Inbound SMTP is being blocked by "default deny / state violation rule

[Jyling]

Upgraded to 25.7.6 and all inbound connections stopped. Checked live log, and lo and behold, all SMTP connections are being blocked.
Needless to say that I have a first-match allow rule on the WAN interface, for the ports 25, 465, and 587. What the?

[Jyling]

Figures, the reason was that during the upgrade, the restored config put all of the NAT rules on the phantom opt1 interface, instead of the WAN. I wonder if it's the correct/necessary behavior.