode : route.action?.targets?.[0]?.tls?.mode;
+  }
+
+  /**
+   * The problems of the backend TLS settings a route carries. Mirrors
+   * `validate_route_backend_tls` in Rust.
+   */
+  private static getBackendTlsErrors(route: IRouteConfig): string[] {
+    const settings: Array<[string, IRouteBackendTls]> = [];
+    if (route.action?.tls?.backend) {
+      settings.push(['action.tls.backend', route.action.tls.backend]);
+    }
+    (route.action?.targets ?? []).forEach((target, index) => {
+      if (target.tls?.backend) {
+        settings.push([`action.targets[${index}].tls.backend`, target.tls.backend]);
+      }
+    });
+    const passthrough = this.tlsMode(route) === 'passthrough';
+    const errors: string[] = [];
+    for (const [field, backend] of settings) {
+      if (passthrough) {
+        errors.push(
+          `${field} has no effect: TLS passthrough forwards the client's TLS and never connects to the backend over TLS`,
+        );
+      }
+      errors.push(...this.getBackendTlsSettingErrors(backend, field));
+    }
+    return errors;
+  }
+
+  /**
+   * The problems of one backend TLS setting; `field` names it in the messages. Mirrors
+   * `backend_tls_issues` in Rust.
+   */
+  private static getBackendTlsSettingErrors(settings: IRouteBackendTls, field: string): string[] {
+    const errors: string[] = [];
+    if (settings.ca !== undefined && settings.rejectUnauthorized === false) {
+      errors.push(
+        `${field}.ca conflicts with ${field}.rejectUnauthorized: false, which accepts any certificate; set one of them`,
+      );
+    }
+    if (settings.ca !== undefined && settings.ca.trim() === '') {
+      errors.push(`${field}.ca must contain PEM certificates`);
+    }
+    // The name the engine sends: trimmed, without trailing dots, lowercase
+    if (settings.serverName !== undefined && settings.serverName.trim().replace(/\.+$/, '') === '') {
+      errors.push(`${field}.serverName must not be empty`);
+    }
+    return errors;
+  }
+
+  /**
+   * Whether a target resolves its host or port through a function. The preprocessor
+   * hands such routes to the TypeScript relay.
+   */
+  private static hasDynamicTarget(route: IRouteConfig): boolean {
+    return (route.action?.targets ?? []).some(
+      (target) => typeof target.host === 'function' || typeof target.port === 'function',
+    );
+  }
+
+  /**
+   * The settings of a dynamic-target route that its relay cannot honour: it resolves one
+   * target per connection, connects without TLS or a PROXY header, and carries only TCP.
+   */
+  private static getDynamicTargetConflicts(route: IRouteConfig): Array<{ setting: string; reason: string }> {
+    const conflicts: Array<{ setting: string; reason: string }> = [];
+    const targets = route.action?.targets ?? [];
+    const noTargetSelection = 'the relay does not select between targets';
+    const noProxyProtocol = 'the relay sends no PROXY protocol header';
+    const noBackendTls = 'the relay connects to the target without TLS';
+    const onlyTcp = 'the relay carries only TCP connections';
+
+    if (targets.length > 1) {
+      conflicts.push({ setting: 'More than one target', reason: noTargetSelection });
+    }
+    if (route.action?.sendProxyProtocol) {
+      conflicts.push({ setting: 'action.sendProxyProtocol', reason: noProxyProtocol });
+    }
+    if (route.action?.tls?.mode === 'terminate-and-reencrypt') {
+      conflicts.push({ setting: 'action.tls.mode "terminate-and-reencrypt"', reason: noBackendTls });
+    }
+    if (route.action?.tls?.backend) {
+      conflicts.push({ setting: 'action.tls.backend', reason: noBackendTls });
+    }
+    targets.forEach((target, index) => {
+      if (target.match) {
+        conflicts.push({ setting: `action.targets[${index}].match`, reason: noTargetSelection });
+      }
+      if (target.sendProxyProtocol) {
+        conflicts.push({ setting: `action.targets[${index}].sendProxyProtocol`, reason: noProxyProtocol });
+      }
+      if (target.tls?.mode === 'terminate-and-reencrypt') {
+        conflicts.push({ setting: `action.targets[${index}].tls.mode "terminate-and-reencrypt"`, reason: noBackendTls });
+      }
+      if (target.tls?.backend) {
+        conflicts.push({ setting: `action.targets[${index}].tls.backend`, reason: noBackendTls });
+      }
+      if (target.backendTransport === 'udp') {
+        conflicts.push({ setting: `action.targets[${index}].backendTransport "udp"`, reason: onlyTcp });
+      }
+    });
+    if (route.match?.path) {
+      conflicts.push({ setting: 'match.path', reason: 'the relay forwards whole connections, not single requests' });
+    }
+    if (route.match?.headers) {
+      conflicts.push({ setting: 'match.headers', reason: 'the relay forwards whole connections, not single requests' });
+    }
+    const transport = route.match?.transport;
+    if (transport === 'udp' || transport === 'all') {
+      conflicts.push({ setting: `match.transport "${transport}"`, reason: onlyTcp });
+    }
+    return conflicts;
+  }
+
+  /**
+   * The settings of an nftables route that its kernel rules cannot honour: they forward each
+   * listed port to one IPv4 address and port before the proxy sees a packet.
+   */
+  private static getNftablesConflicts(route: IRouteConfig): Array<{ setting: string; reason: string }> {
+    const conflicts: Array<{ setting: string; reason: string }> = [];
+    const bypassed = 'the kernel forwards the packets before the proxy sees them';
+    const portOnly = 'the kernel rules match packets by port only';
+    const oneTarget = 'the kernel rules forward each port to one target';
+    const noProxyProtocol = 'the kernel rules send no PROXY protocol header';
+
+    for (const [key, value] of Object.entries(route.security ?? {})) {
+      if (value !== undefined) {
+        conflicts.push({ setting: `security.${key}`, reason: bypassed });
+      }
+    }
+    for (const key of ['domains', 'path', 'headers', 'clientIp', 'tlsVersion', 'protocol', 'inboundProxyProtocol'] as const) {
+      if (route.match?.[key] !== undefined) {
+        conflicts.push({ setting: `match.${key}`, reason: portOnly });
+      }
+    }
+    const ports = route.match?.ports;
+    for (const port of Array.isArray(ports) ? ports : [ports]) {
+      if (typeof port === 'object' && port !== null) {
+        conflicts.push({
+          setting: `The match.ports range ${port.from}-${port.to}`,
+          reason: 'the kernel rules forward single ports',
+        });
+      }
+    }
+    if (route.headers) {
+      conflicts.push({ setting: 'headers', reason: bypassed });
+    }
+    if (route.action?.tls && route.action.tls.mode !== 'passthrough') {
+      conflicts.push({ setting: `action.tls.mode "${route.action.tls.mode}"`, reason: bypassed });
+    }
+    if (route.action?.websocket) {
+      conflicts.push({ setting: 'action.websocket', reason: bypassed });
+    }
+    if (route.action?.advanced) {
+      conflicts.push({ setting: 'action.advanced', reason: bypassed });
+    }
+    if (route.action?.sendProxyProtocol) {
+      conflicts.push({ setting: 'action.sendProxyProtocol', reason: noProxyProtocol });
+    }
+
+    const targets = route.action?.targets ?? [];
+    if (targets.length > 1) {
+      conflicts.push({ setting: 'More than one target', reason: oneTarget });
+    }
+    targets.forEach((target, index) => {
+      const hosts = Array.isArray(target.host) ? target.host : [target.host];
+      if (hosts.length !== 1 || typeof hosts[0] !== 'string' || !plugins.net.isIPv4(hosts[0])) {
+        conflicts.push({
+          setting: `action.targets[${index}].host`,
+          reason: 'the kernel rules forward to one IPv4 address',
+        });
+      }
+      if (typeof target.port === 'function') {
+        conflicts.push({ setting: `action.targets[${index}].port`, reason: 'the kernel rules forward to a fixed port' });
+      }
+      if (target.match) {
+        conflicts.push({ setting: `action.targets[${index}].match`, reason: oneTarget });
+      }
+      if (target.tls && target.tls.mode !== 'passthrough') {
+        conflicts.push({ setting: `action.targets[${index}].tls.mode "${target.tls.mode}"`, reason: bypassed });
+      }
+      for (const key of ['websocket', 'headers', 'advanced'] as const) {
+        if (target[key]) {
+          conflicts.push({ setting: `action.targets[${index}].${key}`, reason: bypassed });
+        }
+      }
+      if (target.sendProxyProtocol) {
+        conflicts.push({ setting: `action.targets[${index}].sendProxyProtocol`, reason: noProxyProtocol });
+      }
+    });
+    return conflicts;
+  }
+
   /**
    * Label every route for validation reports: its name, else its id, else `route[<index>]`.
    * A name or id that several routes share gets `[<index>]` appended, so every label is unique.
@@ -363,14 +661,41 @@ export class RouteValidator {
   }
 
   /**
-   * Validate the IP entries of the settings outside routes: the global `trustedProxyIPs`, the
+   * Validate the settings outside routes: the IP entries of the global `trustedProxyIPs`, the
    * `defaults.security` lists the engine copies into routes without security, and the global
-   * `securityPolicy`. Answers every reason, empty when the settings are valid.
+   * `securityPolicy`; the per-IP limits `maxConnectionsPerIP` and `connectionRateLimitPerMinute`;
+   * and the default backend verification `backendTls`.
+   * Answers every reason, empty when the settings are valid.
    */
   public static validateSettings(
-    settings: Pick<ISmartProxyOptions, 'trustedProxyIPs' | 'defaults' | 'securityPolicy'>,
+    settings: Pick<
+      ISmartProxyOptions,
+      | 'trustedProxyIPs'
+      | 'defaults'
+      | 'securityPolicy'
+      | 'maxConnectionsPerIP'
+      | 'connectionRateLimitPerMinute'
+      | 'backendTls'
+    >,
   ): string[] {
     const errors: string[] = [];
+    // Mirrors `backend_tls_default_issues` in Rust
+    if (settings.backendTls) {
+      const backendTls: IRouteBackendTls = settings.backendTls;
+      errors.push(...this.getBackendTlsSettingErrors(backendTls, 'backendTls'));
+      if (backendTls.serverName !== undefined) {
+        errors.push('backendTls.serverName is not supported; set serverName in a route or target tls.backend');
+      }
+    }
+    // A per-IP limit is a positive integer, or `null` for no limit. 0 is refused rather than read
+    // as "no limit": it would otherwise silently mean the opposite of what it says.
+    for (const field of ['maxConnectionsPerIP', 'connectionRateLimitPerMinute'] as const) {
+      const value: unknown = settings[field];
+      if (value === undefined || value === null) continue;
+      if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
+        errors.push(`${field} must be a positive integer, or null for no per-IP limit (got ${String(value)})`);
+      }
+    }
     const checkList = (
       list: unknown,
       field: string,