fix: re-assign port automatically if out of range for new tunnel entries (fixes #373)

go-backend/internal/http/handler/mutations.go

@@ -1107,6 +1107,15 @@ func (h *Handler) syncTunnelForwardsEntryPorts(tunnelID int64, entryNodeIDs []in
 			continue
 		}
 
+		// If the existing port is outside any entry node's allowed range,
+		// pick a new random port that satisfies all entry nodes.
+		if !h.isPortValidForAllEntryNodes(port, entryNodeIDs) {
+			newPort := h.pickTunnelPort(tunnelID)
+			if newPort > 0 {
+				port = newPort
+			}
+		}
+
 		var entries []forwardPortReplaceEntry
 		if allowInIP {
 			entries = buildForwardPortEntriesWithPreservedInIP(entryNodeIDs, oldPorts, port)
@@ -1120,6 +1129,25 @@ func (h *Handler) syncTunnelForwardsEntryPorts(tunnelID int64, entryNodeIDs []in
 	}
 }
 
+func (h *Handler) isPortValidForAllEntryNodes(port int, entryNodeIDs []int64) bool {
+	if port <= 0 {
+		return false
+	}
+	for _, nodeID := range entryNodeIDs {
+		node, err := h.getNodeRecord(nodeID)
+		if err != nil {
+			continue
+		}
+		if validateLocalNodePort(node, port) != nil {
+			return false
+		}
+		if validateRemoteNodePort(node, port) != nil {
+			return false
+		}
+	}
+	return true
+}
+
 func (h *Handler) tunnelDelete(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		response.WriteJSON(w, response.ErrDefault("请求失败"))