修复了一些已知问题

backend/internal/api/firewall.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"math/rand"
 	"net/http"
+	"net/netip"
 	"strconv"
 	"strings"
 
@@ -29,8 +30,9 @@ func getFirewall(w http.ResponseWriter, r *http.Request, id int) {
 	jsonResponse(w, http.StatusOK, APIResponse{
 		Success: true,
 		Data: map[string]interface{}{
-			"enabled": c.FirewallEnabled,
-			"rules":   c.FirewallRules,
+			"enabled":        c.FirewallEnabled,
+			"default_action": normalizeFirewallDefaultAction(c.FirewallDefaultAction),
+			"rules":          c.FirewallRules,
 		},
 	})
 }
@@ -43,17 +45,32 @@ func updateFirewall(w http.ResponseWriter, r *http.Request, id int) {
 	}
 
 	var req struct {
-		Enabled *bool               `json:"enabled"`
-		Rules   *[]config.FirewallRule `json:"rules"`
+		Enabled       *bool                  `json:"enabled"`
+		DefaultAction *string                `json:"default_action"`
+		Rules         *[]config.FirewallRule `json:"rules"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
 		return
 	}
 
+	oldEnabled := c.FirewallEnabled
+	oldDefaultAction := c.FirewallDefaultAction
+	oldRules := append([]config.FirewallRule(nil), c.FirewallRules...)
+
 	if req.Enabled != nil {
 		c.FirewallEnabled = *req.Enabled
 	}
+	if req.DefaultAction != nil {
+		action := normalizeFirewallDefaultAction(*req.DefaultAction)
+		if action == "" {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid default action"})
+			return
+		}
+		c.FirewallDefaultAction = action
+	} else if strings.TrimSpace(c.FirewallDefaultAction) == "" {
+		c.FirewallDefaultAction = "DROP"
+	}
 	if req.Rules != nil {
 		// Validate and assign IDs to new rules
 		rules := *req.Rules
@@ -61,9 +78,14 @@ func updateFirewall(w http.ResponseWriter, r *http.Request, id int) {
 			rules[i].Direction = strings.ToLower(strings.TrimSpace(rules[i].Direction))
 			rules[i].Protocol = strings.ToLower(strings.TrimSpace(rules[i].Protocol))
 			rules[i].Action = strings.ToUpper(strings.TrimSpace(rules[i].Action))
+			rules[i].Network = normalizeFirewallNetwork(rules[i].Network)
 			rules[i].SourceIP = strings.TrimSpace(rules[i].SourceIP)
 			rules[i].Port = strings.TrimSpace(rules[i].Port)
 
+			if rules[i].Network == "" {
+				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid network"})
+				return
+			}
 			if rules[i].Direction != "in" && rules[i].Direction != "out" {
 				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid direction: " + rules[i].Direction})
 				return
@@ -76,11 +98,21 @@ func updateFirewall(w http.ResponseWriter, r *http.Request, id int) {
 				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid action: " + rules[i].Action})
 				return
 			}
-			if rules[i].ID == "" {
+			if rules[i].SourceIP != "" {
+				if err := validateFirewallIPSpec(rules[i].SourceIP, rules[i].Network); err != nil {
+					jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid IP: " + err.Error()})
+					return
+				}
+			}
+			if rules[i].ID == "" || strings.HasPrefix(rules[i].ID, "tmp-") {
 				rules[i].ID = generateFirewallRuleID()
 			}
 			// Validate port spec
 			if rules[i].Port != "" {
+				if rules[i].Protocol != "tcp" && rules[i].Protocol != "udp" {
+					jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Ports are only supported for TCP and UDP rules"})
+					return
+				}
 				if err := validatePortSpec(rules[i].Port); err != nil {
 					jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid port: " + err.Error()})
 					return
@@ -90,11 +122,14 @@ func updateFirewall(w http.ResponseWriter, r *http.Request, id int) {
 		c.FirewallRules = rules
 	}
 
-	config.SaveConfig()
-
 	// Apply firewall rules to iptables if container is running
 	if c.Status == "running" {
 		if err := lxc.ApplyFirewallRules(id); err != nil {
+			c.FirewallEnabled = oldEnabled
+			c.FirewallDefaultAction = oldDefaultAction
+			c.FirewallRules = oldRules
+			_ = lxc.ApplyFirewallRules(id)
+			config.SaveConfig()
 			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to apply firewall rules: " + err.Error()})
 			return
 		}
@@ -102,28 +137,54 @@ func updateFirewall(w http.ResponseWriter, r *http.Request, id int) {
 		// If disabled and not running, clean any lingering rules
 		lxc.CleanFirewallRules(id)
 	}
+	config.SaveConfig()
 
 	jsonResponse(w, http.StatusOK, APIResponse{
 		Success: true,
 		Message: "Firewall updated",
 		Data: map[string]interface{}{
-			"enabled": c.FirewallEnabled,
-			"rules":   c.FirewallRules,
+			"enabled":        c.FirewallEnabled,
+			"default_action": normalizeFirewallDefaultAction(c.FirewallDefaultAction),
+			"rules":          c.FirewallRules,
 		},
 	})
 }
 
+func normalizeFirewallDefaultAction(action string) string {
+	action = strings.ToUpper(strings.TrimSpace(action))
+	if action == "ACCEPT" || action == "DROP" {
+		return action
+	}
+	return ""
+}
+
+func normalizeFirewallNetwork(network string) string {
+	network = strings.ToLower(strings.TrimSpace(network))
+	switch network {
+	case "", "ipv4", "nat4":
+		return "ipv4"
+	case "ipv6":
+		return "ipv6"
+	case "all", "both":
+		return "all"
+	default:
+		return ""
+	}
+}
+
 func validatePortSpec(port string) error {
 	port = strings.TrimSpace(port)
 	if port == "" {
 		return nil
 	}
 	// Support: "22", "80,443", "8000-9000", "80,443,8000-9000"
+	partCount := 0
 	for _, part := range strings.Split(port, ",") {
 		part = strings.TrimSpace(part)
 		if part == "" {
-			continue
+			return &portValidationError{port}
 		}
+		partCount++
 		if strings.Contains(part, "-") {
 			// Range
 			bounds := strings.SplitN(part, "-", 2)
@@ -135,6 +196,9 @@ func validatePortSpec(port string) error {
 			if err != nil || hi < 1 || hi > 65535 {
 				return &portValidationError{part}
 			}
+			if hi < lo {
+				return &portValidationError{part}
+			}
 		} else {
 			p, err := strconv.Atoi(part)
 			if err != nil || p < 1 || p > 65535 {
@@ -142,9 +206,48 @@ func validatePortSpec(port string) error {
 			}
 		}
 	}
+	if partCount > 15 {
+		return &portValidationError{"too many ports; maximum 15 items per rule"}
+	}
 	return nil
 }
 
+func validateFirewallIPSpec(value string, network string) error {
+	var addr netip.Addr
+	if strings.Contains(value, "/") {
+		prefix, err := netip.ParsePrefix(value)
+		if err != nil {
+			return err
+		}
+		addr = prefix.Addr()
+	} else {
+		parsed, err := netip.ParseAddr(value)
+		if err != nil {
+			return err
+		}
+		addr = parsed
+	}
+	switch network {
+	case "ipv4":
+		if !addr.Is4() {
+			return &ipValidationError{"IPv4 rule requires an IPv4 address or CIDR: " + value}
+		}
+	case "ipv6":
+		if !addr.Is6() || addr.Is4In6() {
+			return &ipValidationError{"IPv6 rule requires an IPv6 address or CIDR: " + value}
+		}
+	}
+	return nil
+}
+
+type ipValidationError struct {
+	value string
+}
+
+func (e *ipValidationError) Error() string {
+	return e.value
+}
+
 type portValidationError struct {
 	port string
 }

backend/internal/config/config.go

@@ -24,11 +24,12 @@ type PortMapping struct {
 
 type FirewallRule struct {
 	ID          string `json:"id"`
-	Direction   string `json:"direction"`   // "in" or "out"
-	Protocol    string `json:"protocol"`    // "tcp", "udp", "icmp", "all"
-	Port        string `json:"port"`        // "" = all, "22", "80,443", "8000-9000"
-	SourceIP    string `json:"source_ip"`   // "" = any
-	Action      string `json:"action"`      // "ACCEPT" or "DROP"
+	Network     string `json:"network,omitempty"` // "ipv4", "ipv6", or "all"; empty defaults to "ipv4"
+	Direction   string `json:"direction"`         // "in" or "out"
+	Protocol    string `json:"protocol"`          // "tcp", "udp", "icmp", "all"
+	Port        string `json:"port"`              // "" = all, "22", "80,443", "8000-9000"
+	SourceIP    string `json:"source_ip"`         // "" = any
+	Action      string `json:"action"`            // "ACCEPT" or "DROP"
 	Description string `json:"description"`
 	Enabled     bool   `json:"enabled"`
 }
@@ -136,7 +137,8 @@ type Container struct {
 	PortMappings                  []PortMapping          `json:"port_mappings"`
 	PortMappingLimit              int                    `json:"port_mapping_limit"`
 	FirewallEnabled               bool                   `json:"firewall_enabled"`
-	FirewallRules                 []FirewallRule          `json:"firewall_rules"`
+	FirewallDefaultAction         string                 `json:"firewall_default_action"`
+	FirewallRules                 []FirewallRule         `json:"firewall_rules"`
 	SnapshotLimit                 int                    `json:"snapshot_limit"`
 	CreatedAt                     string                 `json:"created_at"`
 	ExpiresAt                     string                 `json:"expires_at"`

backend/internal/config/store_sqlite.go

@@ -365,6 +365,7 @@ func ensureSchemaMigrations() error {
 		{"container_public_ipv4s", "prefix_len", "INTEGER"},
 		{"container_public_ipv4s", "gateway", "TEXT"},
 		{"containers", "firewall_enabled", "INTEGER NOT NULL DEFAULT 0"},
+		{"containers", "firewall_default_action", "TEXT NOT NULL DEFAULT 'DROP'"},
 		{"containers", "firewall_rules", "TEXT"},
 	} {
 		if err := ensureColumn(column.table, column.name, column.def); err != nil {
@@ -586,8 +587,8 @@ func saveContainers(tx *sql.Tx) error {
 			snapshot_schedule_enabled, snapshot_schedule_interval_hours, snapshot_schedule_time,
 			snapshot_schedule_last_run, snapshot_schedule_next_run, snapshot_schedule_created_by,
 			policy_blocked, policy_blocked_reason, policy_blocked_at,
-			firewall_enabled, firewall_rules
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+			firewall_enabled, firewall_default_action, firewall_rules
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 			c.ID, c.UUID, c.Name, c.Virtualization, c.LXCName, c.KVMName, c.DiskImage, c.MACAddress, c.Template,
 			c.VCPU, c.RAMMB, c.DiskGB, c.NetworkBWMbps, c.MonthlyTrafficGB, c.TrafficMode, c.TrafficInGB,
 			c.TrafficOutGB, c.TrafficUsedRX, c.TrafficUsedTX, c.TrafficResetDate, c.IOSpeedMBps,
@@ -596,7 +597,7 @@ func saveContainers(tx *sql.Tx) error {
 			boolInt(c.SnapshotScheduleEnabled), c.SnapshotScheduleIntervalHours, c.SnapshotScheduleTime,
 			c.SnapshotScheduleLastRun, c.SnapshotScheduleNextRun, c.SnapshotScheduleCreatedBy,
 			boolInt(c.PolicyBlocked), c.PolicyBlockedReason, c.PolicyBlockedAt,
-			boolInt(c.FirewallEnabled), marshalFirewallRules(c.FirewallRules),
+			boolInt(c.FirewallEnabled), normalizeFirewallDefaultAction(c.FirewallDefaultAction), marshalFirewallRules(c.FirewallRules),
 		); err != nil {
 			return err
 		}
@@ -794,7 +795,7 @@ func loadContainers() ([]Container, error) {
 		snapshot_schedule_enabled, snapshot_schedule_interval_hours, snapshot_schedule_time,
 		snapshot_schedule_last_run, snapshot_schedule_next_run, snapshot_schedule_created_by,
 		policy_blocked, policy_blocked_reason, policy_blocked_at,
-		firewall_enabled, firewall_rules
+		firewall_enabled, firewall_default_action, firewall_rules
 		FROM containers ORDER BY id`)
 	if err != nil {
 		return nil, err
@@ -805,6 +806,7 @@ func loadContainers() ([]Container, error) {
 	for rows.Next() {
 		var c Container
 		var scheduleEnabled, policyBlocked, firewallEnabled int
+		var firewallDefaultAction string
 		var firewallRulesJSON sql.NullString
 		if err := rows.Scan(
 			&c.ID, &c.UUID, &c.Name, &c.Virtualization, &c.LXCName, &c.KVMName, &c.DiskImage, &c.MACAddress, &c.Template,
@@ -815,13 +817,14 @@ func loadContainers() ([]Container, error) {
 			&scheduleEnabled, &c.SnapshotScheduleIntervalHours, &c.SnapshotScheduleTime,
 			&c.SnapshotScheduleLastRun, &c.SnapshotScheduleNextRun, &c.SnapshotScheduleCreatedBy,
 			&policyBlocked, &c.PolicyBlockedReason, &c.PolicyBlockedAt,
-			&firewallEnabled, &firewallRulesJSON,
+			&firewallEnabled, &firewallDefaultAction, &firewallRulesJSON,
 		); err != nil {
 			return nil, err
 		}
 		c.SnapshotScheduleEnabled = scheduleEnabled != 0
 		c.PolicyBlocked = policyBlocked != 0
 		c.FirewallEnabled = firewallEnabled != 0
+		c.FirewallDefaultAction = normalizeFirewallDefaultAction(firewallDefaultAction)
 		if firewallRulesJSON.Valid && strings.TrimSpace(firewallRulesJSON.String) != "" {
 			_ = json.Unmarshal([]byte(firewallRulesJSON.String), &c.FirewallRules)
 		}
@@ -1189,6 +1192,14 @@ func marshalFirewallRules(rules []FirewallRule) interface{} {
 	return string(data)
 }
 
+func normalizeFirewallDefaultAction(action string) string {
+	action = strings.ToUpper(strings.TrimSpace(action))
+	if action == "ACCEPT" {
+		return "ACCEPT"
+	}
+	return "DROP"
+}
+
 func boolPtrInt(value *bool) interface{} {
 	if value == nil {
 		return nil

backend/internal/kvm/kvm.go

@@ -3231,6 +3231,11 @@ func (m *Manager) applyIPv6Runtime(c *config.Container) error {
 		}
 		ensureKVMIPv6NAT66(assignment.Address, uplink)
 	}
+	if c.Status == "running" {
+		if err := lxc.ApplyFirewallRules(c.ID); err != nil {
+			fmt.Printf("Warning: failed to re-apply firewall rules after KVM IPv6 setup for %s: %v\n", c.Name, err)
+		}
+	}
 	return nil
 }
 
@@ -3307,7 +3312,7 @@ func ensureKVMIPv6ForwardRules(ipv6 string, bridge string) {
 	}
 	for _, rule := range rules {
 		check := append([]string{"-C"}, rule...)
-		add := append([]string{"-I"}, append([]string{rule[0], "1"}, rule[1:]...)...)
+		add := append([]string{"-A"}, rule...)
 		if exec.Command("ip6tables", check...).Run() != nil {
 			exec.Command("ip6tables", add...).Run()
 		}

backend/internal/lxc/ipv6.go

@@ -1610,6 +1610,9 @@ func (m *Manager) ApplyIPv6(id int) error {
 			ensureIPv6NAT66(assignment.Address, uplink)
 		}
 	}
+	if err := ApplyFirewallRules(c.ID); err != nil {
+		fmt.Printf("Warning: failed to re-apply firewall rules after IPv6 setup for %s: %v\n", c.Name, err)
+	}
 	return nil
 }
 

backend/internal/lxc/portmap.go

@@ -67,6 +67,10 @@ func (m *Manager) ApplyPortMappings(id int) error {
 
 	applyIPv4EgressPolicy(c, bridge, subnet, tag)
 
+	if err := ApplyFirewallRules(id); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -260,8 +264,8 @@ func EnsureForwardRules(bridge string) {
 				break
 			}
 		}
-		insertArgs := append([]string{"-I", "FORWARD", "1"}, args...)
-		exec.Command("iptables", insertArgs...).Run()
+		appendArgs := append([]string{"-A", "FORWARD"}, args...)
+		exec.Command("iptables", appendArgs...).Run()
 	}
 }
 
@@ -576,6 +580,9 @@ func CleanFirewallRules(id int) {
 	cmd := exec.Command("bash", "-c",
 		fmt.Sprintf("iptables -S FORWARD 2>/dev/null | grep 'clicd-%s-fw-' | sed 's/^-A /-D /' | while read rule; do iptables $rule; done", tag))
 	cmd.CombinedOutput()
+	cmd = exec.Command("bash", "-c",
+		fmt.Sprintf("ip6tables -S FORWARD 2>/dev/null | grep 'clicd-%s-fw-' | sed 's/^-A /-D /' | while read rule; do ip6tables $rule; done", tag))
+	cmd.CombinedOutput()
 
 	// Also remove legacy default policy rules (without specific rule ID)
 	for _, suffix := range []string{"default-in", "default-out"} {
@@ -584,6 +591,9 @@ func CleanFirewallRules(id int) {
 				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-%s-%s", tag, suffix, proto),
 			).CombinedOutput()
 		}
+		exec.Command("ip6tables", "-D", "FORWARD",
+			"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-%s", tag, suffix),
+		).CombinedOutput()
 	}
 }
 
@@ -606,42 +616,140 @@ func ApplyFirewallRules(id int) error {
 	if c.IsKVM() {
 		bridge = "virbr0"
 	}
-	containerIP := c.IP
-	if containerIP == "" {
+	containerIP := strings.TrimSpace(c.IP)
+	containerIPv6s := firewallIPv6Addresses(c)
+	if containerIP == "" && len(containerIPv6s) == 0 {
 		return nil
 	}
 	tag := clicdTag(id)
 
-	// Apply default DROP policy first (inserted at position 1).
-	// Then insert ACCEPT rules (also at position 1), which pushes the DROPs down.
-	// Final order: ACCEPT rules on top, DROP defaults below, bridge ACCEPT rules at the bottom.
-	applyDefaultFirewallPolicy(tag, bridge, containerIP)
+	defaultAction := normalizeFirewallDefaultAction(c.FirewallDefaultAction)
+	if defaultAction == "DROP" {
+		if containerIP != "" {
+			if err := applyDefaultFirewallPolicy(tag, bridge, containerIP); err != nil {
+				return err
+			}
+		}
+		if err := applyDefaultFirewallIPv6Policy(tag, bridge, containerIPv6s); err != nil {
+			return err
+		}
+	}
 
-	for _, rule := range c.FirewallRules {
+	for i := len(c.FirewallRules) - 1; i >= 0; i-- {
+		rule := c.FirewallRules[i]
 		if !rule.Enabled {
 			continue
 		}
-		if err := applyOneFirewallRule(tag, bridge, containerIP, rule); err != nil {
-			fmt.Printf("Warning: failed to apply firewall rule %s for container %d: %v\n", rule.ID, id, err)
+		if containerIP != "" && firewallRuleAppliesToFamily(rule, true) {
+			if err := applyOneFirewallRule(tag, bridge, containerIP, rule); err != nil {
+				return fmt.Errorf("failed to apply firewall rule %s for container %d: %w", rule.ID, id, err)
+			}
+		}
+		if len(containerIPv6s) > 0 && firewallRuleAppliesToFamily(rule, false) {
+			if err := applyOneFirewallIPv6Rule(tag, bridge, containerIPv6s, rule); err != nil {
+				return fmt.Errorf("failed to apply IPv6 firewall rule %s for container %d: %w", rule.ID, id, err)
+			}
 		}
 	}
 
 	return nil
 }
 
+func normalizeFirewallDefaultAction(action string) string {
+	action = strings.ToUpper(strings.TrimSpace(action))
+	if action == "ACCEPT" {
+		return "ACCEPT"
+	}
+	return "DROP"
+}
+
+func normalizeFirewallNetwork(network string) string {
+	network = strings.ToLower(strings.TrimSpace(network))
+	switch network {
+	case "", "ipv4", "nat4":
+		return "ipv4"
+	case "ipv6":
+		return "ipv6"
+	case "all", "both":
+		return "all"
+	default:
+		return "ipv4"
+	}
+}
+
+func firewallRuleAppliesToFamily(rule config.FirewallRule, ipv4 bool) bool {
+	network := normalizeFirewallNetwork(rule.Network)
+	if network == "ipv4" {
+		return ipv4
+	}
+	if network == "ipv6" {
+		return !ipv4
+	}
+	if rule.SourceIP == "" {
+		return true
+	}
+	addr := firewallIPSpecAddr(rule.SourceIP)
+	if !addr.IsValid() {
+		return true
+	}
+	if ipv4 {
+		return addr.Is4()
+	}
+	return addr.Is6() && !addr.Is4In6()
+}
+
+func firewallIPSpecAddr(value string) netip.Addr {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return netip.Addr{}
+	}
+	if strings.Contains(value, "/") {
+		prefix, err := netip.ParsePrefix(value)
+		if err != nil {
+			return netip.Addr{}
+		}
+		return prefix.Addr()
+	}
+	addr, err := netip.ParseAddr(value)
+	if err != nil {
+		return netip.Addr{}
+	}
+	return addr
+}
+
+func firewallIPv6Addresses(c *config.Container) []string {
+	if c == nil {
+		return nil
+	}
+	c.NormalizeNetworkAssignments()
+	seen := map[string]bool{}
+	result := []string{}
+	for _, assignment := range c.IPv6Addresses {
+		ip := strings.TrimSpace(assignment.Address)
+		if ip == "" || seen[ip] {
+			continue
+		}
+		if addr, err := netip.ParseAddr(ip); err == nil && addr.Is6() && !addr.Is4In6() {
+			seen[ip] = true
+			result = append(result, ip)
+		}
+	}
+	return result
+}
+
 func applyOneFirewallRule(tag, bridge, containerIP string, rule config.FirewallRule) error {
 	commentTag := fmt.Sprintf("clicd-%s-fw-%s", tag, rule.ID)
 
 	// Build base iptables args
 	args := []string{"-I", "FORWARD", "1"}
 
-	// Direction: in = traffic arriving at container (-i bridge -d containerIP)
-	//            out = traffic leaving container (-o bridge -s containerIP)
+	// Direction: in = traffic arriving at container (-o bridge -d containerIP)
+	//            out = traffic leaving container (-i bridge -s containerIP)
 	switch rule.Direction {
 	case "in":
-		args = append(args, "-i", bridge, "-d", containerIP+"/32")
+		args = append(args, "-o", bridge, "-d", containerIP+"/32")
 	case "out":
-		args = append(args, "-o", bridge, "-s", containerIP+"/32")
+		args = append(args, "-i", bridge, "-s", containerIP+"/32")
 	default:
 		return fmt.Errorf("invalid direction: %s", rule.Direction)
 	}
@@ -662,7 +770,7 @@ func applyOneFirewallRule(tag, bridge, containerIP string, rule config.FirewallR
 	if rule.Port != "" && (rule.Protocol == "tcp" || rule.Protocol == "udp") {
 		// For "in" direction, traffic going TO the container uses --dport
 		// For "out" direction, traffic going FROM the container uses --dport (destination port on remote)
-		args = append(args, "--dport", normalizePortSpec(rule.Port))
+		args = append(args, firewallPortArgs(rule.Port)...)
 	}
 
 	// Source IP filter (for "out" direction, this matches the remote source; for "in", it matches the sender)
@@ -693,51 +801,145 @@ func applyOneFirewallRule(tag, bridge, containerIP string, rule config.FirewallR
 	return nil
 }
 
+func applyOneFirewallIPv6Rule(tag, bridge string, containerIPs []string, rule config.FirewallRule) error {
+	for _, containerIP := range containerIPs {
+		commentTag := fmt.Sprintf("clicd-%s-fw-%s-v6-%s", tag, rule.ID, firewallCommentIPTag(containerIP))
+		args := []string{"-I", "FORWARD", "1"}
+
+		switch rule.Direction {
+		case "in":
+			args = append(args, "-o", bridge, "-d", containerIP+"/128")
+		case "out":
+			args = append(args, "-i", bridge, "-s", containerIP+"/128")
+		default:
+			return fmt.Errorf("invalid direction: %s", rule.Direction)
+		}
+
+		switch rule.Protocol {
+		case "tcp", "udp":
+			args = append(args, "-p", rule.Protocol)
+		case "icmp":
+			args = append(args, "-p", "ipv6-icmp")
+		case "all":
+		default:
+			return fmt.Errorf("invalid protocol: %s", rule.Protocol)
+		}
+
+		if rule.Port != "" && (rule.Protocol == "tcp" || rule.Protocol == "udp") {
+			args = append(args, firewallPortArgs(rule.Port)...)
+		}
+
+		if rule.SourceIP != "" {
+			switch rule.Direction {
+			case "in":
+				args = append(args, "-s", rule.SourceIP)
+			case "out":
+				args = append(args, "-d", rule.SourceIP)
+			}
+		}
+
+		action := "DROP"
+		if rule.Action == "ACCEPT" {
+			action = "ACCEPT"
+		}
+		args = append(args, "-j", action)
+		args = append(args, "-m", "comment", "--comment", commentTag)
+
+		cmd := exec.Command("ip6tables", args...)
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("ip6tables error: %s", string(output))
+		}
+	}
+	return nil
+}
+
+func firewallPortArgs(port string) []string {
+	spec := normalizePortSpec(port)
+	if strings.Contains(spec, ",") {
+		return []string{"-m", "multiport", "--dports", spec}
+	}
+	return []string{"--dport", spec}
+}
+
 // normalizePortSpec converts user port input to iptables-compatible port spec.
-// "80,443" -> "80,443", "8000-9000" -> "8000:9000", "22" -> "22"
+// "80,443" -> "80,443", "8000-9000" -> "8000:9000", "80,443,8000-9000" -> "80,443,8000:9000"
 func normalizePortSpec(port string) string {
 	port = strings.TrimSpace(port)
 	if port == "" {
 		return ""
 	}
-	// Convert comma-separated to iptables format (already valid)
-	// Convert dash range to colon range: "8000-9000" -> "8000:9000"
-	if strings.Contains(port, "-") && !strings.Contains(port, ":") {
-		parts := strings.SplitN(port, "-", 2)
-		if len(parts) == 2 {
-			return strings.TrimSpace(parts[0]) + ":" + strings.TrimSpace(parts[1])
+	parts := strings.Split(port, ",")
+	for i, part := range parts {
+		part = strings.TrimSpace(part)
+		if strings.Contains(part, "-") && !strings.Contains(part, ":") {
+			bounds := strings.SplitN(part, "-", 2)
+			if len(bounds) == 2 {
+				part = strings.TrimSpace(bounds[0]) + ":" + strings.TrimSpace(bounds[1])
+			}
 		}
+		parts[i] = part
 	}
-	return port
+	return strings.Join(parts, ",")
 }
 
-func applyDefaultFirewallPolicy(tag, bridge, containerIP string) {
-	// Default DROP: inserted at position 1 so they sit above bridge ACCEPT rules.
-	// The user-defined ACCEPT rules (also at position 1) were inserted first,
-	// so they end up above these DROP defaults after the position-1 insertions.
-	for _, proto := range []string{"tcp", "udp"} {
-		args := []string{
-			"-I", "FORWARD", "1",
-			"-i", bridge,
-			"-d", containerIP + "/32",
-			"-p", proto,
-			"-j", "DROP",
-			"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-default-in-%s", tag, proto),
-		}
-		cmd := exec.Command("iptables", args...)
-		cmd.CombinedOutput()
-	}
-
-	for _, proto := range []string{"tcp", "udp"} {
-		args := []string{
+func applyDefaultFirewallPolicy(tag, bridge, containerIP string) error {
+	defaults := [][]string{
+		{
 			"-I", "FORWARD", "1",
 			"-o", bridge,
-			"-s", containerIP + "/32",
-			"-p", proto,
+			"-d", containerIP + "/32",
 			"-j", "DROP",
-			"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-default-out-%s", tag, proto),
-		}
-		cmd := exec.Command("iptables", args...)
-		cmd.CombinedOutput()
+			"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-default-in", tag),
+		},
+		{
+			"-I", "FORWARD", "1",
+			"-i", bridge,
+			"-s", containerIP + "/32",
+			"-j", "DROP",
+			"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-default-out", tag),
+		},
 	}
+	for _, args := range defaults {
+		cmd := exec.Command("iptables", args...)
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("iptables default firewall error: %s", string(output))
+		}
+	}
+	return nil
+}
+
+func applyDefaultFirewallIPv6Policy(tag, bridge string, containerIPs []string) error {
+	for _, containerIP := range containerIPs {
+		defaults := [][]string{
+			{
+				"-I", "FORWARD", "1",
+				"-o", bridge,
+				"-d", containerIP + "/128",
+				"-j", "DROP",
+				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-default-in-v6-%s", tag, firewallCommentIPTag(containerIP)),
+			},
+			{
+				"-I", "FORWARD", "1",
+				"-i", bridge,
+				"-s", containerIP + "/128",
+				"-j", "DROP",
+				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-default-out-v6-%s", tag, firewallCommentIPTag(containerIP)),
+			},
+		}
+		for _, args := range defaults {
+			cmd := exec.Command("ip6tables", args...)
+			output, err := cmd.CombinedOutput()
+			if err != nil {
+				return fmt.Errorf("ip6tables default firewall error: %s", string(output))
+			}
+		}
+	}
+	return nil
+}
+
+func firewallCommentIPTag(ip string) string {
+	replacer := strings.NewReplacer(":", "_", ".", "_", "/", "_")
+	return replacer.Replace(ip)
 }