修复了一些已知问题

backend/internal/kvm/kvm.go

@@ -432,7 +432,8 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 	}
 	ipv6List := configIPv6AssignmentAddresses(ipv6Assignments)
 	ipv4List := configIPv4AssignmentAddresses(publicIPv4s)
-	defaultHostIP := lxc.DefaultPortMappingHostIP(publicIPv4s)
+	// NAT4 port mappings should bind to the host IP, not the VM's independent public IPv4.
+	defaultHostIP := ""
 
 	var xml string
 	winAdminPassword := ""
@@ -1850,8 +1851,7 @@ func windowsIPv6PowerShell(ipv6s []string) string {
 	}
 	return strings.Join([]string{
 		"$clicdIPv6=@(" + strings.Join(quoted, ",") + ")",
-		"$iface=$null",
-		"for ($i=0; $i -lt 60 -and -not $iface; $i++) { $iface=Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.HardwareInterface } | Sort-Object ifIndex | Select-Object -First 1; if (-not $iface) { Start-Sleep -Seconds 5 } }",
+		// Reuse $iface already found by the main script
 		"if ($iface) {",
 		"  foreach ($ip in $clicdIPv6) {",
 		"    Get-NetIPAddress -InterfaceIndex $iface.ifIndex -AddressFamily IPv6 -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -eq $ip } | Remove-NetIPAddress -Confirm:$false -ErrorAction SilentlyContinue",
@@ -1875,8 +1875,7 @@ func windowsIPv4PowerShell(ipv4s []string) string {
 	}
 	return strings.Join([]string{
 		"$clicdIPv4=@(" + strings.Join(quoted, ",") + ")",
-		"$iface=$null",
-		"for ($i=0; $i -lt 60 -and -not $iface; $i++) { $iface=Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.HardwareInterface } | Sort-Object ifIndex | Select-Object -First 1; if (-not $iface) { Start-Sleep -Seconds 5 } }",
+		// Reuse $iface already found by the main script
 		"if ($iface) {",
 		"  foreach ($ip in $clicdIPv4) {",
 		"    Get-NetIPAddress -InterfaceIndex $iface.ifIndex -AddressFamily IPv4 -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -eq $ip } | Remove-NetIPAddress -Confirm:$false -ErrorAction SilentlyContinue",

backend/internal/lxc/lxc.go

@@ -345,12 +345,7 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 
 		// Setup default port mappings (SSH only)
 		portMappings = SetupDefaultPortMappings(sshPort)
-		defaultHostIP := defaultPortMappingHostIP(publicIPv4s)
-		if defaultHostIP != "" {
-			for i := range portMappings {
-				portMappings[i].HostIP = defaultHostIP
-			}
-		}
+		// NAT4 port mappings should bind to the host IP, not the container's independent public IPv4.
 		tempC := &config.Container{ID: id, PublicIPv4s: publicIPv4s, PortMappings: portMappings}
 
 		extraPorts := cfg.ExtraPorts
@@ -364,7 +359,7 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 			pm, err := normalizePortMapping(tempC, -1, config.PortMapping{
 				ContainerPort: containerPort,
 				HostPort:      containerPort,
-				HostIP:        defaultHostIP,
+				HostIP:        "",
 				Protocol:      "tcp",
 				Description:   fmt.Sprintf("Port-%d", containerPort),
 			})

backend/internal/lxc/portmap.go

@@ -59,9 +59,9 @@ func (m *Manager) ApplyPortMappings(id int) error {
 		}
 	}
 
-	// When container has public IPv4 but no port mappings (independent IP mode),
-	// ensure inbound DNAT for standard service ports (SSH / RDP).
-	if len(c.PortMappings) == 0 && len(c.PublicIPv4s) > 0 {
+	// When container has public IPv4, apply full port passthrough DNAT so the
+	// container owns all ports on its public IP (no NAT management needed).
+	if len(c.PublicIPv4s) > 0 {
 		ensureIndependentIPv4Ingress(c, tag)
 	}
 
@@ -75,40 +75,30 @@ func ensureIndependentIPv4Ingress(c *config.Container, tag string) {
 		return
 	}
 
-	type svcPort struct {
-		port     int
-		protocol string
-		desc     string
-	}
-	servicePorts := []svcPort{{port: 22, protocol: "tcp", desc: "SSH"}}
-	if strings.Contains(strings.ToLower(c.Template), "windows") {
-		servicePorts = []svcPort{{port: 3389, protocol: "tcp", desc: "RDP"}}
-	}
-
 	for _, assignment := range c.PublicIPv4s {
 		hostIP := strings.TrimSpace(assignment.Address)
 		if hostIP == "" {
 			continue
 		}
-		for _, svc := range servicePorts {
+		// Full port passthrough: DNAT all TCP+UDP traffic on this public IP to the container.
+		for _, proto := range []string{"tcp", "udp"} {
 			args := []string{
 				"-t", "nat",
 				"-I", "PREROUTING", "1",
 				"-d", hostIP,
-				"-p", svc.protocol,
-				"--dport", fmt.Sprintf("%d", svc.port),
+				"-p", proto,
 				"-j", "DNAT",
-				"--to-destination", fmt.Sprintf("%s:%d", c.IP, svc.port),
-				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-%s-%d", tag, natRuleIPTag(hostIP), svc.port),
+				"--to-destination", c.IP,
+				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-%s-all-%s", tag, natRuleIPTag(hostIP), proto),
 			}
 			cmd := exec.Command("iptables", args...)
 			output, err := cmd.CombinedOutput()
 			if err != nil {
-				fmt.Printf("Warning: failed to apply %s ingress %s:%d->%s:%d: %v, output: %s\n",
-					svc.desc, hostIP, svc.port, c.IP, svc.port, err, string(output))
+				fmt.Printf("Warning: failed to apply %s passthrough %s->%s: %v, output: %s\n",
+					proto, hostIP, c.IP, err, string(output))
 				continue
 			}
-			fmt.Printf("%s ingress: %s:%d -> %s:%d\n", svc.desc, hostIP, svc.port, c.IP, svc.port)
+			fmt.Printf("IPv4 passthrough (%s): %s -> %s (all ports)\n", proto, hostIP, c.IP)
 		}
 	}
 }

backend/internal/server/web/.gitkeep

@@ -0,0 +1 @@
+