From 2a9310e94781d53c90cd6386bae686bc578169eb Mon Sep 17 00:00:00 2001
From: Debian <linux@myhorse.netcell-it.de>
Date: Thu, 28 May 2026 16:51:07 +0200
Subject: [PATCH] =?UTF-8?q?fix(firewall):=20NAT-Regeln=20nach=20Priorit?=
 =?UTF-8?q?=C3=A4t=20sortieren=20+=20Port-Range-Validierung=20(v1.1.137)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- dataSource: data→sortedNAT — Up/Down-Pfeile zeigten auf falschen Nachbarn
- Form.Item dependencies: dportEnd/targetPortEnd validiert ≥ Start-Port
- Modal destroyOnHidden: Formular-State nach Schließen zurückgesetzt

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 VERSION                                       |  2 +-
 cmd/edgeguard-api/main.go                     |  2 +-
 cmd/edgeguard-ctl/main.go                     |  2 +-
 cmd/edgeguard-scheduler/main.go               |  2 +-
 management-ui/src/i18n/locales/de/common.json |  1 +
 management-ui/src/i18n/locales/en/common.json |  1 +
 management-ui/src/pages/Firewall/NATRules.tsx | 31 +++++++++++++++++--
 7 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/VERSION b/VERSION
index 5c7cd93..88cf65e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.136
+1.1.137
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index 1e6557e..46411b8 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.136"
+var version = "1.1.137"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index 79611be..846af3d 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.136"
+var version = "1.1.137"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index f1dca79..42f057c 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.136"
+var version = "1.1.137"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/management-ui/src/i18n/locales/de/common.json b/management-ui/src/i18n/locales/de/common.json
index 1ffd4d0..5ec5221 100644
--- a/management-ui/src/i18n/locales/de/common.json
+++ b/management-ui/src/i18n/locales/de/common.json
@@ -142,6 +142,7 @@
       "matchSrcCidr": "Source-CIDR (Match)", "matchDstCidr": "Dest-CIDR (Match)",
       "matchDstCidrHint": "leer = jede dest-IP (z.B. öffentliche IP der Box)",
       "dportStart": "Port (Start)", "dportEnd": "Port (Ende)",
+      "portRangeError": "End-Port muss ≥ Start-Port sein",
       "targetAddr": "Ziel-Adresse", "targetPortStart": "Ziel-Port (Start)", "targetPortEnd": "Ziel-Port (Ende)",
       "comment": "Kommentar",
       "add": "NAT-Regel hinzufügen", "edit": "NAT-Regel bearbeiten",
diff --git a/management-ui/src/i18n/locales/en/common.json b/management-ui/src/i18n/locales/en/common.json
index 169b15b..471f6ac 100644
--- a/management-ui/src/i18n/locales/en/common.json
+++ b/management-ui/src/i18n/locales/en/common.json
@@ -142,6 +142,7 @@
       "matchSrcCidr": "Source CIDR (match)", "matchDstCidr": "Dest. CIDR (match)",
       "matchDstCidrHint": "empty = any dest IP (e.g. box's public IP)",
       "dportStart": "Port (start)", "dportEnd": "Port (end)",
+      "portRangeError": "End port must be ≥ start port",
       "targetAddr": "Target address", "targetPortStart": "Target port (start)", "targetPortEnd": "Target port (end)",
       "comment": "Comment",
       "add": "Add NAT rule", "edit": "Edit NAT rule",
diff --git a/management-ui/src/pages/Firewall/NATRules.tsx b/management-ui/src/pages/Firewall/NATRules.tsx
index 03a0956..28f71fe 100644
--- a/management-ui/src/pages/Firewall/NATRules.tsx
+++ b/management-ui/src/pages/Firewall/NATRules.tsx
@@ -216,7 +216,7 @@ export default function NATRulesTab() {
       <DataTable
         rowKey="id"
         loading={isLoading}
-        dataSource={data ?? []}
+        dataSource={sortedNAT}
         columns={columns}
         emptyContent={
           <EmptyState
@@ -237,6 +237,7 @@ export default function NATRulesTab() {
         onCancel={() => { setEditing(null); setCreating(false) }}
         onOk={() => { void form.submit() }}
         confirmLoading={create.isPending || update.isPending}
+        destroyOnHidden
         width={560}
       >
         <Form
@@ -289,7 +290,19 @@ export default function NATRulesTab() {
                         <Form.Item label={t('fw.nat.dportStart')} name="match_dport_start" rules={[{ required: true }]}>
                           <InputNumber min={1} max={65535} />
                         </Form.Item>
-                        <Form.Item label={t('fw.nat.dportEnd')} name="match_dport_end">
+                        <Form.Item
+                          label={t('fw.nat.dportEnd')}
+                          name="match_dport_end"
+                          dependencies={['match_dport_start']}
+                          rules={[({ getFieldValue }) => ({
+                            validator(_, val) {
+                              if (!val) return Promise.resolve()
+                              return val >= getFieldValue('match_dport_start')
+                                ? Promise.resolve()
+                                : Promise.reject(new Error(t('fw.nat.portRangeError')))
+                            },
+                          })]}
+                        >
                           <InputNumber min={1} max={65535} />
                         </Form.Item>
                       </Space>
@@ -305,7 +318,19 @@ export default function NATRulesTab() {
                           <Form.Item label={t('fw.nat.targetPortStart')} name="target_port_start">
                             <InputNumber min={1} max={65535} />
                           </Form.Item>
-                          <Form.Item label={t('fw.nat.targetPortEnd')} name="target_port_end">
+                          <Form.Item
+                            label={t('fw.nat.targetPortEnd')}
+                            name="target_port_end"
+                            dependencies={['target_port_start']}
+                            rules={[({ getFieldValue }) => ({
+                              validator(_, val) {
+                                if (!val) return Promise.resolve()
+                                return val >= getFieldValue('target_port_start')
+                                  ? Promise.resolve()
+                                  : Promise.reject(new Error(t('fw.nat.portRangeError')))
+                              },
+                            })]}
+                          >
                             <InputNumber min={1} max={65535} />
                           </Form.Item>
                         </Space>