Rules read as a direction

A match's zones are written "lan → wan" (or "any but wan → any", and
"lan → firewall" / "firewall → wan" in the input and output chains)
instead of "in lan · out wan" and "in not wan"; exclusions read "from
any but X". The Rules and NAT pages and hc; flags and JSON unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/widgets.js

@@ -98,11 +98,16 @@ export function matchEditor(m, n, opts = {}) {
 // describe sums up a match: "in lan · from trusted · ssh, dns".
 export function describe(m) {
   const parts = [];
-  const side = (word, not, list) => { if (list && list.length) parts.push(word + (not ? " not " : " ") + list.join(", ")); };
-  side("in", m.not_in, m.in_zones);
-  side("out", m.not_out, m.out_zones);
-  side("from", m.not_sources, m.sources);
-  side("to", m.not_destinations, m.destinations);
+  const list = (not, xs) => (not ? "any but " : "") + xs.join(", ");
+  // Zones are a direction, "lan → wan"; the firewall itself is the other
+  // end of the input and output chains.
+  const ins = m.in_zones || [], outs = m.out_zones || [];
+  if (ins.length || outs.length) {
+    parts.push((m.chain === "output" ? "firewall" : ins.length ? list(m.not_in, ins) : "any") + " → " +
+      (m.chain === "input" ? "firewall" : outs.length ? list(m.not_out, outs) : "any"));
+  }
+  if (m.sources && m.sources.length) parts.push("from " + list(m.not_sources, m.sources));
+  if (m.destinations && m.destinations.length) parts.push("to " + list(m.not_destinations, m.destinations));
   if (m.services && m.services.length) parts.push(m.services.join(", "));
   if (m.family) parts.push(m.family + " only");
   return parts.length ? parts.join(" · ") : "everything";