FIX #16

backend/internal/lxc/ipv6.go

@@ -74,6 +74,9 @@ func (m *Manager) DetectIPv6Status() IPv6Status {
 }
 
 func DetectPublicIPv6Prefixes() []IPv6PrefixInfo {
+	if configured := ConfiguredPublicIPv6Prefixes(); len(configured) > 0 {
+		return configured
+	}
 	return detectPublicIPv6Prefixes(detectIPv6DefaultRoutes())
 }
 

backend/internal/lxc/lxc.go

@@ -381,7 +381,11 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 	sshPort := 0
 	portMappings := []config.PortMapping{}
 	if cfg.WantsNAT() {
-		sshPort = config.AllocateSSHPort()
+		sshPort, err = config.AllocateSSHPort()
+		if err != nil {
+			_ = m.cleanupContainerStorage(lxcName)
+			return err
+		}
 
 		// Setup default port mappings (SSH only)
 		portMappings = SetupDefaultPortMappings(sshPort)

backend/internal/lxc/portmap.go

@@ -395,6 +395,10 @@ func normalizePortMapping(c *config.Container, skipIndex int, pm config.PortMapp
 	if pm.HostPort <= 0 {
 		pm.HostPort = pm.ContainerPort
 	}
+	if pm.HostIP == "" && !config.NATPortInRange(pm.HostPort) {
+		start, end := config.NATPortRange()
+		return pm, fmt.Errorf("host port must be within configured NAT4 range %d-%d", start, end)
+	}
 	// Check current container's own mappings
 	for i, existing := range c.PortMappings {
 		if i == skipIndex {
@@ -444,16 +448,12 @@ func allocateDefaultEqualPorts(c *config.Container, count int) []int {
 		}
 	}
 	ports := make([]int, 0, count)
-	next := 20000
-	for len(ports) < count {
+	start, end := config.NATPortRange()
+	for next := start; next <= end && len(ports) < count; next++ {
 		hostIP := c.PrimaryPublicIPv4()
 		if !used[hostPortKey(hostIP, next)] && !used[next] {
 			ports = append(ports, next)
 		}
-		next++
-		if next > 65535 || len(ports) >= count {
-			break
-		}
 	}
 	return ports
 }