package firewall

import (
	"strings"
	"testing"
)

func TestSaveDNATRequiresDstnatChain(t *testing.T) {
	m := &FirewallManager{}
	for _, chain := range []string{"srcnat", "custom", "output"} {
		err := m.SaveNATRule(NATRule{Chain: chain, Action: "dst-nat"})
		if err == nil || !strings.Contains(err.Error(), "dstnat chain") {
			t.Fatalf("chain %s: expected dstnat error, got %v", chain, err)
		}
		if len(m.natRules) != 0 {
			t.Fatal("rejected rule was saved")
		}
	}
}