From d90396c8eacb30640c092c3b39c20a4edccd30a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=80=97=E5=AD=90?= <haozi@loli.email>
Date: Sat, 14 Jun 2025 18:00:28 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=87=BA=E7=AB=99=E8=A7=84=E5=88=99?=
 =?UTF-8?q?=E4=B8=8B=EF=BC=8C=E5=BF=85=E9=A1=BB=E6=8C=87=E5=AE=9A=E5=85=B7?=
 =?UTF-8?q?=E4=BD=93=E7=9A=84=E5=9C=B0=E5=9D=80=EF=BC=8C=E5=90=A6=E5=88=99?=
 =?UTF-8?q?=E4=BC=9A=E6=B7=BB=E5=8A=A0=E6=88=90=E5=85=A5=E7=AB=99=E8=A7=84?=
 =?UTF-8?q?=E5=88=99=EF=BC=8Cclose=20#822?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkg/firewall/firewall.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkg/firewall/firewall.go b/pkg/firewall/firewall.go
index 829d9f79..0d56006d 100644
--- a/pkg/firewall/firewall.go
+++ b/pkg/firewall/firewall.go
@@ -207,6 +207,11 @@ func (r *Firewall) Port(rule FireInfo, operation Operation) error {
 }
 
 func (r *Firewall) RichRules(rule FireInfo, operation Operation) error {
+	// 出站规则下，必须指定具体的地址，否则会添加成入站规则
+	if rule.Direction == "out" && rule.Address == "" {
+		return fmt.Errorf("outbound rules must specify an address")
+	}
+
 	protocols := strings.Split(string(rule.Protocol), "/")
 	for protocol := range slices.Values(protocols) {
 		var ruleBuilder strings.Builder