修复了一些已知问题

backend/internal/lxc/portmap.go

@@ -59,11 +59,60 @@ func (m *Manager) ApplyPortMappings(id int) error {
 		}
 	}
 
+	// When container has public IPv4 but no port mappings (independent IP mode),
+	// ensure inbound DNAT for standard service ports (SSH / RDP).
+	if len(c.PortMappings) == 0 && len(c.PublicIPv4s) > 0 {
+		ensureIndependentIPv4Ingress(c, tag)
+	}
+
 	applyIPv4EgressPolicy(c, bridge, subnet, tag)
 
 	return nil
 }
 
+func ensureIndependentIPv4Ingress(c *config.Container, tag string) {
+	if c == nil || c.IP == "" || len(c.PublicIPv4s) == 0 {
+		return
+	}
+
+	type svcPort struct {
+		port     int
+		protocol string
+		desc     string
+	}
+	servicePorts := []svcPort{{port: 22, protocol: "tcp", desc: "SSH"}}
+	if strings.Contains(strings.ToLower(c.Template), "windows") {
+		servicePorts = []svcPort{{port: 3389, protocol: "tcp", desc: "RDP"}}
+	}
+
+	for _, assignment := range c.PublicIPv4s {
+		hostIP := strings.TrimSpace(assignment.Address)
+		if hostIP == "" {
+			continue
+		}
+		for _, svc := range servicePorts {
+			args := []string{
+				"-t", "nat",
+				"-I", "PREROUTING", "1",
+				"-d", hostIP,
+				"-p", svc.protocol,
+				"--dport", fmt.Sprintf("%d", svc.port),
+				"-j", "DNAT",
+				"--to-destination", fmt.Sprintf("%s:%d", c.IP, svc.port),
+				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-%s-%d", tag, natRuleIPTag(hostIP), svc.port),
+			}
+			cmd := exec.Command("iptables", args...)
+			output, err := cmd.CombinedOutput()
+			if err != nil {
+				fmt.Printf("Warning: failed to apply %s ingress %s:%d->%s:%d: %v, output: %s\n",
+					svc.desc, hostIP, svc.port, c.IP, svc.port, err, string(output))
+				continue
+			}
+			fmt.Printf("%s ingress: %s:%d -> %s:%d\n", svc.desc, hostIP, svc.port, c.IP, svc.port)
+		}
+	}
+}
+
 func applyIPv4EgressPolicy(c *config.Container, bridge, subnet, tag string) {
 	if c == nil || strings.TrimSpace(c.IP) == "" {
 		return