release: v1.1.18

Patch

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Mofang/clicd.php

@@ -37,10 +37,10 @@ function clicd_json_response($payload)
 function clicd_MetaData()
 {
     return [
-        'DisplayName' => 'CLICD 对接模块 by 欢-Huan and ChatGPT 5.5',
+        'DisplayName' => 'CLICD 对接模块 by 欢-Huan and ChatGPT 5.5 and DeepSeek V4',
         'APIVersion'  => '1.1',
         'HelpDoc'     => 'https://github.com/MengMengCode/CLICD',
-        'version'     => '1.0.1',
+        'version'     => '1.0.5',
     ];
 }
 
@@ -59,10 +59,19 @@ function clicd_ConfigOptions()
         ['type' => 'text', 'name' => '入站流量 GB', 'description' => 'in_out 模式下入站流量限制，0 表示不限制', 'default' => '0', 'key' => 'traffic_in_gb'],
         ['type' => 'text', 'name' => '出站流量 GB', 'description' => 'in_out 模式下出站流量限制，0 表示不限制', 'default' => '0', 'key' => 'traffic_out_gb'],
         ['type' => 'text', 'name' => 'IO 速度 MB/s', 'description' => '磁盘 IO 限制，0 表示不限制', 'default' => '0', 'key' => 'io_speed_mbps'],
+        ['type' => 'dropdown', 'name' => '分配 NAT', 'description' => '开通时是否分配 NAT 端口映射', 'default' => 'true', 'key' => 'assign_nat', 'options' => ['true' => '启用', 'false' => '禁用']],
         ['type' => 'text', 'name' => 'NAT 端口数量', 'description' => '开通时分配的端口映射数量，最小 2', 'default' => '2', 'key' => 'port_mapping_count'],
         ['type' => 'text', 'name' => '快照配额', 'description' => '每台实例允许保留的快照数量', 'default' => '3', 'key' => 'snapshot_limit'],
         ['type' => 'text', 'name' => '额外端口', 'description' => '逗号分隔的容器端口，例如 80,443', 'default' => '', 'key' => 'extra_ports'],
+        ['type' => 'dropdown', 'name' => '自动公网 IPv4', 'description' => '开通时是否从 CLICD 公网 IPv4 池分配独立 IPv4', 'default' => 'false', 'key' => 'assign_ipv4', 'options' => ['true' => '启用', 'false' => '禁用']],
+        ['type' => 'text', 'name' => '公网 IPv4 数量', 'description' => '自动分配公网 IPv4 的数量，通常填写 1', 'default' => '1', 'key' => 'ipv4_count'],
+        ['type' => 'text', 'name' => '指定公网 IPv4', 'description' => '指定分配的公网 IPv4，多个用逗号分隔；留空则从地址池自动分配', 'default' => '', 'key' => 'public_ipv4s'],
         ['type' => 'dropdown', 'name' => '自动 IPv6', 'description' => '开通时自动分配 IPv6', 'default' => 'false', 'key' => 'assign_ipv6', 'options' => ['true' => '启用', 'false' => '禁用']],
+        ['type' => 'text', 'name' => 'IPv6 数量', 'description' => '自动分配 IPv6 的数量，通常填写 1', 'default' => '1', 'key' => 'ipv6_count'],
+        ['type' => 'text', 'name' => '指定 IPv6', 'description' => '指定分配的 IPv6 地址，多个用逗号分隔；留空则从地址池自动分配', 'default' => '', 'key' => 'ipv6_addresses'],
+        ['type' => 'dropdown', 'name' => 'SSH 鉴权模式', 'description' => 'auto_password=自动生成密码，password=使用指定密码，key=使用 SSH 公钥', 'default' => 'auto_password', 'key' => 'ssh_auth_mode', 'options' => ['auto_password' => '自动密码', 'password' => '指定密码', 'key' => 'SSH 公钥']],
+        ['type' => 'text', 'name' => '指定 SSH 密码', 'description' => 'SSH 鉴权模式为 password 时使用；其他模式留空', 'default' => '', 'key' => 'ssh_password'],
+        ['type' => 'text', 'name' => 'SSH 公钥', 'description' => 'SSH 鉴权模式为 key 时使用；填写完整 public key', 'default' => '', 'key' => 'ssh_public_key'],
         ['type' => 'dropdown', 'name' => '同步到期时间', 'description' => '开通/续费时把魔方到期日期同步到 CLICD，格式会转换为 YYYY-MM-DD', 'default' => 'true', 'key' => 'sync_expiry', 'options' => ['true' => '启用', 'false' => '禁用']],
     ];
 }
@@ -203,16 +212,101 @@ function clicd_container_name($params)
     return trim($name, '-.');
 }
 
-function clicd_public_host($params, $container = [])
+function clicd_host_id($params)
+{
+    foreach (['hostid', 'id', 'serviceid', 'service_id', 'relid'] as $key) {
+        if (!empty($params[$key]) && is_numeric($params[$key])) {
+            return (int)$params[$key];
+        }
+    }
+    return 0;
+}
+function clicd_first_string($value)
+{
+    if (is_array($value)) {
+        foreach ($value as $item) {
+            if (is_array($item)) {
+                foreach (['address', 'ip', 'ipv4', 'public_ip', 'public_ipv4'] as $key) {
+                    if (!empty($item[$key])) {
+                        $itemValue = trim((string)$item[$key]);
+                        if ($itemValue !== '') {
+                            return $itemValue;
+                        }
+                    }
+                }
+                continue;
+            }
+
+            $itemValue = trim((string)$item);
+            if ($itemValue !== '') {
+                return $itemValue;
+            }
+        }
+        return '';
+    }
+
+    $value = trim((string)$value);
+    return $value;
+}
+
+function clicd_public_host_from_container($container = [])
 {
     if (is_array($container)) {
-        foreach (['nat_public_ip', 'public_ip', 'host_ip', 'external_ip', 'node_ip', 'nat_host'] as $key) {
+        foreach (['public_ipv4s', 'public_ipv4', 'public_ip', 'ipv4_addresses', 'ipv4', 'nat_public_ip', 'host_ip', 'external_ip', 'node_ip', 'nat_host'] as $key) {
             if (!empty($container[$key])) {
-                return trim((string)$container[$key]);
+                $value = clicd_first_string($container[$key]);
+                if ($value !== '') {
+                    return $value;
+                }
             }
         }
     }
 
+    return '';
+}
+
+function clicd_public_ipv4_from_routing($params, $container = [])
+{
+    if (!is_array($container)) {
+        return '';
+    }
+
+    $containerId = isset($container['id']) ? (string)$container['id'] : '';
+    $containerName = isset($container['name']) ? (string)$container['name'] : clicd_container_name($params);
+
+    $res = clicd_request($params, '/api/v1/routing', [], 'GET', 30);
+    if (!clicd_success($res) || empty($res['data']['ipv4_assignments']) || !is_array($res['data']['ipv4_assignments'])) {
+        return '';
+    }
+
+    foreach ($res['data']['ipv4_assignments'] as $assignment) {
+        if (!is_array($assignment)) {
+            continue;
+        }
+        $matchId = $containerId !== '' && isset($assignment['container_id']) && (string)$assignment['container_id'] === $containerId;
+        $matchName = $containerName !== '' && isset($assignment['container_name']) && (string)$assignment['container_name'] === $containerName;
+        if ($matchId || $matchName) {
+            return clicd_first_string($assignment['address'] ?? '');
+        }
+    }
+
+    return '';
+}
+
+function clicd_public_host($params, $container = [], $useRouting = false)
+{
+    $fromContainer = clicd_public_host_from_container($container);
+    if ($fromContainer !== '') {
+        return $fromContainer;
+    }
+
+    if ($useRouting) {
+        $fromRouting = clicd_public_ipv4_from_routing($params, $container);
+        if ($fromRouting !== '') {
+            return $fromRouting;
+        }
+    }
+
     foreach (['server_ip', 'ip'] as $key) {
         if (!empty($params[$key])) {
             $value = trim((string)$params[$key]);
@@ -403,6 +497,24 @@ function clicd_extra_ports($value)
     return array_values(array_unique($ports));
 }
 
+function clicd_csv_values($value)
+{
+    if (is_array($value)) {
+        $parts = $value;
+    } else {
+        $parts = preg_split('/[,;\s]+/', (string)$value);
+    }
+
+    $result = [];
+    foreach ($parts as $part) {
+        $part = trim((string)$part);
+        if ($part !== '') {
+            $result[] = $part;
+        }
+    }
+    return array_values(array_unique($result));
+}
+
 function clicd_expiry_from_params($params)
 {
     $options = $params['configoptions'] ?? [];
@@ -435,6 +547,21 @@ function clicd_container_payload($params)
 {
     $options = $params['configoptions'] ?? [];
     $trafficMode = $options['traffic_mode'] ?? 'total';
+    $assignNat = clicd_bool_option($options['assign_nat'] ?? 'true', true);
+    $assignIpv4 = clicd_bool_option($options['assign_ipv4'] ?? 'false', false);
+    $assignIpv6 = clicd_bool_option($options['assign_ipv6'] ?? 'false', false);
+    $publicIpv4s = clicd_csv_values($options['public_ipv4s'] ?? '');
+    $ipv6Addresses = clicd_csv_values($options['ipv6_addresses'] ?? '');
+    if (!empty($publicIpv4s)) {
+        $assignIpv4 = true;
+    }
+    if (!empty($ipv6Addresses)) {
+        $assignIpv6 = true;
+    }
+    $sshAuthMode = strtolower(trim((string)($options['ssh_auth_mode'] ?? 'auto_password')));
+    if (!in_array($sshAuthMode, ['auto_password', 'password', 'key'], true)) {
+        $sshAuthMode = 'auto_password';
+    }
 
     return [
         'name'               => clicd_container_name($params),
@@ -451,9 +578,18 @@ function clicd_container_payload($params)
         'traffic_out_gb'     => clicd_int_option($options, 'traffic_out_gb', 0),
         'io_speed_mbps'      => clicd_int_option($options, 'io_speed_mbps', 0),
         'extra_ports'        => clicd_extra_ports($options['extra_ports'] ?? ''),
-        'port_mapping_count' => max(2, clicd_int_option($options, 'port_mapping_count', 2)),
+        'port_mapping_count' => $assignNat ? max(2, clicd_int_option($options, 'port_mapping_count', 2)) : 0,
+        'assign_nat'         => $assignNat,
+        'assign_ipv4'        => $assignIpv4,
+        'ipv4_count'         => max(1, clicd_int_option($options, 'ipv4_count', 1)),
+        'public_ipv4s'       => $publicIpv4s,
         'snapshot_limit'     => max(1, clicd_int_option($options, 'snapshot_limit', 3)),
-        'assign_ipv6'        => clicd_bool_option($options['assign_ipv6'] ?? 'false', false),
+        'assign_ipv6'        => $assignIpv6,
+        'ipv6_count'         => max(1, clicd_int_option($options, 'ipv6_count', 1)),
+        'ipv6_addresses'     => $ipv6Addresses,
+        'ssh_auth_mode'      => $sshAuthMode,
+        'ssh_password'       => (string)($options['ssh_password'] ?? ''),
+        'ssh_public_key'     => trim((string)($options['ssh_public_key'] ?? '')),
         'expires_at'         => clicd_expiry_from_params($params),
     ];
 }
@@ -477,6 +613,9 @@ function clicd_request_value($key, $default = '')
 {
     if (function_exists('input')) {
         $value = input('param.' . $key);
+        if ($value === null) {
+            $value = input('*.' . $key);
+        }
         return $value === null ? $default : $value;
     }
     if (isset($_POST[$key])) {
@@ -821,16 +960,35 @@ function clicd_info_ajax($params)
     ];
 }
 
+function clicd_domain_status_from_container($container)
+{
+    if (!is_array($container)) {
+        return 'Active';
+    }
+
+    if (!empty($container['policy_blocked'])) {
+        return 'Suspended';
+    }
+
+    $status = strtolower(trim((string)($container['status'] ?? '')));
+    if (in_array($status, ['suspended', 'blocked', 'policy_blocked', 'disabled'], true)) {
+        return 'Suspended';
+    }
+
+    return 'Active';
+}
+
 function clicd_update_host_from_container($params, $container)
 {
-    if (empty($params['hostid']) || !is_array($container)) {
+    $hostId = clicd_host_id($params);
+    if ($hostId <= 0 || !is_array($container)) {
         return;
     }
 
     $update = [
-        'domainstatus' => (($container['status'] ?? '') === 'running') ? 'Active' : 'Suspended',
+        'domainstatus' => clicd_domain_status_from_container($container),
         'username'     => 'root',
-        'dedicatedip'  => clicd_public_host($params, $container),
+        'dedicatedip'  => clicd_public_host($params, $container, true),
     ];
 
     $sshPort = clicd_container_ssh_port($container);
@@ -844,7 +1002,7 @@ function clicd_update_host_from_container($params, $container)
     }
 
     try {
-        Db::name('host')->where('id', $params['hostid'])->update($update);
+        Db::name('host')->where('id', $hostId)->update($update);
     } catch (\Exception $e) {
         clicd_debug('host update failed', $e->getMessage());
     }
@@ -879,21 +1037,24 @@ function clicd_CreateAccount($params)
         return ['status' => 'error', 'msg' => clicd_message($res, '开通失败')];
     }
 
-    $detail = clicd_find_container($params);
-    if (clicd_success($detail) && isset($detail['data'])) {
-        clicd_update_host_from_container($params, $detail['data']);
-    } elseif (!empty($params['hostid'])) {
+    $hostId = clicd_host_id($params);
+    if ($hostId > 0) {
         try {
-            Db::name('host')->where('id', $params['hostid'])->update([
+            Db::name('host')->where('id', $hostId)->update([
                 'domainstatus' => 'Active',
                 'username'     => 'root',
-                'dedicatedip'  => clicd_public_host($params),
+                'dedicatedip'  => clicd_public_ipv4_from_routing($params) ?: clicd_public_host($params),
             ]);
         } catch (\Exception $e) {
             return ['status' => 'error', 'msg' => '开通成功但同步魔方数据库失败: ' . $e->getMessage()];
         }
     }
 
+    $detail = clicd_find_container($params);
+    if (clicd_success($detail) && isset($detail['data'])) {
+        clicd_update_host_from_container($params, $detail['data']);
+    }
+
     return ['status' => 'success', 'msg' => clicd_message($res, '开通成功')];
 }
 
@@ -1001,9 +1162,10 @@ function clicd_CrackPassword($params, $new_pass)
     }
 
     $password = $res['data']['ssh_password'] ?? $res['data']['password'] ?? $new_pass;
-    if (!empty($params['hostid'])) {
+    $hostId = clicd_host_id($params);
+    if ($hostId > 0) {
         try {
-            Db::name('host')->where('id', $params['hostid'])->update(['password' => clicd_store_password($password)]);
+            Db::name('host')->where('id', $hostId)->update(['password' => clicd_store_password($password)]);
             $detail = clicd_find_container($params);
             if (clicd_success($detail) && isset($detail['data'])) {
                 clicd_update_host_from_container($params, $detail['data']);
@@ -1262,19 +1424,163 @@ function clicd_webssh($params)
     ];
 }
 
+function clicd_firewallList($params)
+{
+    $container = [];
+    $containerId = clicd_container_api_id($params, $container);
+    $res = clicd_request($params, '/api/v1/containers/' . rawurlencode($containerId) . '/firewall', [], 'GET', 30);
+    if (!clicd_success($res) || empty($res['data'])) {
+        return ['status' => 'error', 'msg' => clicd_message($res, '获取防火墙设置失败')];
+    }
+
+    return [
+        'status' => 200,
+        'msg'    => '获取成功',
+        'data'   => $res['data'],
+    ];
+}
+
+function clicd_firewallUpdate($params)
+{
+    $input = clicd_json_input();
+    $enabled = clicd_param_value($input, 'enabled', 'true');
+    $enabled = filter_var($enabled, FILTER_VALIDATE_BOOLEAN);
+    $defaultAction = strtoupper(trim((string)clicd_param_value($input, 'default_action', '')));
+    $rules = clicd_param_value($input, 'rules', '[]');
+
+    if (is_string($rules)) {
+        $decodedRules = json_decode($rules, true);
+        if (is_array($decodedRules)) {
+            $rules = $decodedRules;
+        }
+    }
+    if (!is_array($rules)) {
+        $rules = [];
+    }
+
+    $payload = [
+        'enabled' => $enabled,
+        'rules'   => $rules,
+    ];
+    if (in_array($defaultAction, ['ACCEPT', 'DROP'], true)) {
+        $payload['default_action'] = $defaultAction;
+    }
+
+    $container = [];
+    $containerId = clicd_container_api_id($params, $container);
+    $res = clicd_request($params, '/api/v1/containers/' . rawurlencode($containerId) . '/firewall', $payload, 'PUT', 30);
+    if (!clicd_success($res)) {
+        return ['status' => 'error', 'msg' => clicd_message($res, '更新防火墙设置失败')];
+    }
+
+    // GET after PUT to confirm the actual state after CLICD processes it
+    $getRes = clicd_request($params, '/api/v1/containers/' . rawurlencode($containerId) . '/firewall', [], 'GET', 30);
+    $actualData = [];
+    if (clicd_success($getRes) && !empty($getRes['data']) && is_array($getRes['data'])) {
+        $actualData = $getRes['data'];
+    }
+
+    return [
+        'status' => 200,
+        'msg'    => clicd_message($res, '防火墙设置已更新'),
+        'data'   => $actualData,
+    ];
+}
+
+function clicd_firewall_ajax($params)
+{
+    $input = clicd_json_input();
+    $action = strtolower(trim((string)clicd_param_value($input, 'action', '')));
+    $debug = [clicd_debug_entry('Firewall ajax received', [
+        'action' => $action,
+        'input'  => $input,
+        'query'  => $_GET,
+    ])];
+
+    $container = [];
+    $containerId = clicd_container_api_id($params, $container);
+    $debug[] = clicd_debug_entry('Container resolved', [
+        'container_id' => $containerId,
+        'container'    => [
+            'id'   => $container['id'] ?? null,
+            'uuid' => $container['uuid'] ?? null,
+            'name' => $container['name'] ?? null,
+        ],
+    ]);
+
+    if (!in_array($action, ['list', 'update'], true)) {
+        return ['status' => 'error', 'msg' => '未知防火墙操作', 'debug' => $debug];
+    }
+
+    if ($action === 'list') {
+        $call = clicd_request_debug($params, '/api/v1/containers/' . rawurlencode($containerId) . '/firewall', [], 'GET', 30);
+        $debug[] = $call['debug'];
+        $res = $call['response'];
+        if (!clicd_success($res) || empty($res['data'])) {
+            return ['status' => 'error', 'msg' => clicd_message($res, '获取防火墙设置失败'), 'debug' => $debug];
+        }
+        return [
+            'status' => 'success',
+            'msg'    => '获取成功',
+            'data'   => $res['data'],
+            'debug'  => $debug,
+        ];
+    }
+
+    // update
+    $enabled = clicd_param_value($input, 'enabled', 'true');
+    $enabled = filter_var($enabled, FILTER_VALIDATE_BOOLEAN);
+    $defaultAction = strtoupper(trim((string)clicd_param_value($input, 'default_action', '')));
+    $rules = clicd_param_value($input, 'rules', '[]');
+
+    if (is_string($rules)) {
+        $decodedRules = json_decode($rules, true);
+        if (is_array($decodedRules)) {
+            $rules = $decodedRules;
+        }
+    }
+    if (!is_array($rules)) {
+        $rules = [];
+    }
+
+    $payload = [
+        'enabled' => $enabled,
+        'rules'   => $rules,
+    ];
+    if (in_array($defaultAction, ['ACCEPT', 'DROP'], true)) {
+        $payload['default_action'] = $defaultAction;
+    }
+
+    $call = clicd_request_debug($params, '/api/v1/containers/' . rawurlencode($containerId) . '/firewall', $payload, 'PUT', 30);
+    $debug[] = $call['debug'];
+    $res = $call['response'];
+
+    if (!clicd_success($res)) {
+        return ['status' => 'error', 'msg' => clicd_message($res, '更新防火墙设置失败'), 'debug' => $debug];
+    }
+
+    return [
+        'status' => 'success',
+        'msg'    => clicd_message($res, '防火墙设置已更新'),
+        'data'   => $res['data'] ?? [],
+        'debug'  => $debug,
+    ];
+}
+
 function clicd_AllowFunction()
 {
     return [
-        'client' => ['TrafficReset', 'randomPort', 'addNat', 'updateNat', 'deleteNat', 'natList', 'infoData', 'webssh'],
-        'admin'  => ['TrafficReset', 'randomPort', 'addNat', 'updateNat', 'deleteNat', 'natList', 'infoData', 'webssh'],
+        'client' => ['TrafficReset', 'randomPort', 'addNat', 'updateNat', 'deleteNat', 'natList', 'infoData', 'webssh', 'firewallList', 'firewallUpdate'],
+        'admin'  => ['TrafficReset', 'randomPort', 'addNat', 'updateNat', 'deleteNat', 'natList', 'infoData', 'webssh', 'firewallList', 'firewallUpdate'],
     ];
 }
 
 function clicd_ClientArea($params)
 {
     return [
-        'info' => ['name' => '实例信息'],
-        'nat'  => ['name' => 'NAT转发'],
+        'info'     => ['name' => '实例信息'],
+        'nat'      => ['name' => 'NAT转发'],
+        'firewall' => ['name' => '防火墙'],
     ];
 }
 
@@ -1287,8 +1593,11 @@ function clicd_ClientAreaOutput($params, $key)
     if ($func === 'infoajax') {
         clicd_json_response(clicd_info_ajax($params));
     }
+    if ($func === 'firewallajax') {
+        clicd_json_response(clicd_firewall_ajax($params));
+    }
 
-    if (!in_array($key, ['info', 'nat'], true)) {
+    if (!in_array($key, ['info', 'nat', 'firewall'], true)) {
         return '';
     }
 
@@ -1298,6 +1607,7 @@ function clicd_ClientAreaOutput($params, $key)
     }
 
     $c = $res['data'];
+    $publicHost = clicd_public_host($params, $c, true);
 
     if ($key === 'nat') {
         $operation = clicd_handle_nat_post($params);
@@ -1315,8 +1625,8 @@ function clicd_ClientAreaOutput($params, $key)
                 'container'     => $c,
                 'container_name'=> $c['name'] ?? clicd_container_name($params),
                 'ssh_port'      => $c['ssh_port'] ?? '',
-                'server_ip'     => $params['server_ip'] ?? parse_url(clicd_base_url($params), PHP_URL_HOST),
-                'nat_host'      => $params['server_ip'] ?? parse_url(clicd_base_url($params), PHP_URL_HOST),
+                'server_ip'     => $publicHost,
+                'nat_host'      => $publicHost,
                 'operation_msg' => $operationMsg,
                 'service_id'    => clicd_request_value('id', $params['hostid'] ?? ''),
                 'area_key'      => 'nat',
@@ -1325,6 +1635,19 @@ function clicd_ClientAreaOutput($params, $key)
         ];
     }
 
+    if ($key === 'firewall') {
+        return [
+            'template' => 'templates/firewall.html',
+            'vars'     => [
+                'container'      => $c,
+                'container_name' => $c['name'] ?? clicd_container_name($params),
+                'server_ip'      => $publicHost,
+                'service_id'     => clicd_request_value('id', $params['hostid'] ?? ''),
+                'area_key'       => 'firewall',
+            ],
+        ];
+    }
+
     $initialRxBytes = (int)($c['traffic_used_rx'] ?? $c['rx_bytes'] ?? 0);
     $initialTxBytes = (int)($c['traffic_used_tx'] ?? $c['tx_bytes'] ?? 0);
     $initialTrafficUsed = ($initialRxBytes || $initialTxBytes) ? round(($initialRxBytes + $initialTxBytes) / 1073741824, 2) : '-';
@@ -1342,8 +1665,8 @@ function clicd_ClientAreaOutput($params, $key)
         'vars'     => [
             'container'      => $c,
             'status_text'    => (($c['status'] ?? '') === 'running') ? '运行中' : '已关机',
-            'server_ip'      => $params['server_ip'] ?? parse_url(clicd_base_url($params), PHP_URL_HOST),
-            'ssh_host'       => $params['server_ip'] ?? parse_url(clicd_base_url($params), PHP_URL_HOST),
+            'server_ip'      => $publicHost,
+            'ssh_host'       => $publicHost,
             'ssh_port'       => $c['ssh_port'] ?? '',
             'ssh_password'   => $c['ssh_password'] ?? '',
             'ipv4'           => $c['ip'] ?? '',
@@ -1366,3 +1689,7 @@ function clicd_ClientAreaOutput($params, $key)
         ],
     ];
 }
+
+
+
+

Mofang/handlers/webssh.php

@@ -1,4 +1,4 @@
-<?php
+<?php
 $ws = isset($_GET['ws']) ? (string)$_GET['ws'] : (isset($_GET['amp;ws']) ? (string)$_GET['amp;ws'] : '');
 $protocol = isset($_GET['protocol']) ? (string)$_GET['protocol'] : (isset($_GET['amp;protocol']) ? (string)$_GET['amp;protocol'] : '');
 $container = isset($_GET['container']) ? (string)$_GET['container'] : (isset($_GET['amp;container']) ? (string)$_GET['amp;container'] : '');

Mofang/templates/firewall.html

@@ -0,0 +1,508 @@
+<style>
+.clicd-fw-panel{font-size:14px;color:#1f2937}
+.clicd-fw-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:12px;margin-bottom:16px}
+.clicd-fw-card{border:1px solid #e5e7eb;border-radius:6px;padding:12px;background:#fff}
+.clicd-fw-label{color:#6b7280;font-size:12px;margin-bottom:4px}
+.clicd-fw-value{font-size:18px;font-weight:600;word-break:break-all}
+.clicd-fw-section{border:1px solid #e5e7eb;border-radius:6px;background:#fff;padding:12px;margin-top:8px}
+.clicd-fw-title{font-weight:600;margin:18px 0 8px}
+.clicd-fw-muted{color:#6b7280}
+.clicd-fw-toggle-row{display:flex;align-items:center;gap:12px;margin-bottom:12px}
+.clicd-fw-toggle{position:relative;display:inline-flex;width:48px;height:26px;cursor:pointer}
+.clicd-fw-toggle input{opacity:0;width:0;height:0}
+.clicd-fw-toggle-slider{position:absolute;inset:0;background:#d1d5db;border-radius:26px;transition:.25s}
+.clicd-fw-toggle-slider:before{content:"";position:absolute;width:22px;height:22px;border-radius:50%;background:#fff;top:2px;left:2px;transition:.25s}.clicd-fw-toggle .clicd-fw-toggle-slider:before{width:16px;height:16px;top:2px;left:2px}
+.clicd-fw-toggle input:checked+.clicd-fw-toggle-slider{background:#10b981}
+.clicd-fw-toggle input:checked+.clicd-fw-toggle-slider:before{transform:translateX(22px)}
+.clicd-fw-toggle-label{font-size:14px;font-weight:500}
+.clicd-fw-status{font-size:13px;color:#6b7280}
+.clicd-fw-rule-form{display:grid;grid-template-columns:repeat(auto-fit,minmax(140px,1fr));gap:10px;align-items:end}
+.clicd-fw-field label{display:block;color:#6b7280;font-size:12px;margin-bottom:4px}
+.clicd-fw-input,.clicd-fw-select{width:100%;height:34px;border:1px solid #d1d5db;border-radius:4px;padding:6px 8px;box-sizing:border-box}
+.clicd-fw-input:focus,.clicd-fw-select:focus{border-color:#2563eb;outline:none}
+.clicd-fw-actions{display:flex;gap:8px;flex-wrap:wrap;align-items:end}
+.clicd-fw-btn{height:34px;border:1px solid #2563eb;background:#2563eb;color:#fff;border-radius:4px;padding:0 12px;cursor:pointer;font-size:13px}
+.clicd-fw-btn[disabled]{opacity:.6;cursor:not-allowed}
+.clicd-fw-btn-secondary{border-color:#d1d5db;background:#fff;color:#374151}
+.clicd-fw-btn-danger{border-color:#dc2626;background:#dc2626;color:#fff}
+.clicd-fw-btn-sm{height:30px;padding:0 10px;font-size:12px}
+.clicd-fw-rules{display:flex;flex-direction:column;gap:10px;margin-top:8px}
+.clicd-fw-rule{border:1px solid #e5e7eb;border-radius:6px;background:#fff;padding:12px}
+.clicd-fw-rule-header{display:flex;align-items:center;justify-content:space-between;gap:8px;margin-bottom:8px;flex-wrap:wrap}
+.clicd-fw-rule-direction{display:inline-flex;align-items:center;gap:4px;padding:2px 8px;border-radius:4px;font-size:12px;font-weight:600}
+.clicd-fw-direction-in{background:#dbeafe;color:#1d4ed8}
+.clicd-fw-direction-out{background:#fef3c7;color:#92400e}
+.clicd-fw-rule-action{display:inline-flex;align-items:center;gap:4px;padding:2px 8px;border-radius:4px;font-size:12px;font-weight:600}
+.clicd-fw-action-ACCEPT{background:#d1fae5;color:#065f46}
+.clicd-fw-action-DROP{background:#fee2e2;color:#991b1b}
+.clicd-fw-rule-desc{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-bottom:8px}
+.clicd-fw-rule-detail{font-size:13px;color:#374151;display:flex;align-items:center;gap:8px;flex-wrap:wrap}
+.clicd-fw-rule-detail .sep{color:#d1d5db}
+.clicd-fw-rule-edit-row{display:grid;grid-template-columns:repeat(auto-fit,minmax(120px,1fr));gap:8px;margin-top:8px;padding-top:8px;border-top:1px solid #e5e7eb}
+.clicd-fw-message{border:1px solid #bfdbfe;background:#eff6ff;color:#1d4ed8;border-radius:6px;padding:10px 12px;margin-bottom:12px;display:none}
+.clicd-fw-message.error{border-color:#fecaca;background:#fef2f2;color:#b91c1c}
+.clicd-fw-debug{margin-top:12px;border:1px dashed #d1d5db;border-radius:6px;background:#f9fafb;padding:10px;color:#374151;white-space:pre-wrap;font-size:12px;display:none}
+.clicd-fw-modal-mask{position:fixed;inset:0;background:rgba(15,23,42,.42);display:none;align-items:center;justify-content:center;z-index:9999;padding:16px}
+.clicd-fw-modal{width:min(420px,100%);background:#fff;border-radius:6px;border:1px solid #e5e7eb;box-shadow:0 18px 48px rgba(15,23,42,.22);padding:16px}
+.clicd-fw-modal-title{font-size:16px;font-weight:700;color:#111827;margin-bottom:8px}
+.clicd-fw-modal-body{font-size:14px;color:#4b5563;line-height:1.6;margin-bottom:14px}
+.clicd-fw-modal-actions{display:flex;justify-content:flex-end;gap:8px}
+</style>
+
+<div class="clicd-fw-panel" id="clicd-fw-panel" data-service-id="{$service_id}" data-area-key="{$area_key}">
+    <div class="clicd-fw-message" id="clicd-fw-message"></div>
+
+    <div class="clicd-fw-grid">
+        <div class="clicd-fw-card">
+            <div class="clicd-fw-label">实例名称</div>
+            <div class="clicd-fw-value">{$container_name}</div>
+        </div>
+        <div class="clicd-fw-card">
+            <div class="clicd-fw-label">IP 地址</div>
+            <div class="clicd-fw-value">{$server_ip}</div>
+        </div>
+    </div>
+
+    <div class="clicd-fw-section">
+        <div class="clicd-fw-toggle-row">
+            <label class="clicd-fw-toggle">
+                <input type="checkbox" id="clicd-fw-enabled">
+                <span class="clicd-fw-toggle-slider"></span>
+            </label>
+            <span class="clicd-fw-toggle-label">启用防火墙</span>
+            <span class="clicd-fw-status" id="clicd-fw-status-text">加载中...</span>
+        </div>
+    </div>
+
+    <div class="clicd-fw-title">添加规则</div>
+    <div class="clicd-fw-section" id="clicd-fw-add-section">
+        <div class="clicd-fw-rule-form">
+            <div class="clicd-fw-field">
+                <label>方向</label>
+                <select class="clicd-fw-select" id="clicd-fw-add-direction">
+                    <option value="in">入站 (In)</option>
+                    <option value="out">出站 (Out)</option>
+                </select>
+            </div>
+            <div class="clicd-fw-field">
+                <label>协议</label>
+                <select class="clicd-fw-select" id="clicd-fw-add-protocol">
+                    <option value="tcp">TCP</option>
+                    <option value="udp">UDP</option>
+                </select>
+            </div>
+            <div class="clicd-fw-field">
+                <label>端口</label>
+                <input class="clicd-fw-input" id="clicd-fw-add-port" type="text" placeholder="22 / 80,443 / 8000-9000">
+            </div>
+            <div class="clicd-fw-field">
+                <label>来源 IP</label>
+                <input class="clicd-fw-input" id="clicd-fw-add-source-ip" type="text" placeholder="留空表示所有">
+            </div>
+            <div class="clicd-fw-field">
+                <label>动作</label>
+                <select class="clicd-fw-select" id="clicd-fw-add-action">
+                    <option value="ACCEPT">放行 (ACCEPT)</option>
+                    <option value="DROP">拒绝 (DROP)</option>
+                </select>
+            </div>
+            <div class="clicd-fw-field">
+                <label>说明</label>
+                <input class="clicd-fw-input" id="clicd-fw-add-desc" type="text" placeholder="例如 Allow SSH">
+            </div>
+            <div class="clicd-fw-actions">
+                <button class="clicd-fw-btn" type="button" data-clicd-fw-action="add-rule">添加规则</button>
+            </div>
+        </div>
+    </div>
+
+    <div class="clicd-fw-title">防火墙规则</div>
+    <div id="clicd-fw-rules" class="clicd-fw-rules">
+        <div class="clicd-fw-section clicd-fw-muted">加载中...</div>
+    </div>
+
+    <pre class="clicd-fw-debug" id="clicd-fw-debug"></pre>
+
+    <div class="clicd-fw-modal-mask" id="clicd-fw-delete-modal">
+        <div class="clicd-fw-modal">
+            <div class="clicd-fw-modal-title">确认删除</div>
+            <div class="clicd-fw-modal-body" id="clicd-fw-delete-text">确认删除该规则？</div>
+            <div class="clicd-fw-modal-actions">
+                <button class="clicd-fw-btn clicd-fw-btn-secondary" type="button" id="clicd-fw-delete-cancel">取消</button>
+                <button class="clicd-fw-btn clicd-fw-btn-danger" type="button" id="clicd-fw-delete-confirm">删除</button>
+            </div>
+        </div>
+    </div>
+</div>
+
+<script>
+(function(){
+    var panel = document.getElementById('clicd-fw-panel');
+    if (!panel || panel.getAttribute('data-bound') === '1') return;
+    panel.setAttribute('data-bound', '1');
+
+    var message = document.getElementById('clicd-fw-message');
+    var debugBox = document.getElementById('clicd-fw-debug');
+    var rulesContainer = document.getElementById('clicd-fw-rules');
+    var enabledCheckbox = document.getElementById('clicd-fw-enabled');
+    var statusText = document.getElementById('clicd-fw-status-text');
+    var deleteModal = document.getElementById('clicd-fw-delete-modal');
+    var deleteText = document.getElementById('clicd-fw-delete-text');
+    var deleteCancel = document.getElementById('clicd-fw-delete-cancel');
+    var deleteConfirm = document.getElementById('clicd-fw-delete-confirm');
+    var pendingDeleteRule = null;
+    var currentRules = [];
+
+    function showMessage(type, text) {
+        message.className = 'clicd-fw-message' + (type === 'error' ? ' error' : '');
+        message.style.display = 'block';
+        message.textContent = text || '';
+    }
+
+    function showDebug(data) {
+        debugBox.style.display = 'block';
+        debugBox.textContent = JSON.stringify(data || {}, null, 2);
+    }
+
+    function endpoint() {
+        return "{$MODULE_CUSTOM_API}";
+    }
+
+    function setBusy(busy) {
+        panel.querySelectorAll('button, input, select').forEach(function(el){ el.disabled = !!busy; });
+    }
+
+    function escapeHtml(value) {
+        return String(value)
+            .replace(/&/g, '&amp;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#039;');
+    }
+
+    function portDisplay(port) {
+        return port || '所有';
+    }
+
+    function sourceIpDisplay(ip) {
+        return ip || '任意';
+    }
+
+    function directionLabel(dir) {
+        return dir === 'in' ? '入站' : '出站';
+    }
+
+    function actionLabel(action) {
+        return action === 'ACCEPT' ? '放行' : '拒绝';
+    }
+
+    function renderRules(rules) {
+        currentRules = Array.isArray(rules) ? rules : [];
+        if (currentRules.length === 0) {
+            rulesContainer.innerHTML = '<div class="clicd-fw-section clicd-fw-muted">暂无防火墙规则</div>';
+            return;
+        }
+        rulesContainer.innerHTML = currentRules.map(function(rule, idx) {
+            var dirRaw = String(rule.direction || 'in').toLowerCase();
+            var protoRaw = String(rule.protocol || 'tcp').toLowerCase();
+            var actionRaw = String(rule.action || 'ACCEPT').toUpperCase();
+            var dir = (dirRaw === 'in' || dirRaw === 'out') ? dirRaw : 'in';
+            var proto = (protoRaw === 'tcp' || protoRaw === 'udp' || protoRaw === 'icmp' || protoRaw === 'all') ? protoRaw : 'tcp';
+            var action = (actionRaw === 'ACCEPT' || actionRaw === 'DROP' || actionRaw === 'REJECT') ? actionRaw : 'ACCEPT';
+            var port = escapeHtml(portDisplay(rule.port));
+            var srcIp = escapeHtml(sourceIpDisplay(rule.source_ip));
+            var desc = escapeHtml(rule.description || '');
+            var ruleId = escapeHtml(rule.id || '');
+            var enabled = rule.enabled !== false;
+            var enabledChecked = enabled ? 'checked' : '';
+            var dirClass = dir === 'in' ? 'clicd-fw-direction-in' : 'clicd-fw-direction-out';
+            var actionClass = 'clicd-fw-action-' + action;
+            return '<div class="clicd-fw-rule" data-rule-id="' + ruleId + '" data-rule-index="' + idx + '">' +
+                '<div class="clicd-fw-rule-header">' +
+                '<div style="display:flex;align-items:center;gap:6px;flex-wrap:wrap">' +
+                '<span class="clicd-fw-rule-direction ' + dirClass + '">' + (dir === 'in' ? '&#8593; 入站' : '&#8595; 出站') + '</span>' +
+                '<span class="clicd-fw-rule-action ' + actionClass + '">' + actionLabel(action) + '</span>' +
+                '<span style="font-size:13px;color:#6b7280">' + proto.toUpperCase() + '</span>' +
+                '<span style="font-size:13px;color:#374151">' +
+                (port !== '所有' ? '端口: ' + port : '') +
+                (srcIp !== '任意' && port !== '所有' ? ' | ' : '') +
+                (srcIp !== '任意' ? '来源: ' + srcIp : '') +
+                '</span>' +
+                '</div>' +
+                '<div style="display:flex;align-items:center;gap:6px">' +
+                '<label class="clicd-fw-toggle" style="width:36px;height:20px">' +
+                '<input type="checkbox" class="clicd-fw-rule-enabled" ' + enabledChecked + '>' +
+                '<span class="clicd-fw-toggle-slider" style="border-radius:20px"></span>' +
+                
+                '</label>' +
+                '</div>' +
+                '</div>' +
+                '<div class="clicd-fw-rule-desc">' +
+                '<span style="font-size:13px;color:#374151;flex:1">' + (desc || '<span style="color:#9ca3af">无说明</span>') + '</span>' +
+                '</div>' +
+                '<div class="clicd-fw-rule-edit-row">' +
+                '<div class="clicd-fw-field"><label>方向</label><select class="clicd-fw-select clicd-fw-edit-field" data-field="direction">' +
+                '<option value="in"' + (dir === 'in' ? ' selected' : '') + '>入站</option>' +
+                '<option value="out"' + (dir === 'out' ? ' selected' : '') + '>出站</option>' +
+                '</select></div>' +
+                '<div class="clicd-fw-field"><label>协议</label><select class="clicd-fw-select clicd-fw-edit-field" data-field="protocol">' +
+                '<option value="tcp"' + (proto === 'tcp' ? ' selected' : '') + '>TCP</option>' +
+                '<option value="udp"' + (proto === 'udp' ? ' selected' : '') + '>UDP</option>' +
+                '</select></div>' +
+                '<div class="clicd-fw-field"><label>端口</label><input class="clicd-fw-input clicd-fw-edit-field" data-field="port" type="text" value="' + escapeHtml(rule.port || '') + '"></div>' +
+                '<div class="clicd-fw-field"><label>来源 IP</label><input class="clicd-fw-input clicd-fw-edit-field" data-field="source_ip" type="text" value="' + escapeHtml(rule.source_ip || '') + '"></div>' +
+                '<div class="clicd-fw-field"><label>动作</label><select class="clicd-fw-select clicd-fw-edit-field" data-field="action">' +
+                '<option value="ACCEPT"' + (action === 'ACCEPT' ? ' selected' : '') + '>放行</option>' +
+                '<option value="DROP"' + (action === 'DROP' ? ' selected' : '') + '>拒绝</option>' +
+                '</select></div>' +
+                '<div class="clicd-fw-field"><label>说明</label><input class="clicd-fw-input clicd-fw-edit-field" data-field="description" type="text" value="' + desc + '"></div>' +
+                '<div class="clicd-fw-actions" style="align-items:end">' +
+                '<button class="clicd-fw-btn clicd-fw-btn-secondary clicd-fw-btn-sm" type="button" data-clicd-fw-action="update-rule">保存</button>' +
+                '<button class="clicd-fw-btn clicd-fw-btn-danger clicd-fw-btn-sm" type="button" data-clicd-fw-action="delete-rule">删除</button>' +
+                '</div>' +
+                '</div>' +
+                '</div>';
+        }).join('');
+
+        // Bind toggle events for rule enabled/disabled
+        rulesContainer.querySelectorAll('.clicd-fw-rule-enabled').forEach(function(toggle, idx) {
+            toggle.addEventListener('change', function() {
+                var rule = currentRules[idx];
+                if (!rule) return;
+                rule.enabled = toggle.checked;
+                saveFirewall();
+            });
+        });
+    }
+
+    function getRuleFromItem(item) {
+        var idx = parseInt(item.getAttribute('data-rule-index'), 10);
+        if (isNaN(idx) || !currentRules[idx]) return null;
+        return { index: idx, rule: currentRules[idx] };
+    }
+
+    function getEditField(item, name) {
+        return item.querySelector('[data-field="' + name + '"]');
+    }
+
+    function updateRuleFromFields(item, idx) {
+        currentRules[idx].direction = getEditField(item, 'direction') ? getEditField(item, 'direction').value : 'in';
+        currentRules[idx].protocol = getEditField(item, 'protocol') ? getEditField(item, 'protocol').value : 'tcp';
+        currentRules[idx].port = getEditField(item, 'port') ? getEditField(item, 'port').value : '';
+        currentRules[idx].source_ip = getEditField(item, 'source_ip') ? getEditField(item, 'source_ip').value : '';
+        currentRules[idx].action = getEditField(item, 'action') ? getEditField(item, 'action').value : 'ACCEPT';
+        currentRules[idx].description = getEditField(item, 'description') ? getEditField(item, 'description').value : '';
+    }
+
+    function getAddRulePayload() {
+        return {
+            direction: document.getElementById('clicd-fw-add-direction').value,
+            protocol: document.getElementById('clicd-fw-add-protocol').value,
+            port: document.getElementById('clicd-fw-add-port').value,
+            source_ip: document.getElementById('clicd-fw-add-source-ip').value,
+            action: document.getElementById('clicd-fw-add-action').value,
+            description: document.getElementById('clicd-fw-add-desc').value,
+            enabled: true
+        };
+    }
+
+    function clearAddForm() {
+        document.getElementById('clicd-fw-add-port').value = '';
+        document.getElementById('clicd-fw-add-source-ip').value = '';
+        document.getElementById('clicd-fw-add-action').value = 'ACCEPT';
+        document.getElementById('clicd-fw-add-desc').value = '';
+    }
+
+    function saveFirewall() {
+        var enabled = enabledCheckbox.checked;
+        var rules = currentRules.map(function(r) {
+            return {
+                id: r.id || '',
+                direction: r.direction || 'in',
+                protocol: r.protocol || 'tcp',
+                port: r.port || '',
+                source_ip: r.source_ip || '',
+                action: r.action || 'ACCEPT',
+                description: r.description || '',
+                enabled: r.enabled !== false
+            };
+        });
+
+        setBusy(true);
+        var body = new URLSearchParams();
+        body.set('id', panel.getAttribute('data-service-id') || '');
+        body.set('func', 'firewallUpdate');
+        body.set('enabled', enabled ? 'true' : 'false');
+        body.set('rules', JSON.stringify(rules));
+
+        fetch(endpoint(), {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
+                'Authorization': 'JWT {$Think.get.jwt}'
+            },
+            credentials: 'same-origin',
+            body: body.toString()
+        })
+        .then(function(res){ return res.text(); })
+        .then(function(text){
+            var data;
+            try { data = JSON.parse(text); } catch(e) { data = {status:'error', msg:'非 JSON 响应: ' + text}; }
+            showDebug((data.data && data.data.debug) || data.debug || data);
+            if (data.status === 200 || data.status === 'success') {
+                showMessage('success', data.msg || '防火墙设置已更新');
+                if (data.data && data.data.rules) {
+                    currentRules = data.data.rules;
+                    renderRules(currentRules);
+                }
+                updateStatusText();
+            } else {
+                showMessage('error', data.msg || '更新失败');
+            }
+        })
+        .catch(function(e){
+            showMessage('error', e.message || '请求失败');
+            showDebug({error: String(e)});
+        })
+        .finally(function(){
+            setBusy(false);
+        });
+    }
+
+    function loadFirewall() {
+        setBusy(true);
+        var body = new URLSearchParams();
+        body.set('id', panel.getAttribute('data-service-id') || '');
+        body.set('func', 'firewallList');
+
+        fetch(endpoint(), {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
+                'Authorization': 'JWT {$Think.get.jwt}'
+            },
+            credentials: 'same-origin',
+            body: body.toString()
+        })
+        .then(function(res){ return res.text(); })
+        .then(function(text){
+            var data;
+            try { data = JSON.parse(text); } catch(e) { data = {status:'error', msg:'非 JSON 响应: ' + text}; }
+            showDebug((data.data && data.data.debug) || data.debug || data);
+            if (data.status === 200 || data.status === 'success') {
+                if (data.data) {
+                    enabledCheckbox.checked = data.data.enabled === true || data.data.enabled === 'true' || data.data.enabled === 1;
+                    currentRules = Array.isArray(data.data.rules) ? data.data.rules : [];
+                    renderRules(currentRules);
+                    updateStatusText();
+                }
+            } else {
+                showMessage('error', data.msg || '获取防火墙设置失败');
+                rulesContainer.innerHTML = '<div class="clicd-fw-section clicd-fw-muted">加载失败</div>';
+            }
+        })
+        .catch(function(e){
+            showMessage('error', e.message || '请求失败');
+            showDebug({error: String(e)});
+            rulesContainer.innerHTML = '<div class="clicd-fw-section clicd-fw-muted">加载失败</div>';
+        })
+        .finally(function(){
+            setBusy(false);
+        });
+    }
+
+    function updateStatusText() {
+        if (enabledCheckbox.checked) {
+            statusText.textContent = '已启用 - 默认拒绝所有流量，仅放行规则中定义的流量';
+        } else {
+            statusText.textContent = '已禁用 - 所有流量不受限制';
+        }
+    }
+
+    function openDeleteModal(rule, desc) {
+        pendingDeleteRule = rule;
+        if (deleteText) {
+            deleteText.textContent = '确认删除规则: ' + (desc || '未命名规则') + ' ?';
+        }
+        if (deleteModal) {
+            deleteModal.style.display = 'flex';
+        }
+    }
+
+    function closeDeleteModal() {
+        pendingDeleteRule = null;
+        if (deleteModal) {
+            deleteModal.style.display = 'none';
+        }
+    }
+
+    // Event delegation
+    panel.addEventListener('click', function(event) {
+        var button = event.target.closest('[data-clicd-fw-action]');
+        if (!button) return;
+        var action = button.getAttribute('data-clicd-fw-action');
+
+        if (action === 'add-rule') {
+            var payload = getAddRulePayload();
+            currentRules.push({
+                id: '',
+                direction: payload.direction,
+                protocol: payload.protocol,
+                port: payload.port,
+                source_ip: payload.source_ip,
+                action: payload.action,
+                description: payload.description,
+                enabled: true
+            });
+            renderRules(currentRules);
+            clearAddForm();
+            saveFirewall();
+            return;
+        }
+
+        var item = button.closest('.clicd-fw-rule');
+        if (!item) return;
+        var idx = parseInt(item.getAttribute('data-rule-index'), 10);
+        if (isNaN(idx) || !currentRules[idx]) return;
+
+        if (action === 'update-rule') {
+            updateRuleFromFields(item, idx);
+            saveFirewall();
+            return;
+        }
+
+        if (action === 'delete-rule') {
+            var desc = currentRules[idx].description || (currentRules[idx].protocol + '/' + (currentRules[idx].port || 'all'));
+            openDeleteModal(idx, desc);
+            return;
+        }
+    });
+
+    enabledCheckbox.addEventListener('change', function() {
+        saveFirewall();
+    });
+
+    if (deleteCancel) {
+        deleteCancel.addEventListener('click', closeDeleteModal);
+    }
+    if (deleteModal) {
+        deleteModal.addEventListener('click', function(event){
+            if (event.target === deleteModal) closeDeleteModal();
+        });
+    }
+    if (deleteConfirm) {
+        deleteConfirm.addEventListener('click', function(){
+            if (pendingDeleteRule === null) return;
+            var idx = pendingDeleteRule;
+            closeDeleteModal();
+            if (idx >= 0 && idx < currentRules.length) {
+                currentRules.splice(idx, 1);
+                saveFirewall();
+            }
+        });
+    }
+
+    loadFirewall();
+})();
+</script>

Mofang/templates/info.html

@@ -1,4 +1,4 @@
-<style>
+<style>
 .clicd-info{font-size:14px;color:#1f2937;background:#f6f8fb;padding:14px;border-radius:6px;max-width:100%;overflow:hidden}
 .clicd-info *{box-sizing:border-box}
 .clicd-head{display:grid;grid-template-columns:repeat(auto-fit,minmax(170px,1fr));gap:10px;margin-bottom:12px}

Mofang/templates/nat.html

@@ -1,4 +1,4 @@
-<style>
+<style>
 .clicd-nat-panel{font-size:14px;color:#1f2937}
 .clicd-nat-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:12px;margin-bottom:16px}
 .clicd-nat-card{border:1px solid #e5e7eb;border-radius:6px;padding:12px;background:#fff}

README.md

@@ -5,7 +5,7 @@
 <h1 align="center">CLICD</h1>
 
 <p align="center">
-  <img alt="Go" src="https://img.shields.io/badge/Go-1.22-00ADD8?style=flat-square&logo=go&logoColor=white">
+  <img alt="Go" src="https://img.shields.io/badge/Go-1.24-00ADD8?style=flat-square&logo=go&logoColor=white">
   <img alt="React" src="https://img.shields.io/badge/React-18-61DAFB?style=flat-square&logo=react&logoColor=111111">
   <img alt="TypeScript" src="https://img.shields.io/badge/TypeScript-5-3178C6?style=flat-square&logo=typescript&logoColor=white">
   <img alt="Vite" src="https://img.shields.io/badge/Vite-5-646CFF?style=flat-square&logo=vite&logoColor=white">
@@ -27,41 +27,11 @@
   <img alt="TLS" src="https://img.shields.io/badge/TLS-Let's_Encrypt-003A70?style=flat-square&logo=letsencrypt&logoColor=white">
 </p>
 
-CLICD is a lightweight virtualization management panel for LXC and KVM, featuring a web console, CLI management, batch operations, image management, NAT networking, IPv6 allocation, WebSSH, VNC access, resource controls, bandwidth limiting, and security alerting.
-It is designed for managing LXC containers and KVM virtual machines on VPS servers, and is particularly suitable for environments that require bulk provisioning and delegated access management through sub-user management links.
+CLICD is a lightweight virtualization management panel for LXC and KVM. It combines a web console, CLI tools, REST API, NAT/IPv6 networking, WebSSH/WebVNC access, resource quotas, traffic limits, snapshots, delegated sub-user access, and security alerts into a single deployable service.
 
-CLICD 是一个面向 LXC/KVM 的轻量虚拟化管理面板，提供 Web 控制台、CLI、批量任务、镜像管理、NAT 端口、IPv6 分配、WebSSH、VNC、资源限制、流量限制和安全告警能力。它适合用来管理小型 VPS 上的 LXC 容器和 KVM 虚拟机，也适合需要批量创建和分发子用户管理链接的场景。
+CLICD 是一个面向 LXC/KVM 的轻量虚拟化管理面板，集成 Web 控制台、CLI、REST API、NAT/IPv6 网络、WebSSH/WebVNC、资源配额、流量限制、快照、子用户授权和安全告警能力，适合 VPS 商家、实验室、开发者自建虚拟化节点以及需要批量开通容器的场景。
 
-## Features / 功能介绍
-
-### English
-1. Supports Ubuntu, Debian, Alpine, CentOS, Arch Linux, Fedora, Rocky Linux, and other operating system images. Images can be downloaded on demand through the image management interface. For hosts with limited resources, lightweight distributions such as Alpine are recommended.
-2. Supports WebSSH management, allowing users to access container terminals directly from the browser without manually copying SSH credentials.
-3. Supports NAT4 port quotas, port forwarding, and protocol restrictions, as well as public IPv6 allocation. IPv6 assignment requires the host machine to have a routable IPv6 prefix.
-4. Supports both inbound and outbound traffic limits. Containers are automatically powered off when configured limits are reached, preventing bandwidth overuse.
-5. Supports container expiration dates. Expired containers are automatically shut down, and delegated users lose access until an administrator extends the expiration period.
-6. Includes lightweight conntrack-based security monitoring. The system does not store full logs of normal connections, but generates audit alerts for suspicious activities such as port scanning, lateral scanning, brute-force attempts, SMTP abuse, UDP reflection attacks, cryptocurrency mining ports, and proxy/VPN/Tor usage.
-7. Supports delegated management links. Administrators can assign specific containers to sub-users, while ensuring that each user can only manage the containers explicitly authorized to them.
-8. Provides a REST API for automating the management of containers, tasks, images, networking, traffic controls, and security alerts.
-9. Supports operating entirely through the CLI. When the web console is not required, administrators can stop and disable the systemd service and launch CLI-only mode using `clicd cli --no-web`.
-
-### 中文
-1. 支持 Ubuntu、Debian、Alpine、CentOS、Arch Linux、Fedora、Rocky Linux 等系统镜像。镜像可以在镜像管理中按需下载；如果宿主机资源比较小，建议优先选择 Alpine 这类轻量镜像。
-2. 支持 WebSSH 管理，可以在浏览器里一键进入容器终端，不需要手动复制 SSH 密码。
-3. 支持设置 NAT4 端口数量、NAT 端口映射和协议限制，并支持分配公网 IPv6。IPv6 分配要求宿主机本身拥有可路由的 IPv6 地址段。
-4. 支持单向和双向网络流量限制。达到限制后容器会自动关机，避免流量超额。
-5. 支持设置容器有效期。到期后容器会自动关机，子用户无法继续操作，只有管理员重新设置延期日期后才能恢复使用。
-6. 内置基于 conntrack 的轻量安全告警。系统不会保存完整正常连接日志，但会对端口扫描、横向扫描、爆破倾向、SMTP 滥用、UDP 反射、挖矿端口、代理/VPN/Tor 等可疑行为生成告警并写入审计日志。
-7. 支持子用户管理链接，管理员可以把指定容器分发给拼车用户，子用户只能管理自己被授权的容器。
-8. 支持 API 接入，可以通过 API 完成容器、任务、镜像、端口、流量、安全告警等功能的自动化控制。
-9. 支持仅使用 CLI 管理。需要关闭 Web 控制台时，可以停止并禁用 systemd 服务，然后使用 `clicd cli --no-web` 进入命令行模式。
-
-## Technology Stack / 技术栈
-
-- Backend: Go, net/http, LXC, KVM/libvirt, cgroup v2, iptables, conntrack
-- Frontend: React, TypeScript, Vite, Tailwind CSS, lucide-react, xterm.js
-- Runtime: Linux, systemd, LXC, KVM/QEMU
-- Build: GitHub Actions, Node.js 20, Go 1.22
+![alt text](/img/image-1.png)
 
 ## Installation / 安装
 
@@ -77,9 +47,52 @@ One-click Uninstall / 一键卸载：
 curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo sh -s -- uninstall
 ```
 
-![alt text](/img/image.png)
-![alt text](/img/image-1.png)
+
+
+## Features / 功能介绍
+
+### English
+
+| Area | What CLICD provides |
+| --- | --- |
+| Virtualization | Manage LXC containers and KVM virtual machines from one panel, including create, reinstall, start, stop, restart, delete, password reset, expiry control, and batch actions. |
+| Images and templates | Built-in template and image management for Ubuntu, Debian, Alpine, CentOS, Arch Linux, Fedora, Rocky Linux, and other common distributions. Images can be enabled, disabled, downloaded, cancelled, or removed from cache. |
+| Networking | NAT4 port quotas, random available port allocation, TCP/UDP port mappings, public IPv4 pool management, IPv6 prefix detection, IPv6 status checks, and per-container IPv6 assignment. |
+| Resource control | CPU, memory, disk, swap, bandwidth usage, traffic reset, traffic limit, and resource limit management, with automatic shutdown behavior for expired or over-quota containers. |
+| Console access | Browser-based WebSSH and WebVNC ticket access, so users can open terminals or consoles without manually exchanging credentials. |
+| Snapshots | Snapshot overview, per-container snapshots, create/delete/restore operations, scheduled snapshots, and quota controls. |
+| Security | Conntrack-based security alerts for port scans, lateral scans, brute-force behavior, SMTP abuse, UDP reflection, mining ports, proxy/VPN/Tor usage, plus security logs, summaries, and configurable settings. |
+| Accounts and audit | Delegated sub-user links, sub-user password rotation, per-user container permissions, audit logs, login logs, and API key management. |
+| Automation | Versioned REST API under `/api/v1`, task queue endpoints, batch create/action endpoints, and a Mofang finance integration module packaged automatically by GitHub Actions. |
+| Operations | Dashboard statistics, host resource overview, routing overview, swap management, CLI-only mode, and release artifacts generated by GitHub Actions. |
+
+### 中文
+
+| 模块 | CLICD 提供的能力 |
+| --- | --- |
+| 虚拟化管理 | 在同一个面板里管理 LXC 容器和 KVM 虚拟机，支持创建、重装、开机、关机、重启、删除、重置密码、到期时间和批量操作。 |
+| 镜像与模板 | 内置模板和镜像管理，支持 Ubuntu、Debian、Alpine、CentOS、Arch Linux、Fedora、Rocky Linux 等常见发行版，镜像可按需下载、取消、启用、禁用和清理缓存。 |
+| 网络能力 | 支持 NAT4 端口配额、随机可用端口、TCP/UDP 端口映射、公网 IPv4 池管理、IPv6 前缀检测、IPv6 状态检查和容器级 IPv6 分配。 |
+| 资源限制 | 支持 CPU、内存、磁盘、Swap、带宽用量、流量重置、流量限制和资源限制管理；容器到期或超额后可自动关机，避免资源和流量失控。 |
+| 远程控制 | 内置 WebSSH 和 WebVNC 票据访问，用户可以直接在浏览器打开终端或控制台，不需要手动复制连接信息。 |
+| 快照能力 | 支持快照总览、容器快照、创建快照、删除快照、恢复快照、计划快照和快照配额。 |
+| 安全告警 | 基于 conntrack 做轻量安全检测，可识别端口扫描、横向扫描、爆破倾向、SMTP 滥用、UDP 反射、挖矿端口、代理/VPN/Tor 等风险，并提供安全日志、汇总和设置项。 |
+| 账号与审计 | 支持子用户管理链接、子用户密码轮换、按容器授权、操作日志、登录日志和 API Key 管理，适合分发给下游用户或拼车用户。 |
+| 自动化接入 | 全量接口统一使用 `/api/v1`，覆盖任务队列、容器、镜像、网络、流量、安全、批量创建和批量操作；同时提供魔方财务对接模块，并由 GitHub Actions 自动打包发布。 |
+| 运维入口 | 提供总览统计、主机资源、路由概览、Swap 管理、CLI-only 模式和 GitHub Actions 自动发布产物，便于在小型节点上长期维护。 |
+
+## Technology Stack / 技术栈
+
+- Backend: Go, net/http, LXC, KVM/libvirt, cgroup v2, iptables, conntrack
+- Frontend: React, TypeScript, Vite, Tailwind CSS, lucide-react, xterm.js
+- Runtime: Linux, systemd, LXC, KVM/QEMU
+- Build: GitHub Actions, Node.js 20, Go 1.24
+
+## Preview / 预览
 ![alt text](/img/image-2.png)
+![alt text](/img/image-3.png)
+![alt text](/img/image-4.png)
+![alt text](/img/image-5.png)
 
 
 ## Disclaimer/免责声明
@@ -99,10 +112,11 @@ This open-source software is intended solely for educational purposes, specifica
 本开源软件仅供学习和研究 LXC、KVM 等虚拟化技术原理之目的使用，不得用于任何违反适用法律法规、软件许可协议或第三方权益的行为。
 
 本软件中涉及的 Windows 名称、标识、图标及相关知识产权均归 Microsoft Corporation 及其权利人所有。本项目与微软公司不存在任何关联、授权或合作关系。
-## Thanks/鸣谢
-
+## Thanks / 鸣谢
+- [Nodeseek.com](https://www.nodeseek.com) — 一个专注于服务器的社区
 - [Linux.do](https://linux.do) — 一个充满灵感的科技社区
 
+
 ## Star History
 
 <a href="https://www.star-history.com/?repos=MengMengCode%2FCLICD&type=date&legend=top-left">

backend/internal/api/auth.go

@@ -90,7 +90,7 @@ func hasScope(r *http.Request, scope string) bool {
 
 func subUserScopeAllowed(scope string) bool {
 	switch scope {
-	case "container:read", "container:power", "container:reinstall", "container:network",
+	case "container:read", "container:power", "container:reinstall", "container:password", "container:network",
 		"dashboard:read", "image:read", "task:read", "snapshot:read", "snapshot:create", "snapshot:delete", "snapshot:restore", "snapshot:schedule",
 		"terminal:ssh", "terminal:vnc":
 		return true

backend/internal/api/firewall.go

@@ -0,0 +1,257 @@
+package api
+
+import (
+	"encoding/json"
+	"math/rand"
+	"net/http"
+	"net/netip"
+	"strconv"
+	"strings"
+
+	"clicd/internal/config"
+	"clicd/internal/lxc"
+)
+
+func generateFirewallRuleID() string {
+	const chars = "abcdefghijklmnopqrstuvwxyz0123456789"
+	b := make([]byte, 8)
+	for i := range b {
+		b[i] = chars[rand.Intn(len(chars))]
+	}
+	return string(b)
+}
+
+func getFirewall(w http.ResponseWriter, r *http.Request, id int) {
+	c := config.FindContainer(id)
+	if c == nil {
+		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Container not found"})
+		return
+	}
+	jsonResponse(w, http.StatusOK, APIResponse{
+		Success: true,
+		Data: map[string]interface{}{
+			"enabled":        c.FirewallEnabled,
+			"default_action": normalizeFirewallDefaultAction(c.FirewallDefaultAction),
+			"rules":          c.FirewallRules,
+		},
+	})
+}
+
+func updateFirewall(w http.ResponseWriter, r *http.Request, id int) {
+	c := config.FindContainer(id)
+	if c == nil {
+		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Container not found"})
+		return
+	}
+
+	var req struct {
+		Enabled       *bool                  `json:"enabled"`
+		DefaultAction *string                `json:"default_action"`
+		Rules         *[]config.FirewallRule `json:"rules"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+		return
+	}
+
+	oldEnabled := c.FirewallEnabled
+	oldDefaultAction := c.FirewallDefaultAction
+	oldRules := append([]config.FirewallRule(nil), c.FirewallRules...)
+
+	if req.Enabled != nil {
+		c.FirewallEnabled = *req.Enabled
+	}
+	if req.DefaultAction != nil {
+		action := normalizeFirewallDefaultAction(*req.DefaultAction)
+		if action == "" {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid default action"})
+			return
+		}
+		c.FirewallDefaultAction = action
+	} else if strings.TrimSpace(c.FirewallDefaultAction) == "" {
+		c.FirewallDefaultAction = "DROP"
+	}
+	if req.Rules != nil {
+		// Validate and assign IDs to new rules
+		rules := *req.Rules
+		for i := range rules {
+			rules[i].Direction = strings.ToLower(strings.TrimSpace(rules[i].Direction))
+			rules[i].Protocol = strings.ToLower(strings.TrimSpace(rules[i].Protocol))
+			rules[i].Action = strings.ToUpper(strings.TrimSpace(rules[i].Action))
+			rules[i].Network = normalizeFirewallNetwork(rules[i].Network)
+			rules[i].SourceIP = strings.TrimSpace(rules[i].SourceIP)
+			rules[i].Port = strings.TrimSpace(rules[i].Port)
+
+			if rules[i].Network == "" {
+				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid network"})
+				return
+			}
+			if rules[i].Direction != "in" && rules[i].Direction != "out" {
+				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid direction: " + rules[i].Direction})
+				return
+			}
+			if rules[i].Protocol != "tcp" && rules[i].Protocol != "udp" && rules[i].Protocol != "icmp" && rules[i].Protocol != "all" {
+				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid protocol: " + rules[i].Protocol})
+				return
+			}
+			if rules[i].Action != "ACCEPT" && rules[i].Action != "DROP" {
+				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid action: " + rules[i].Action})
+				return
+			}
+			if rules[i].SourceIP != "" {
+				if err := validateFirewallIPSpec(rules[i].SourceIP, rules[i].Network); err != nil {
+					jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid IP: " + err.Error()})
+					return
+				}
+			}
+			if rules[i].ID == "" || strings.HasPrefix(rules[i].ID, "tmp-") {
+				rules[i].ID = generateFirewallRuleID()
+			}
+			// Validate port spec
+			if rules[i].Port != "" {
+				if rules[i].Protocol != "tcp" && rules[i].Protocol != "udp" {
+					jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Ports are only supported for TCP and UDP rules"})
+					return
+				}
+				if err := validatePortSpec(rules[i].Port); err != nil {
+					jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid port: " + err.Error()})
+					return
+				}
+			}
+		}
+		c.FirewallRules = rules
+	}
+
+	// Apply firewall rules to iptables if container is running
+	if c.Status == "running" {
+		if err := lxc.ApplyFirewallRules(id); err != nil {
+			c.FirewallEnabled = oldEnabled
+			c.FirewallDefaultAction = oldDefaultAction
+			c.FirewallRules = oldRules
+			_ = lxc.ApplyFirewallRules(id)
+			config.SaveConfig()
+			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to apply firewall rules: " + err.Error()})
+			return
+		}
+	} else if !c.FirewallEnabled {
+		// If disabled and not running, clean any lingering rules
+		lxc.CleanFirewallRules(id)
+	}
+	config.SaveConfig()
+
+	jsonResponse(w, http.StatusOK, APIResponse{
+		Success: true,
+		Message: "Firewall updated",
+		Data: map[string]interface{}{
+			"enabled":        c.FirewallEnabled,
+			"default_action": normalizeFirewallDefaultAction(c.FirewallDefaultAction),
+			"rules":          c.FirewallRules,
+		},
+	})
+}
+
+func normalizeFirewallDefaultAction(action string) string {
+	action = strings.ToUpper(strings.TrimSpace(action))
+	if action == "ACCEPT" || action == "DROP" {
+		return action
+	}
+	return ""
+}
+
+func normalizeFirewallNetwork(network string) string {
+	network = strings.ToLower(strings.TrimSpace(network))
+	switch network {
+	case "", "ipv4", "nat4":
+		return "ipv4"
+	case "ipv6":
+		return "ipv6"
+	case "all", "both":
+		return "all"
+	default:
+		return ""
+	}
+}
+
+func validatePortSpec(port string) error {
+	port = strings.TrimSpace(port)
+	if port == "" {
+		return nil
+	}
+	// Support: "22", "80,443", "8000-9000", "80,443,8000-9000"
+	partCount := 0
+	for _, part := range strings.Split(port, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			return &portValidationError{port}
+		}
+		partCount++
+		if strings.Contains(part, "-") {
+			// Range
+			bounds := strings.SplitN(part, "-", 2)
+			lo, err := strconv.Atoi(strings.TrimSpace(bounds[0]))
+			if err != nil || lo < 1 || lo > 65535 {
+				return &portValidationError{part}
+			}
+			hi, err := strconv.Atoi(strings.TrimSpace(bounds[1]))
+			if err != nil || hi < 1 || hi > 65535 {
+				return &portValidationError{part}
+			}
+			if hi < lo {
+				return &portValidationError{part}
+			}
+		} else {
+			p, err := strconv.Atoi(part)
+			if err != nil || p < 1 || p > 65535 {
+				return &portValidationError{part}
+			}
+		}
+	}
+	if partCount > 15 {
+		return &portValidationError{"too many ports; maximum 15 items per rule"}
+	}
+	return nil
+}
+
+func validateFirewallIPSpec(value string, network string) error {
+	var addr netip.Addr
+	if strings.Contains(value, "/") {
+		prefix, err := netip.ParsePrefix(value)
+		if err != nil {
+			return err
+		}
+		addr = prefix.Addr()
+	} else {
+		parsed, err := netip.ParseAddr(value)
+		if err != nil {
+			return err
+		}
+		addr = parsed
+	}
+	switch network {
+	case "ipv4":
+		if !addr.Is4() {
+			return &ipValidationError{"IPv4 rule requires an IPv4 address or CIDR: " + value}
+		}
+	case "ipv6":
+		if !addr.Is6() || addr.Is4In6() {
+			return &ipValidationError{"IPv6 rule requires an IPv6 address or CIDR: " + value}
+		}
+	}
+	return nil
+}
+
+type ipValidationError struct {
+	value string
+}
+
+func (e *ipValidationError) Error() string {
+	return e.value
+}
+
+type portValidationError struct {
+	port string
+}
+
+func (e *portValidationError) Error() string {
+	return "invalid port value: " + e.port
+}

backend/internal/api/handlers.go

@@ -182,6 +182,16 @@ func HandleSingleContainer(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		deletePortMapping(w, r, id, strings.TrimPrefix(action, "port-mappings/"))
+	case action == "firewall" && r.Method == http.MethodGet:
+		if !requireScope(w, r, "container:network") {
+			return
+		}
+		getFirewall(w, r, id)
+	case action == "firewall" && r.Method == http.MethodPut:
+		if !requireScope(w, r, "container:network") {
+			return
+		}
+		updateFirewall(w, r, id)
 	case r.Method == http.MethodGet:
 		if !requireScope(w, r, "container:read") {
 			return

backend/internal/api/security.go

@@ -180,6 +180,12 @@ func (ss *SecurityScanner) monitorLoop() {
 	}
 }
 
+func (ss *SecurityScanner) alertCount() int {
+	ss.mu.Lock()
+	defer ss.mu.Unlock()
+	return len(ss.alerts)
+}
+
 func (ss *SecurityScanner) checkAllContainers() {
 	for _, c := range config.AppConfig.Containers {
 		if c.Status != "running" || c.IP == "" {
@@ -208,6 +214,7 @@ func (ss *SecurityScanner) checkContainer(name, ip string) {
 		return
 	}
 
+	alertBefore := ss.alertCount()
 	ss.detectPortScans(name, ip, stats)
 	ss.detectBruteForce(name, ip, stats)
 	ss.detectSpam(name, ip, stats)
@@ -216,6 +223,11 @@ func (ss *SecurityScanner) checkContainer(name, ip string) {
 	ss.detectMining(name, ip, stats)
 	ss.detectProxyAndTor(name, ip, stats)
 	ss.detectMalware(name, ip, stats)
+
+	// If new alerts were generated, snapshot the conntrack data for later retrieval.
+	if ss.alertCount() > alertBefore {
+		config.SaveConntrackSnapshot(ip, lines)
+	}
 }
 
 func newTrafficStats() *trafficStats {
@@ -759,28 +771,49 @@ func HandleSecurityLogs(w http.ResponseWriter, r *http.Request) {
 
 func getConnectionLogs(ip string) []map[string]interface{} {
 	logs := make([]map[string]interface{}, 0)
+	seen := map[string]bool{}
 
-	for _, line := range readConntrackLines(ip) {
+	parseLine := func(line string) map[string]interface{} {
 		srcIP := extractField(line, "src=")
 		dstIP := extractField(line, "dst=")
 		srcPort := extractField(line, "sport=")
 		dstPort := extractField(line, "dport=")
-
 		sPort, _ := strconv.Atoi(srcPort)
 		dPort, _ := strconv.Atoi(dstPort)
-
-		logs = append(logs, map[string]interface{}{
+		return map[string]interface{}{
 			"src_ip":   srcIP,
 			"dst_ip":   dstIP,
 			"src_port": sPort,
 			"dst_port": dPort,
 			"protocol": extractProtocol(line),
 			"state":    extractConnState(line),
-		})
+		}
+	}
 
+	// First, load stored snapshots from database (persisted at alert time).
+	for _, line := range config.GetConntrackSnapshotLines(ip) {
 		if len(logs) >= 100 {
 			break
 		}
+		key := strings.TrimSpace(line)
+		if key == "" || seen[key] {
+			continue
+		}
+		seen[key] = true
+		logs = append(logs, parseLine(line))
+	}
+
+	// Then, merge live conntrack data (deduplicated).
+	for _, line := range readConntrackLines(ip) {
+		if len(logs) >= 100 {
+			break
+		}
+		key := strings.TrimSpace(line)
+		if key == "" || seen[key] {
+			continue
+		}
+		seen[key] = true
+		logs = append(logs, parseLine(line))
 	}
 
 	return logs

backend/internal/api/subuser.go

@@ -373,6 +373,15 @@ func SubUserMiddleware(next http.HandlerFunc) http.HandlerFunc {
 			return
 		}
 
+		imagesEnabledPath := "/api/images/enabled"
+		if strings.HasPrefix(path, "/api/v1/") {
+			imagesEnabledPath = "/api/v1/images/enabled"
+		}
+		if path == imagesEnabledPath && r.Method == http.MethodGet {
+			next(w, r)
+			return
+		}
+
 		if path == containerListPath {
 			if r.Method != http.MethodGet {
 				jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Sub-users cannot create containers"})
@@ -503,7 +512,7 @@ func isSubUserContainerActionAllowed(action string, method string) bool {
 		return method == http.MethodPost
 	case strings.HasPrefix(action, "snapshots/"):
 		return method == http.MethodDelete || method == http.MethodPost
-	case action == "start" || action == "stop" || action == "restart" || action == "reinstall":
+	case action == "start" || action == "stop" || action == "restart" || action == "reinstall" || action == "reset-password":
 		return method == http.MethodPost
 	case strings.HasPrefix(action, "port-mappings/"):
 		return method == http.MethodPut

backend/internal/cli/cli.go

@@ -34,7 +34,7 @@ var cliTranslations = map[string]string{
 	"请选择操作":             "Select an action",
 	"再见":                "Goodbye",
 	"无效选择":              "Invalid choice",
-	"CLICD - LXC 容器管理器": "CLICD - LXC Container Manager",
+	"CLICD - LXC 容器管理器": "CLICD - Container Manager",
 	"Web 面板":            "Web panel",
 	"端口":                "port",
 	"运行中":               "running",

backend/internal/config/config.go

@@ -22,6 +22,18 @@ type PortMapping struct {
 	Description   string `json:"description"`
 }
 
+type FirewallRule struct {
+	ID          string `json:"id"`
+	Network     string `json:"network,omitempty"` // "ipv4", "ipv6", or "all"; empty defaults to "ipv4"
+	Direction   string `json:"direction"`         // "in" or "out"
+	Protocol    string `json:"protocol"`          // "tcp", "udp", "icmp", "all"
+	Port        string `json:"port"`              // "" = all, "22", "80,443", "8000-9000"
+	SourceIP    string `json:"source_ip"`         // "" = any
+	Action      string `json:"action"`            // "ACCEPT" or "DROP"
+	Description string `json:"description"`
+	Enabled     bool   `json:"enabled"`
+}
+
 type PublicIPv4Assignment struct {
 	Address   string `json:"address"`
 	Interface string `json:"interface,omitempty"`
@@ -124,6 +136,9 @@ type Container struct {
 	SSHHostKey                    string                 `json:"ssh_host_key,omitempty"`
 	PortMappings                  []PortMapping          `json:"port_mappings"`
 	PortMappingLimit              int                    `json:"port_mapping_limit"`
+	FirewallEnabled               bool                   `json:"firewall_enabled"`
+	FirewallDefaultAction         string                 `json:"firewall_default_action"`
+	FirewallRules                 []FirewallRule         `json:"firewall_rules"`
 	SnapshotLimit                 int                    `json:"snapshot_limit"`
 	CreatedAt                     string                 `json:"created_at"`
 	ExpiresAt                     string                 `json:"expires_at"`

backend/internal/config/store_sqlite.go

@@ -254,6 +254,14 @@ func ensureSchema() error {
 			success INTEGER,
 			error TEXT
 		)`,
+		`CREATE TABLE IF NOT EXISTS security_conntrack_snapshots (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			container_ip TEXT NOT NULL,
+			line TEXT NOT NULL,
+			captured_at TEXT NOT NULL
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_conntrack_snapshots_ip_time
+			ON security_conntrack_snapshots(container_ip, captured_at)`,
 		`CREATE TABLE IF NOT EXISTS tasks (
 			id TEXT PRIMARY KEY,
 			type TEXT,
@@ -356,6 +364,9 @@ func ensureSchemaMigrations() error {
 		{"port_mappings", "host_ip", "TEXT"},
 		{"container_public_ipv4s", "prefix_len", "INTEGER"},
 		{"container_public_ipv4s", "gateway", "TEXT"},
+		{"containers", "firewall_enabled", "INTEGER NOT NULL DEFAULT 0"},
+		{"containers", "firewall_default_action", "TEXT NOT NULL DEFAULT 'DROP'"},
+		{"containers", "firewall_rules", "TEXT"},
 	} {
 		if err := ensureColumn(column.table, column.name, column.def); err != nil {
 			return err
@@ -575,8 +586,9 @@ func saveContainers(tx *sql.Tx) error {
 			ssh_host_key, port_mapping_limit, snapshot_limit, created_at, expires_at,
 			snapshot_schedule_enabled, snapshot_schedule_interval_hours, snapshot_schedule_time,
 			snapshot_schedule_last_run, snapshot_schedule_next_run, snapshot_schedule_created_by,
-			policy_blocked, policy_blocked_reason, policy_blocked_at
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+			policy_blocked, policy_blocked_reason, policy_blocked_at,
+			firewall_enabled, firewall_default_action, firewall_rules
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 			c.ID, c.UUID, c.Name, c.Virtualization, c.LXCName, c.KVMName, c.DiskImage, c.MACAddress, c.Template,
 			c.VCPU, c.RAMMB, c.DiskGB, c.NetworkBWMbps, c.MonthlyTrafficGB, c.TrafficMode, c.TrafficInGB,
 			c.TrafficOutGB, c.TrafficUsedRX, c.TrafficUsedTX, c.TrafficResetDate, c.IOSpeedMBps,
@@ -585,6 +597,7 @@ func saveContainers(tx *sql.Tx) error {
 			boolInt(c.SnapshotScheduleEnabled), c.SnapshotScheduleIntervalHours, c.SnapshotScheduleTime,
 			c.SnapshotScheduleLastRun, c.SnapshotScheduleNextRun, c.SnapshotScheduleCreatedBy,
 			boolInt(c.PolicyBlocked), c.PolicyBlockedReason, c.PolicyBlockedAt,
+			boolInt(c.FirewallEnabled), normalizeFirewallDefaultAction(c.FirewallDefaultAction), marshalFirewallRules(c.FirewallRules),
 		); err != nil {
 			return err
 		}
@@ -642,6 +655,59 @@ func saveAPIKeys(tx *sql.Tx) error {
 	return nil
 }
 
+// SaveConntrackSnapshot stores raw conntrack lines for a container IP.
+func SaveConntrackSnapshot(containerIP string, lines []string) {
+	if db == nil || len(lines) == 0 || strings.TrimSpace(containerIP) == "" {
+		return
+	}
+	now := time.Now().Format("2006-01-02 15:04:05")
+	tx, err := db.Begin()
+	if err != nil {
+		return
+	}
+	defer tx.Rollback()
+	stmt, err := tx.Prepare(`INSERT INTO security_conntrack_snapshots (container_ip, line, captured_at) VALUES (?, ?, ?)`)
+	if err != nil {
+		return
+	}
+	defer stmt.Close()
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		stmt.Exec(containerIP, line, now)
+	}
+	tx.Commit()
+
+	// Cleanup old snapshots (>1 hour)
+	db.Exec(`DELETE FROM security_conntrack_snapshots WHERE captured_at < ?`,
+		time.Now().Add(-1*time.Hour).Format("2006-01-02 15:04:05"))
+}
+
+// GetConntrackSnapshotLines returns stored conntrack lines for a container IP.
+func GetConntrackSnapshotLines(containerIP string) []string {
+	if db == nil || strings.TrimSpace(containerIP) == "" {
+		return nil
+	}
+	rows, err := db.Query(
+		`SELECT line FROM security_conntrack_snapshots WHERE container_ip = ? ORDER BY captured_at DESC LIMIT 200`,
+		containerIP,
+	)
+	if err != nil {
+		return nil
+	}
+	defer rows.Close()
+	var lines []string
+	for rows.Next() {
+		var line string
+		if rows.Scan(&line) == nil {
+			lines = append(lines, line)
+		}
+	}
+	return lines
+}
+
 func saveAuditLogs(tx *sql.Tx) error {
 	for _, log := range AppConfig.AuditLogs {
 		successSet := 0
@@ -728,7 +794,8 @@ func loadContainers() ([]Container, error) {
 		ssh_host_key, port_mapping_limit, snapshot_limit, created_at, expires_at,
 		snapshot_schedule_enabled, snapshot_schedule_interval_hours, snapshot_schedule_time,
 		snapshot_schedule_last_run, snapshot_schedule_next_run, snapshot_schedule_created_by,
-		policy_blocked, policy_blocked_reason, policy_blocked_at
+		policy_blocked, policy_blocked_reason, policy_blocked_at,
+		firewall_enabled, firewall_default_action, firewall_rules
 		FROM containers ORDER BY id`)
 	if err != nil {
 		return nil, err
@@ -738,7 +805,9 @@ func loadContainers() ([]Container, error) {
 	result := []Container{}
 	for rows.Next() {
 		var c Container
-		var scheduleEnabled, policyBlocked int
+		var scheduleEnabled, policyBlocked, firewallEnabled int
+		var firewallDefaultAction string
+		var firewallRulesJSON sql.NullString
 		if err := rows.Scan(
 			&c.ID, &c.UUID, &c.Name, &c.Virtualization, &c.LXCName, &c.KVMName, &c.DiskImage, &c.MACAddress, &c.Template,
 			&c.VCPU, &c.RAMMB, &c.DiskGB, &c.NetworkBWMbps, &c.MonthlyTrafficGB, &c.TrafficMode, &c.TrafficInGB,
@@ -748,11 +817,17 @@ func loadContainers() ([]Container, error) {
 			&scheduleEnabled, &c.SnapshotScheduleIntervalHours, &c.SnapshotScheduleTime,
 			&c.SnapshotScheduleLastRun, &c.SnapshotScheduleNextRun, &c.SnapshotScheduleCreatedBy,
 			&policyBlocked, &c.PolicyBlockedReason, &c.PolicyBlockedAt,
+			&firewallEnabled, &firewallDefaultAction, &firewallRulesJSON,
 		); err != nil {
 			return nil, err
 		}
 		c.SnapshotScheduleEnabled = scheduleEnabled != 0
 		c.PolicyBlocked = policyBlocked != 0
+		c.FirewallEnabled = firewallEnabled != 0
+		c.FirewallDefaultAction = normalizeFirewallDefaultAction(firewallDefaultAction)
+		if firewallRulesJSON.Valid && strings.TrimSpace(firewallRulesJSON.String) != "" {
+			_ = json.Unmarshal([]byte(firewallRulesJSON.String), &c.FirewallRules)
+		}
 		result = append(result, c)
 	}
 	if err := rows.Err(); err != nil {
@@ -1106,6 +1181,25 @@ func boolInt(value bool) int {
 	return 0
 }
 
+func marshalFirewallRules(rules []FirewallRule) interface{} {
+	if len(rules) == 0 {
+		return nil
+	}
+	data, err := json.Marshal(rules)
+	if err != nil {
+		return nil
+	}
+	return string(data)
+}
+
+func normalizeFirewallDefaultAction(action string) string {
+	action = strings.ToUpper(strings.TrimSpace(action))
+	if action == "ACCEPT" {
+		return "ACCEPT"
+	}
+	return "DROP"
+}
+
 func boolPtrInt(value *bool) interface{} {
 	if value == nil {
 		return nil

backend/internal/kvm/kvm.go

@@ -84,6 +84,7 @@ var (
 	lastTrafficSnapshot = map[string]trafficSample{}
 	kvmSnapshotMu       sync.Mutex
 	kvmSSHEnsureLocks   sync.Map
+	knownSSHHostKeys    sync.Map // TOFU host key store: host:port → ssh.PublicKey
 	portMapApplyMu      sync.Mutex
 	lastPortMapApply    = map[int]time.Time{}
 	windowsMetricsMu    sync.Mutex
@@ -407,6 +408,7 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 	mac := randomMAC()
 	sshPassword := generateRandomString(16)
 	sshPublicKey := ""
+	sshAuthMode := ""
 	if !IsWindowsImage(image.ID) {
 		sshAccess, err := lxc.ResolveCreateSSHAccess(cfg)
 		if err != nil {
@@ -414,6 +416,7 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 		}
 		sshPassword = sshAccess.Password
 		sshPublicKey = sshAccess.PublicKey
+		sshAuthMode = sshAccess.Mode
 	}
 	publicIPv4s, err := lxc.AllocatePublicIPv4Assignments(id, cfg.PublicIPv4s, cfg.IPv4Count, cfg.AssignIPv4)
 	if err != nil {
@@ -429,7 +432,9 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 		ipv6Assignments = assigned
 	}
 	ipv6List := configIPv6AssignmentAddresses(ipv6Assignments)
-	defaultHostIP := lxc.DefaultPortMappingHostIP(publicIPv4s)
+	ipv4List := configIPv4AssignmentAddresses(publicIPv4s)
+	// NAT4 port mappings should bind to the host IP, not the VM's independent public IPv4.
+	defaultHostIP := ""
 
 	var xml string
 	winAdminPassword := ""
@@ -448,7 +453,7 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 		}
 		winAdminPassword = generateWindowsPassword()
 		unattendPath := filepath.Join(m.instanceDir(vmName), "unattend.iso")
-		if err := createWindowsUnattendISO(unattendPath, cfg.Name, winAdminPassword, ipv6List); err != nil {
+		if err := createWindowsUnattendISO(unattendPath, cfg.Name, winAdminPassword, ipv6List, ipv4List); err != nil {
 			return nil, err
 		}
 		xml = windowsDomainXML(vmName, int(cfg.VCPU), cfg.RAMMB, diskPath, ImagePath(image.ID), unattendPath, mac, cfg.IOSpeedMBps, cfg.NetworkBWMbps)
@@ -464,7 +469,7 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 		if err := createOverlayDisk(ImagePath(image.ID), diskPath, cfg.DiskGB); err != nil {
 			return nil, err
 		}
-		if err := createSeedISO(seedPath, vmName, cfg.Name, sshPassword, sshPublicKey, mac, ipv6List, *image); err != nil {
+		if err := createSeedISO(seedPath, vmName, cfg.Name, sshPassword, sshPublicKey, mac, ipv6List, ipv4List, *image, sshAuthMode); err != nil {
 			return nil, err
 		}
 		xml = domainXML(vmName, int(cfg.VCPU), cfg.RAMMB, diskPath, seedPath, mac, cfg.IOSpeedMBps, cfg.NetworkBWMbps, image.Desktop != "")
@@ -585,7 +590,7 @@ func (m *Manager) StartContainer(id int) error {
 			}
 		}
 	}
-	config.UpdateContainerStatus(id, "running")
+	config.UpdateContainerStatus(id, "initializing")
 	// Detect VNC port
 	if _, err := m.RefreshVNCPort(id); err != nil {
 		fmt.Printf("Warning: failed to refresh VNC port for %s: %v\n", name, err)
@@ -621,7 +626,15 @@ func (m *Manager) StartContainer(id int) error {
 		if err := lxc.NewManager().ApplyPortMappings(id); err != nil {
 			return err
 		}
+		if err := lxc.ApplyFirewallRules(id); err != nil {
+			fmt.Printf("Warning: failed to apply firewall rules: %v\n", err)
+		}
 	}
+	// Wait for cloud-init to finish and SSH to be reachable (password-only mode)
+	if !isWindows && c.IP != "" {
+		m.waitForCloudInitReady(name, c.IP, c.SSHPassword)
+	}
+	config.UpdateContainerStatus(id, "running")
 	if c.IPv6 != "" || len(c.IPv6Addresses) > 0 {
 		if err := m.applyIPv6Runtime(c); err != nil {
 			return err
@@ -632,12 +645,71 @@ func (m *Manager) StartContainer(id int) error {
 	return nil
 }
 
+// waitForCloudInitReady waits for cloud-init to finish and SSH to be reachable.
+// tofuHostKeyCallback implements Trust-On-First-Use host key verification.
+// On the first connection to a host, the key is accepted and remembered.
+// Subsequent connections must present the same key or the connection is rejected.
+func tofuHostKeyCallback(hostname string, remote net.Addr, key ssh.PublicKey) error {
+	if stored, ok := knownSSHHostKeys.Load(hostname); ok {
+		if bytes.Equal(stored.(ssh.PublicKey).Marshal(), key.Marshal()) {
+			return nil
+		}
+		return fmt.Errorf("host key mismatch for %s (possible MitM attack)", hostname)
+	}
+	knownSSHHostKeys.Store(hostname, key)
+	return nil
+}
+
+func (m *Manager) waitForCloudInitReady(vmName, ip, password string) {
+	if ip == "" || password == "" {
+		return
+	}
+	deadline := time.Now().Add(3 * time.Minute)
+	target := net.JoinHostPort(ip, "22")
+	sshWasUp := false
+	qgaAttempted := false
+
+	for time.Now().Before(deadline) {
+		client, err := ssh.Dial("tcp", target, &ssh.ClientConfig{
+			User:            "root",
+			Auth:            []ssh.AuthMethod{ssh.Password(password)},
+			HostKeyCallback: tofuHostKeyCallback,
+			Timeout:         5 * time.Second,
+		})
+		if err == nil {
+			client.Close()
+			if !sshWasUp {
+				sshWasUp = true
+				fmt.Printf("KVM %s SSH up, waiting for cloud-init to settle...\n", vmName)
+				time.Sleep(10 * time.Second)
+				continue
+			}
+			fmt.Printf("KVM %s ready\n", vmName)
+			return
+		}
+
+		// Try guest agent ONCE to speed things up, with timeout to avoid blocking
+		if !qgaAttempted && qemuGuestPing(vmName) == nil {
+			qgaAttempted = true
+			ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+			cmd := exec.CommandContext(ctx, "virsh", "qemu-agent-command", vmName,
+				`{"execute":"guest-exec","arguments":{"path":"/bin/sh","arg":["-c","cloud-init status --wait 2>/dev/null; systemctl restart sshd 2>/dev/null || systemctl restart ssh 2>/dev/null; true"],"capture-output":false}}`)
+			cmd.Run()
+			cancel()
+		}
+
+		time.Sleep(5 * time.Second)
+	}
+	fmt.Printf("Warning: KVM %s not ready after 3 minutes\n", vmName)
+}
+
 func (m *Manager) StopContainer(id int) error {
 	c := config.FindContainer(id)
 	if c == nil {
 		return fmt.Errorf("container not found: %d", id)
 	}
 	_ = lxc.NewManager().CleanPortMappings(id)
+	lxc.CleanFirewallRules(id)
 	name := c.VirshName()
 	status, _ := m.GetContainerStatus(name)
 	if status != "running" {
@@ -1115,6 +1187,7 @@ func (m *Manager) prepareVMForColdCopy(id int, name string) (bool, error) {
 		time.Sleep(time.Second)
 	} else {
 		_ = lxc.NewManager().CleanPortMappings(id)
+		lxc.CleanFirewallRules(id)
 	}
 	return wasRunning, nil
 }
@@ -1389,7 +1462,7 @@ func (m *Manager) RefreshNetwork(id int) (string, error) {
 	if changed {
 		config.SaveConfig()
 	}
-	if c.Status == "running" && len(c.PortMappings) > 0 && shouldApplyPortMappings(id, changed) {
+	if c.Status == "running" && shouldApplyPortMappings(id, changed) {
 		if err := lxc.NewManager().ApplyPortMappings(id); err != nil {
 			return ip, err
 		}
@@ -1596,7 +1669,7 @@ func createEmptyDisk(target string, diskGB int) error {
 	return nil
 }
 
-func createWindowsUnattendISO(target, hostname, adminPassword string, ipv6s []string) error {
+func createWindowsUnattendISO(target, hostname, adminPassword string, ipv6s []string, ipv4s []string) error {
 	tool := firstAvailableCommand("genisoimage", "mkisofs", "xorriso")
 	if tool == "" {
 		return fmt.Errorf("one of genisoimage, mkisofs, xorriso is required for Windows unattended setup")
@@ -1622,13 +1695,13 @@ func createWindowsUnattendISO(target, hostname, adminPassword string, ipv6s []st
 	if err := os.WriteFile(filepath.Join(setupScriptsDir, "SetupComplete.cmd"), []byte(windowsSetupCompleteCMD()), 0600); err != nil {
 		return err
 	}
-	if err := os.WriteFile(filepath.Join(clicdDir, "FirstLogon.ps1"), []byte(windowsFirstLogonPowerShell(adminPassword, ipv6s)), 0600); err != nil {
+	if err := os.WriteFile(filepath.Join(clicdDir, "FirstLogon.ps1"), []byte(windowsFirstLogonPowerShell(adminPassword, ipv6s, ipv4s)), 0600); err != nil {
 		return err
 	}
 	if err := os.WriteFile(filepath.Join(dir, "SetupComplete.cmd"), []byte(windowsSetupCompleteCMD()), 0600); err != nil {
 		return err
 	}
-	if err := os.WriteFile(filepath.Join(dir, "FirstLogon.ps1"), []byte(windowsFirstLogonPowerShell(adminPassword, ipv6s)), 0600); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, "FirstLogon.ps1"), []byte(windowsFirstLogonPowerShell(adminPassword, ipv6s, ipv4s)), 0600); err != nil {
 		return err
 	}
 	_ = os.Remove(target)
@@ -1738,7 +1811,7 @@ exit /b 0
 `
 }
 
-func windowsFirstLogonPowerShell(adminPassword string, ipv6s []string) string {
+func windowsFirstLogonPowerShell(adminPassword string, ipv6s []string, ipv4s []string) string {
 	commands := []string{
 		"$ErrorActionPreference='Continue'",
 		"$ProgressPreference='SilentlyContinue'",
@@ -1774,6 +1847,12 @@ func windowsFirstLogonPowerShell(adminPassword string, ipv6s []string) string {
 			windowsIPv6PowerShell(ipv6s),
 		)
 	}
+	ipv4s = normalizeKVMIPv4List(ipv4s)
+	if len(ipv4s) > 0 {
+		commands = append(commands,
+			windowsIPv4PowerShell(ipv4s),
+		)
+	}
 	commands = append(commands,
 		"New-Item -ItemType File -Force -Path 'C:\\CLICD\\init.done' | Out-Null",
 		"} finally { Stop-Transcript | Out-Null }",
@@ -1792,8 +1871,7 @@ func windowsIPv6PowerShell(ipv6s []string) string {
 	}
 	return strings.Join([]string{
 		"$clicdIPv6=@(" + strings.Join(quoted, ",") + ")",
-		"$iface=$null",
-		"for ($i=0; $i -lt 60 -and -not $iface; $i++) { $iface=Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.HardwareInterface } | Sort-Object ifIndex | Select-Object -First 1; if (-not $iface) { Start-Sleep -Seconds 5 } }",
+		// Reuse $iface already found by the main script
 		"if ($iface) {",
 		"  foreach ($ip in $clicdIPv6) {",
 		"    Get-NetIPAddress -InterfaceIndex $iface.ifIndex -AddressFamily IPv6 -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -eq $ip } | Remove-NetIPAddress -Confirm:$false -ErrorAction SilentlyContinue",
@@ -1806,12 +1884,48 @@ func windowsIPv6PowerShell(ipv6s []string) string {
 	}, "\r\n")
 }
 
+func windowsIPv4PowerShell(ipv4s []string) string {
+	ipv4s = normalizeKVMIPv4List(ipv4s)
+	if len(ipv4s) == 0 {
+		return ""
+	}
+	quoted := make([]string, 0, len(ipv4s))
+	for _, ipv4 := range ipv4s {
+		quoted = append(quoted, "'"+strings.ReplaceAll(ipv4, "'", "''")+"'")
+	}
+	return strings.Join([]string{
+		"$clicdIPv4=@(" + strings.Join(quoted, ",") + ")",
+		// Reuse $iface already found by the main script
+		"if ($iface) {",
+		"  foreach ($ip in $clicdIPv4) {",
+		"    Get-NetIPAddress -InterfaceIndex $iface.ifIndex -AddressFamily IPv4 -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -eq $ip } | Remove-NetIPAddress -Confirm:$false -ErrorAction SilentlyContinue",
+		"    New-NetIPAddress -IPAddress $ip -PrefixLength 32 -InterfaceIndex $iface.ifIndex -SkipAsSource:$false -ErrorAction SilentlyContinue | Out-Null",
+		"  }",
+		"}",
+	}, "\r\n")
+}
+
+func normalizeKVMIPv4List(values []string) []string {
+	seen := map[string]bool{}
+	result := make([]string, 0, len(values))
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value == "" || seen[value] {
+			continue
+		}
+		seen[value] = true
+		result = append(result, value)
+	}
+	return result
+}
+
 func shellQuoteWindows(value string) string {
 	return `"` + strings.ReplaceAll(value, `"`, `\"`) + `"`
 }
 
-func createSeedISO(seedPath, instanceID, hostname, password, publicKey, mac string, ipv6s []string, image Image) error {
-	guestSetup := kvmSSHSetupScript(password, publicKey)
+func createSeedISO(seedPath, instanceID, hostname, password, publicKey, mac string, ipv6s []string, ipv4s []string, image Image, sshAuthMode string) error {
+	disablePubkey := sshAuthMode == "password" || sshAuthMode == "auto_password"
+	guestSetup := kvmSSHSetupScript(password, disablePubkey, publicKey)
 	if desktopSetup := kvmDesktopSetupScript(image); desktopSetup != "" {
 		guestSetup += "\n" + desktopSetup
 	}
@@ -1846,29 +1960,40 @@ runcmd:
 %s
 `, hostname, password, authorizedKeys, setupScript)
 	metaData := fmt.Sprintf("instance-id: %s\nlocal-hostname: %s\n", instanceID, hostname)
-	ipv6Block := ""
+
+	// Build static address block (IPv4 + IPv6)
+	ipv4s = normalizeKVMIPv4List(ipv4s)
+	addressBlock := ""
+	addressLines := make([]string, 0, len(ipv4s)+len(ipv6s))
+	for _, ipv4 := range ipv4s {
+		addressLines = append(addressLines, fmt.Sprintf("        - %s/32", ipv4))
+	}
+	for _, ipv6 := range ipv6s {
+		addressLines = append(addressLines, fmt.Sprintf("        - %s/128", ipv6))
+	}
+	if len(addressLines) > 0 {
+		addressBlock = fmt.Sprintf("\n      addresses:\n%s", strings.Join(addressLines, "\n"))
+	}
+
+	// IPv6 routes (only needed when IPv6 addresses are configured)
+	ipv6RouteBlock := ""
 	if len(ipv6s) > 0 {
-		addressLines := make([]string, 0, len(ipv6s))
-		for _, ipv6 := range ipv6s {
-			addressLines = append(addressLines, fmt.Sprintf("        - %s/128", ipv6))
-		}
-		ipv6Block = fmt.Sprintf(`
-      addresses:
-%s
+		ipv6RouteBlock = fmt.Sprintf(`
       routes:
         - to: default
           via: %s
           on-link: true
-          metric: 100`, strings.Join(addressLines, "\n"), ipv6GatewayLinkLocal)
+          metric: 100`, ipv6GatewayLinkLocal)
 	}
+
 	networkConfig := fmt.Sprintf(`version: 2
 ethernets:
   nic0:
     match:
       macaddress: "%s"
     dhcp4: true
-    dhcp6: false%s
-`, strings.ToLower(mac), ipv6Block)
+    dhcp6: false%s%s
+`, strings.ToLower(mac), addressBlock, ipv6RouteBlock)
 	dir := filepath.Dir(seedPath)
 	userPath := filepath.Join(dir, "user-data")
 	metaPath := filepath.Join(dir, "meta-data")
@@ -1900,6 +2025,16 @@ func configIPv6AssignmentAddresses(assignments []config.IPv6Assignment) []string
 	return values
 }
 
+func configIPv4AssignmentAddresses(assignments []config.PublicIPv4Assignment) []string {
+	values := make([]string, 0, len(assignments))
+	for _, item := range assignments {
+		if strings.TrimSpace(item.Address) != "" {
+			values = append(values, strings.TrimSpace(item.Address))
+		}
+	}
+	return values
+}
+
 func normalizeKVMIPv6List(values []string) []string {
 	seen := map[string]bool{}
 	result := make([]string, 0, len(values))
@@ -2356,6 +2491,9 @@ func (m *Manager) EnsureSSH(id int) error {
 		if mapErr := lxc.NewManager().ApplyPortMappings(id); mapErr != nil {
 			return mapErr
 		}
+		if err := lxc.ApplyFirewallRules(id); err != nil {
+			fmt.Printf("Warning: failed to apply firewall rules: %v\n", err)
+		}
 		return nil
 	}
 	if lastErr == nil {
@@ -2368,11 +2506,11 @@ func runKVMGuestAgentSSHSetup(name string, password string) error {
 	if err := qemuGuestPing(name); err != nil {
 		return err
 	}
-	return qemuGuestExec(name, kvmSSHSetupScript(password), 180*time.Second)
+	return qemuGuestExec(name, kvmSSHSetupScript(password, false), 180*time.Second)
 }
 
 func runKVMSSHSetup(client *ssh.Client, password string) error {
-	return runKVMSSHScript(client, kvmSSHSetupScript(password), "KVM SSH", 150*time.Second)
+	return runKVMSSHScript(client, kvmSSHSetupScript(password, false), "KVM SSH", 150*time.Second)
 }
 
 func runKVMSSHScript(client *ssh.Client, script string, description string, timeout time.Duration) error {
@@ -2401,12 +2539,16 @@ func runKVMSSHScript(client *ssh.Client, script string, description string, time
 	}
 }
 
-func kvmSSHSetupScript(password string, publicKeys ...string) string {
+func kvmSSHSetupScript(password string, disablePubkeyAuth bool, publicKeys ...string) string {
 	publicKey := ""
 	if len(publicKeys) > 0 {
 		publicKey = strings.TrimSpace(publicKeys[0])
 	}
-	return `set -u
+	pubkeyValue := "yes"
+	if disablePubkeyAuth {
+		pubkeyValue = "no"
+	}
+	script := `set -u
 ROOT_PASSWORD=` + shellQuote(password) + `
 SSH_PUBLIC_KEY=` + shellQuote(publicKey) + `
 export DEBIAN_FRONTEND=noninteractive
@@ -2435,7 +2577,7 @@ fi
 mkdir -p /etc/ssh/sshd_config.d
 cat > /etc/ssh/sshd_config.d/99-clicd-root.conf <<'EOF'
 PermitRootLogin yes
-PubkeyAuthentication yes
+PubkeyAuthentication __CLICD_PUBKEY_AUTH__
 PasswordAuthentication yes
 KbdInteractiveAuthentication yes
 ChallengeResponseAuthentication yes
@@ -2443,8 +2585,8 @@ EOF
 if [ -f /etc/ssh/sshd_config ]; then
 	grep -q '^PermitRootLogin ' /etc/ssh/sshd_config && sed -i 's/^PermitRootLogin .*/PermitRootLogin yes/' /etc/ssh/sshd_config || printf '\nPermitRootLogin yes\n' >> /etc/ssh/sshd_config
 	grep -q '^#PermitRootLogin ' /etc/ssh/sshd_config && sed -i 's/^#PermitRootLogin .*/PermitRootLogin yes/' /etc/ssh/sshd_config || true
-	grep -q '^PubkeyAuthentication ' /etc/ssh/sshd_config && sed -i 's/^PubkeyAuthentication .*/PubkeyAuthentication yes/' /etc/ssh/sshd_config || printf '\nPubkeyAuthentication yes\n' >> /etc/ssh/sshd_config
-	grep -q '^#PubkeyAuthentication ' /etc/ssh/sshd_config && sed -i 's/^#PubkeyAuthentication .*/PubkeyAuthentication yes/' /etc/ssh/sshd_config || true
+	grep -q '^PubkeyAuthentication ' /etc/ssh/sshd_config && sed -i 's/^PubkeyAuthentication .*/PubkeyAuthentication __CLICD_PUBKEY_AUTH__/' /etc/ssh/sshd_config || printf '\nPubkeyAuthentication __CLICD_PUBKEY_AUTH__\n' >> /etc/ssh/sshd_config
+	grep -q '^#PubkeyAuthentication ' /etc/ssh/sshd_config && sed -i 's/^#PubkeyAuthentication .*/PubkeyAuthentication __CLICD_PUBKEY_AUTH__/' /etc/ssh/sshd_config || true
 	grep -q '^PasswordAuthentication ' /etc/ssh/sshd_config && sed -i 's/^PasswordAuthentication .*/PasswordAuthentication yes/' /etc/ssh/sshd_config || printf '\nPasswordAuthentication yes\n' >> /etc/ssh/sshd_config
 	grep -q '^#PasswordAuthentication ' /etc/ssh/sshd_config && sed -i 's/^#PasswordAuthentication .*/PasswordAuthentication yes/' /etc/ssh/sshd_config || true
 	grep -q '^KbdInteractiveAuthentication ' /etc/ssh/sshd_config && sed -i 's/^KbdInteractiveAuthentication .*/KbdInteractiveAuthentication yes/' /etc/ssh/sshd_config || printf '\nKbdInteractiveAuthentication yes\n' >> /etc/ssh/sshd_config
@@ -2459,7 +2601,10 @@ if [ -n "$SSH_PUBLIC_KEY" ]; then
 	chown -R root:root /root/.ssh 2>/dev/null || true
 fi
 if command -v chpasswd >/dev/null 2>&1; then
-	printf 'root:%s\n' "$ROOT_PASSWORD" | chpasswd || true
+	printf 'root:%s\n' "$ROOT_PASSWORD" | chpasswd 2>/tmp/clicd-chpasswd.log && echo "root password set via chpasswd" || echo "WARNING: chpasswd failed: $(cat /tmp/clicd-chpasswd.log 2>/dev/null)"
+elif command -v openssl >/dev/null 2>&1 && command -v usermod >/dev/null 2>&1; then
+	HASH=$(echo "$ROOT_PASSWORD" | openssl passwd -6 -stdin 2>/dev/null)
+	[ -n "$HASH" ] && usermod -p "$HASH" root 2>/dev/null && echo "root password set via openssl/usermod" || echo "WARNING: openssl/usermod failed"
 fi
 ssh-keygen -A >/dev/null 2>&1 || true
 if command -v systemctl >/dev/null 2>&1; then
@@ -2485,6 +2630,8 @@ if [ -w /dev/tty1 ]; then
 	printf '\nCLICD VNC console is ready. Press Enter for login prompt.\n' >/dev/tty1 || true
 fi
 `
+	script = strings.ReplaceAll(script, "__CLICD_PUBKEY_AUTH__", pubkeyValue)
+	return script
 }
 
 func kvmDesktopSetupScript(image Image) string {
@@ -3084,6 +3231,11 @@ func (m *Manager) applyIPv6Runtime(c *config.Container) error {
 		}
 		ensureKVMIPv6NAT66(assignment.Address, uplink)
 	}
+	if c.Status == "running" {
+		if err := lxc.ApplyFirewallRules(c.ID); err != nil {
+			fmt.Printf("Warning: failed to re-apply firewall rules after KVM IPv6 setup for %s: %v\n", c.Name, err)
+		}
+	}
 	return nil
 }
 
@@ -3160,7 +3312,7 @@ func ensureKVMIPv6ForwardRules(ipv6 string, bridge string) {
 	}
 	for _, rule := range rules {
 		check := append([]string{"-C"}, rule...)
-		add := append([]string{"-I"}, append([]string{rule[0], "1"}, rule[1:]...)...)
+		add := append([]string{"-A"}, rule...)
 		if exec.Command("ip6tables", check...).Run() != nil {
 			exec.Command("ip6tables", add...).Run()
 		}

backend/internal/lxc/ipv6.go

@@ -1610,6 +1610,9 @@ func (m *Manager) ApplyIPv6(id int) error {
 			ensureIPv6NAT66(assignment.Address, uplink)
 		}
 	}
+	if err := ApplyFirewallRules(c.ID); err != nil {
+		fmt.Printf("Warning: failed to re-apply firewall rules after IPv6 setup for %s: %v\n", c.Name, err)
+	}
 	return nil
 }
 

backend/internal/lxc/lxc.go

@@ -345,12 +345,7 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 
 		// Setup default port mappings (SSH only)
 		portMappings = SetupDefaultPortMappings(sshPort)
-		defaultHostIP := defaultPortMappingHostIP(publicIPv4s)
-		if defaultHostIP != "" {
-			for i := range portMappings {
-				portMappings[i].HostIP = defaultHostIP
-			}
-		}
+		// NAT4 port mappings should bind to the host IP, not the container's independent public IPv4.
 		tempC := &config.Container{ID: id, PublicIPv4s: publicIPv4s, PortMappings: portMappings}
 
 		extraPorts := cfg.ExtraPorts
@@ -364,7 +359,7 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 			pm, err := normalizePortMapping(tempC, -1, config.PortMapping{
 				ContainerPort: containerPort,
 				HostPort:      containerPort,
-				HostIP:        defaultHostIP,
+				HostIP:        "",
 				Protocol:      "tcp",
 				Description:   fmt.Sprintf("Port-%d", containerPort),
 			})
@@ -424,7 +419,7 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 			fmt.Printf("Warning: failed to install IPv6 init in %s: %v\n", lxcName, err)
 		}
 	}
-	if err := m.preconfigureSSH(rootfsPath, cfg.TemplateID); err != nil {
+	if err := m.preconfigureSSH(rootfsPath, cfg.TemplateID, sshAccess.Mode); err != nil {
 		fmt.Printf("Warning: failed to pre-configure SSH in %s: %v\n", lxcName, err)
 	}
 	if sshAccess.PublicKey != "" {
@@ -512,11 +507,13 @@ IPv6AcceptRA=no
 }
 
 // preconfigureSSH installs and configures SSH directly in the rootfs before first boot.
-func (m *Manager) preconfigureSSH(rootfsPath, templateID string) error {
+func (m *Manager) preconfigureSSH(rootfsPath, templateID string, sshAuthMode string) error {
 	_ = templateID
+	// Disable pubkey auth when user chose password-only mode (password or auto_password)
+	disablePubkey := sshAuthMode == SSHAuthPassword || sshAuthMode == SSHAuthAutoPassword
 	ctx, cancel := context.WithTimeout(context.Background(), 180*time.Second)
 	defer cancel()
-	cmd, err := m.rootfsCommand(rootfsPath, "sh", "-c", sshSetupScript(false))
+	cmd, err := m.rootfsCommand(rootfsPath, "sh", "-c", sshSetupScript(false, disablePubkey))
 	if err != nil {
 		return err
 	}
@@ -1327,6 +1324,9 @@ func (m *Manager) StartContainer(id int) error {
 	if err := m.ApplyPortMappings(id); err != nil {
 		fmt.Printf("Warning: failed to apply port mappings: %v\n", err)
 	}
+	if err := ApplyFirewallRules(id); err != nil {
+		fmt.Printf("Warning: failed to apply firewall rules: %v\n", err)
+	}
 	if c.IPv6 != "" || len(c.IPv6Addresses) > 0 {
 		if err := m.ApplyIPv6(id); err != nil {
 			fmt.Printf("Warning: failed to apply IPv6 routing for %s: %v\n", lxcName, err)
@@ -1475,11 +1475,13 @@ func (m *Manager) StopContainer(id int) error {
 	if status != "running" {
 		config.UpdateContainerStatus(id, "stopped")
 		m.CleanPortMappings(id)
+		CleanFirewallRules(id)
 		m.cleanupBandwidthLimit(lxcName)
 		return nil
 	}
 
 	m.CleanPortMappings(id)
+	CleanFirewallRules(id)
 	m.cleanupBandwidthLimit(lxcName)
 
 	cmd := exec.Command("lxc-stop", "-n", lxcName)
@@ -1758,7 +1760,7 @@ func (m *Manager) EnsureSSH(id int) error {
 		config.SaveConfig()
 	}
 
-	script := sshSetupScript(true)
+	script := sshSetupScript(true, false) // keep pubkey enabled for runtime ensure
 
 	ctx, cancel := context.WithTimeout(context.Background(), 180*time.Second)
 	defer cancel()
@@ -1826,7 +1828,11 @@ func (m *Manager) containerPortListening(lxcName string, port int) bool {
 	return exec.CommandContext(ctx, "lxc-attach", "-n", lxcName, "--", "sh", "-c", check).Run() == nil
 }
 
-func sshSetupScript(startService bool) string {
+func sshSetupScript(startService bool, disablePubkeyAuth bool) string {
+	pubkeyValue := "yes"
+	if disablePubkeyAuth {
+		pubkeyValue = "no"
+	}
 	script := `set -u
 
 # DNS setup: handle both traditional /etc/resolv.conf and systemd-resolved (Ubuntu 24.04).
@@ -1945,7 +1951,7 @@ ssh-keygen -A >/dev/null 2>&1 || true
 
 cat >/etc/ssh/sshd_config.d/99-clicd.conf <<'EOF'
 PermitRootLogin yes
-PubkeyAuthentication yes
+PubkeyAuthentication __CLICD_PUBKEY_AUTH__
 PasswordAuthentication yes
 KbdInteractiveAuthentication no
 ChallengeResponseAuthentication no
@@ -1953,7 +1959,7 @@ UsePAM no
 EOF
 
 set_sshd_option PermitRootLogin yes
-set_sshd_option PubkeyAuthentication yes
+set_sshd_option PubkeyAuthentication __CLICD_PUBKEY_AUTH__
 set_sshd_option PasswordAuthentication yes
 set_sshd_option KbdInteractiveAuthentication no
 set_sshd_option ChallengeResponseAuthentication no
@@ -1981,6 +1987,7 @@ ensure_sshd_runtime_dir
 	exit 32
 }
 `
+	script = strings.ReplaceAll(script, "__CLICD_PUBKEY_AUTH__", pubkeyValue)
 	if !startService {
 		return script
 	}
@@ -2054,7 +2061,7 @@ func (m *Manager) ResetSSHPassword(id int, password string) (string, error) {
 			return "", err
 		}
 		rootfsPath := filepath.Join(m.LxcPath, lxcName, "rootfs")
-		if err := m.preconfigureSSH(rootfsPath, c.Template); err != nil {
+		if err := m.preconfigureSSH(rootfsPath, c.Template, ""); err != nil {
 			return "", fmt.Errorf("failed to configure SSH: %v", err)
 		}
 		if err := m.setRootfsPassword(rootfsPath, newPassword); err != nil {
@@ -2583,6 +2590,7 @@ func (m *Manager) ReinstallContainer(id int, templateID string, authConfig ...Co
 
 	// Clean port mappings temporarily
 	m.CleanPortMappings(id)
+	CleanFirewallRules(id)
 
 	// Download the new OS into a temporary container, then replace only the
 	// existing rootfs. The target container directory and config are preserved.
@@ -2626,7 +2634,7 @@ func (m *Manager) ReinstallContainer(id int, templateID string, authConfig ...Co
 		}
 	}
 	c.SSHPassword = sshAccess.Password
-	if err := m.preconfigureSSH(rootfsPath, templateID); err != nil {
+	if err := m.preconfigureSSH(rootfsPath, templateID, sshAccess.Mode); err != nil {
 		fmt.Printf("Warning: failed to pre-configure SSH in %s after reinstall: %v\n", lxcName, err)
 	}
 	if sshAccess.PublicKey != "" {

backend/internal/lxc/portmap.go

@@ -59,11 +59,54 @@ func (m *Manager) ApplyPortMappings(id int) error {
 		}
 	}
 
+	// When container has public IPv4, apply full port passthrough DNAT so the
+	// container owns all ports on its public IP (no NAT management needed).
+	if len(c.PublicIPv4s) > 0 {
+		ensureIndependentIPv4Ingress(c, tag)
+	}
+
 	applyIPv4EgressPolicy(c, bridge, subnet, tag)
 
+	if err := ApplyFirewallRules(id); err != nil {
+		return err
+	}
+
 	return nil
 }
 
+func ensureIndependentIPv4Ingress(c *config.Container, tag string) {
+	if c == nil || c.IP == "" || len(c.PublicIPv4s) == 0 {
+		return
+	}
+
+	for _, assignment := range c.PublicIPv4s {
+		hostIP := strings.TrimSpace(assignment.Address)
+		if hostIP == "" {
+			continue
+		}
+		// Full port passthrough: DNAT all TCP+UDP traffic on this public IP to the container.
+		for _, proto := range []string{"tcp", "udp"} {
+			args := []string{
+				"-t", "nat",
+				"-I", "PREROUTING", "1",
+				"-d", hostIP,
+				"-p", proto,
+				"-j", "DNAT",
+				"--to-destination", c.IP,
+				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-%s-all-%s", tag, natRuleIPTag(hostIP), proto),
+			}
+			cmd := exec.Command("iptables", args...)
+			output, err := cmd.CombinedOutput()
+			if err != nil {
+				fmt.Printf("Warning: failed to apply %s passthrough %s->%s: %v, output: %s\n",
+					proto, hostIP, c.IP, err, string(output))
+				continue
+			}
+			fmt.Printf("IPv4 passthrough (%s): %s -> %s (all ports)\n", proto, hostIP, c.IP)
+		}
+	}
+}
+
 func applyIPv4EgressPolicy(c *config.Container, bridge, subnet, tag string) {
 	if c == nil || strings.TrimSpace(c.IP) == "" {
 		return
@@ -221,8 +264,8 @@ func EnsureForwardRules(bridge string) {
 				break
 			}
 		}
-		insertArgs := append([]string{"-I", "FORWARD", "1"}, args...)
-		exec.Command("iptables", insertArgs...).Run()
+		appendArgs := append([]string{"-A", "FORWARD"}, args...)
+		exec.Command("iptables", appendArgs...).Run()
 	}
 }
 
@@ -529,3 +572,374 @@ func hostPortKey(hostIP string, port int) int {
 	}
 	return port + (sum % 1000000 * 100000)
 }
+
+// CleanFirewallRules removes all firewall rules for a container from the FORWARD chain.
+func CleanFirewallRules(id int) {
+	tag := clicdTag(id)
+	// Remove all rules with the firewall tag prefix
+	cmd := exec.Command("bash", "-c",
+		fmt.Sprintf("iptables -S FORWARD 2>/dev/null | grep 'clicd-%s-fw-' | sed 's/^-A /-D /' | while read rule; do iptables $rule; done", tag))
+	cmd.CombinedOutput()
+	cmd = exec.Command("bash", "-c",
+		fmt.Sprintf("ip6tables -S FORWARD 2>/dev/null | grep 'clicd-%s-fw-' | sed 's/^-A /-D /' | while read rule; do ip6tables $rule; done", tag))
+	cmd.CombinedOutput()
+
+	// Also remove legacy default policy rules (without specific rule ID)
+	for _, suffix := range []string{"default-in", "default-out"} {
+		for _, proto := range []string{"tcp", "udp"} {
+			exec.Command("iptables", "-D", "FORWARD",
+				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-%s-%s", tag, suffix, proto),
+			).CombinedOutput()
+		}
+		exec.Command("ip6tables", "-D", "FORWARD",
+			"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-%s", tag, suffix),
+		).CombinedOutput()
+	}
+}
+
+// ApplyFirewallRules applies iptables FORWARD rules for a container's firewall configuration.
+func ApplyFirewallRules(id int) error {
+	c := config.FindContainer(id)
+	if c == nil {
+		return fmt.Errorf("container not found: %d", id)
+	}
+
+	// Always clean existing firewall rules first
+	CleanFirewallRules(id)
+
+	// If firewall is disabled or no rules, nothing to apply
+	if !c.FirewallEnabled {
+		return nil
+	}
+
+	bridge := "lxcbr0"
+	if c.IsKVM() {
+		bridge = "virbr0"
+	}
+	containerIP := strings.TrimSpace(c.IP)
+	containerIPv6s := firewallIPv6Addresses(c)
+	if containerIP == "" && len(containerIPv6s) == 0 {
+		return nil
+	}
+	tag := clicdTag(id)
+
+	defaultAction := normalizeFirewallDefaultAction(c.FirewallDefaultAction)
+	if defaultAction == "DROP" {
+		if containerIP != "" {
+			if err := applyDefaultFirewallPolicy(tag, bridge, containerIP); err != nil {
+				return err
+			}
+		}
+		if err := applyDefaultFirewallIPv6Policy(tag, bridge, containerIPv6s); err != nil {
+			return err
+		}
+	}
+
+	for i := len(c.FirewallRules) - 1; i >= 0; i-- {
+		rule := c.FirewallRules[i]
+		if !rule.Enabled {
+			continue
+		}
+		if containerIP != "" && firewallRuleAppliesToFamily(rule, true) {
+			if err := applyOneFirewallRule(tag, bridge, containerIP, rule); err != nil {
+				return fmt.Errorf("failed to apply firewall rule %s for container %d: %w", rule.ID, id, err)
+			}
+		}
+		if len(containerIPv6s) > 0 && firewallRuleAppliesToFamily(rule, false) {
+			if err := applyOneFirewallIPv6Rule(tag, bridge, containerIPv6s, rule); err != nil {
+				return fmt.Errorf("failed to apply IPv6 firewall rule %s for container %d: %w", rule.ID, id, err)
+			}
+		}
+	}
+
+	return nil
+}
+
+func normalizeFirewallDefaultAction(action string) string {
+	action = strings.ToUpper(strings.TrimSpace(action))
+	if action == "ACCEPT" {
+		return "ACCEPT"
+	}
+	return "DROP"
+}
+
+func normalizeFirewallNetwork(network string) string {
+	network = strings.ToLower(strings.TrimSpace(network))
+	switch network {
+	case "", "ipv4", "nat4":
+		return "ipv4"
+	case "ipv6":
+		return "ipv6"
+	case "all", "both":
+		return "all"
+	default:
+		return "ipv4"
+	}
+}
+
+func firewallRuleAppliesToFamily(rule config.FirewallRule, ipv4 bool) bool {
+	network := normalizeFirewallNetwork(rule.Network)
+	if network == "ipv4" {
+		return ipv4
+	}
+	if network == "ipv6" {
+		return !ipv4
+	}
+	if rule.SourceIP == "" {
+		return true
+	}
+	addr := firewallIPSpecAddr(rule.SourceIP)
+	if !addr.IsValid() {
+		return true
+	}
+	if ipv4 {
+		return addr.Is4()
+	}
+	return addr.Is6() && !addr.Is4In6()
+}
+
+func firewallIPSpecAddr(value string) netip.Addr {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return netip.Addr{}
+	}
+	if strings.Contains(value, "/") {
+		prefix, err := netip.ParsePrefix(value)
+		if err != nil {
+			return netip.Addr{}
+		}
+		return prefix.Addr()
+	}
+	addr, err := netip.ParseAddr(value)
+	if err != nil {
+		return netip.Addr{}
+	}
+	return addr
+}
+
+func firewallIPv6Addresses(c *config.Container) []string {
+	if c == nil {
+		return nil
+	}
+	c.NormalizeNetworkAssignments()
+	seen := map[string]bool{}
+	result := []string{}
+	for _, assignment := range c.IPv6Addresses {
+		ip := strings.TrimSpace(assignment.Address)
+		if ip == "" || seen[ip] {
+			continue
+		}
+		if addr, err := netip.ParseAddr(ip); err == nil && addr.Is6() && !addr.Is4In6() {
+			seen[ip] = true
+			result = append(result, ip)
+		}
+	}
+	return result
+}
+
+func applyOneFirewallRule(tag, bridge, containerIP string, rule config.FirewallRule) error {
+	commentTag := fmt.Sprintf("clicd-%s-fw-%s", tag, rule.ID)
+
+	// Build base iptables args
+	args := []string{"-I", "FORWARD", "1"}
+
+	// Direction: in = traffic arriving at container (-o bridge -d containerIP)
+	//            out = traffic leaving container (-i bridge -s containerIP)
+	switch rule.Direction {
+	case "in":
+		args = append(args, "-o", bridge, "-d", containerIP+"/32")
+	case "out":
+		args = append(args, "-i", bridge, "-s", containerIP+"/32")
+	default:
+		return fmt.Errorf("invalid direction: %s", rule.Direction)
+	}
+
+	// Protocol
+	switch rule.Protocol {
+	case "tcp", "udp":
+		args = append(args, "-p", rule.Protocol)
+	case "icmp":
+		args = append(args, "-p", "icmp")
+	case "all":
+		// no protocol filter
+	default:
+		return fmt.Errorf("invalid protocol: %s", rule.Protocol)
+	}
+
+	// Port matching (only for tcp/udp)
+	if rule.Port != "" && (rule.Protocol == "tcp" || rule.Protocol == "udp") {
+		// For "in" direction, traffic going TO the container uses --dport
+		// For "out" direction, traffic going FROM the container uses --dport (destination port on remote)
+		args = append(args, firewallPortArgs(rule.Port)...)
+	}
+
+	// Source IP filter (for "out" direction, this matches the remote source; for "in", it matches the sender)
+	if rule.SourceIP != "" {
+		switch rule.Direction {
+		case "in":
+			args = append(args, "-s", rule.SourceIP)
+		case "out":
+			args = append(args, "-d", rule.SourceIP)
+		}
+	}
+
+	// Action
+	action := "DROP"
+	if rule.Action == "ACCEPT" {
+		action = "ACCEPT"
+	}
+	args = append(args, "-j", action)
+
+	// Comment tag for cleanup
+	args = append(args, "-m", "comment", "--comment", commentTag)
+
+	cmd := exec.Command("iptables", args...)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("iptables error: %s", string(output))
+	}
+	return nil
+}
+
+func applyOneFirewallIPv6Rule(tag, bridge string, containerIPs []string, rule config.FirewallRule) error {
+	for _, containerIP := range containerIPs {
+		commentTag := fmt.Sprintf("clicd-%s-fw-%s-v6-%s", tag, rule.ID, firewallCommentIPTag(containerIP))
+		args := []string{"-I", "FORWARD", "1"}
+
+		switch rule.Direction {
+		case "in":
+			args = append(args, "-o", bridge, "-d", containerIP+"/128")
+		case "out":
+			args = append(args, "-i", bridge, "-s", containerIP+"/128")
+		default:
+			return fmt.Errorf("invalid direction: %s", rule.Direction)
+		}
+
+		switch rule.Protocol {
+		case "tcp", "udp":
+			args = append(args, "-p", rule.Protocol)
+		case "icmp":
+			args = append(args, "-p", "ipv6-icmp")
+		case "all":
+		default:
+			return fmt.Errorf("invalid protocol: %s", rule.Protocol)
+		}
+
+		if rule.Port != "" && (rule.Protocol == "tcp" || rule.Protocol == "udp") {
+			args = append(args, firewallPortArgs(rule.Port)...)
+		}
+
+		if rule.SourceIP != "" {
+			switch rule.Direction {
+			case "in":
+				args = append(args, "-s", rule.SourceIP)
+			case "out":
+				args = append(args, "-d", rule.SourceIP)
+			}
+		}
+
+		action := "DROP"
+		if rule.Action == "ACCEPT" {
+			action = "ACCEPT"
+		}
+		args = append(args, "-j", action)
+		args = append(args, "-m", "comment", "--comment", commentTag)
+
+		cmd := exec.Command("ip6tables", args...)
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("ip6tables error: %s", string(output))
+		}
+	}
+	return nil
+}
+
+func firewallPortArgs(port string) []string {
+	spec := normalizePortSpec(port)
+	if strings.Contains(spec, ",") {
+		return []string{"-m", "multiport", "--dports", spec}
+	}
+	return []string{"--dport", spec}
+}
+
+// normalizePortSpec converts user port input to iptables-compatible port spec.
+// "80,443" -> "80,443", "8000-9000" -> "8000:9000", "80,443,8000-9000" -> "80,443,8000:9000"
+func normalizePortSpec(port string) string {
+	port = strings.TrimSpace(port)
+	if port == "" {
+		return ""
+	}
+	parts := strings.Split(port, ",")
+	for i, part := range parts {
+		part = strings.TrimSpace(part)
+		if strings.Contains(part, "-") && !strings.Contains(part, ":") {
+			bounds := strings.SplitN(part, "-", 2)
+			if len(bounds) == 2 {
+				part = strings.TrimSpace(bounds[0]) + ":" + strings.TrimSpace(bounds[1])
+			}
+		}
+		parts[i] = part
+	}
+	return strings.Join(parts, ",")
+}
+
+func applyDefaultFirewallPolicy(tag, bridge, containerIP string) error {
+	defaults := [][]string{
+		{
+			"-I", "FORWARD", "1",
+			"-o", bridge,
+			"-d", containerIP + "/32",
+			"-j", "DROP",
+			"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-default-in", tag),
+		},
+		{
+			"-I", "FORWARD", "1",
+			"-i", bridge,
+			"-s", containerIP + "/32",
+			"-j", "DROP",
+			"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-default-out", tag),
+		},
+	}
+	for _, args := range defaults {
+		cmd := exec.Command("iptables", args...)
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("iptables default firewall error: %s", string(output))
+		}
+	}
+	return nil
+}
+
+func applyDefaultFirewallIPv6Policy(tag, bridge string, containerIPs []string) error {
+	for _, containerIP := range containerIPs {
+		defaults := [][]string{
+			{
+				"-I", "FORWARD", "1",
+				"-o", bridge,
+				"-d", containerIP + "/128",
+				"-j", "DROP",
+				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-default-in-v6-%s", tag, firewallCommentIPTag(containerIP)),
+			},
+			{
+				"-I", "FORWARD", "1",
+				"-i", bridge,
+				"-s", containerIP + "/128",
+				"-j", "DROP",
+				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-fw-default-out-v6-%s", tag, firewallCommentIPTag(containerIP)),
+			},
+		}
+		for _, args := range defaults {
+			cmd := exec.Command("ip6tables", args...)
+			output, err := cmd.CombinedOutput()
+			if err != nil {
+				return fmt.Errorf("ip6tables default firewall error: %s", string(output))
+			}
+		}
+	}
+	return nil
+}
+
+func firewallCommentIPTag(ip string) string {
+	replacer := strings.NewReplacer(":", "_", ".", "_", "/", "_")
+	return replacer.Replace(ip)
+}

backend/internal/server/web/.gitkeep

@@ -0,0 +1 @@
+ 

backend/internal/version/version.go

@@ -1,7 +1,7 @@
 package version
 
 var (
-	Version = "1.1.13"
+	Version = "1.1.18"
 	Repo    = "MengMengCode/CLICD"
 )
 

frontend/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>CLICD - LXC Container Manager</title>
+    <title>CLICD - Container Manager</title>
     <script>
       (function() {
         var theme = localStorage.getItem('clicd_theme');

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clicd-frontend",
   "private": true,
-  "version": "1.1.13",
+  "version": "1.1.18",
   "type": "module",
   "scripts": {
     "dev": "vite",

frontend/src/components/CreateContainerModal.tsx

@@ -321,7 +321,12 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
                 type="checkbox"
                 checked={!!form.assign_ipv4}
                 disabled={!ipv4Available}
-                onChange={(event) => setForm({ ...form, assign_ipv4: event.target.checked, public_ipv4s: event.target.checked ? form.public_ipv4s : [] })}
+                onChange={(event) => setForm({
+                  ...form,
+                  assign_ipv4: event.target.checked,
+                  public_ipv4s: event.target.checked ? form.public_ipv4s : [],
+                  ...(event.target.checked ? { assign_nat: false, port_mapping_count: 0, extra_ports: [] } : {}),
+                })}
                 className="mt-1"
               />
               <span className="min-w-0">
@@ -429,6 +434,7 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
                       assign_nat: checked,
                       port_mapping_count: checked ? Math.max(2, form.port_mapping_count || 2) : 0,
                       extra_ports: [],
+                      ...(checked ? { assign_ipv4: false, public_ipv4s: [], ipv4_count: 0 } : {}),
                     })
                   }}
                   className="mt-1"
@@ -680,9 +686,10 @@ function validateResourceInputs(form: CreateContainerRequest, maxVCPU: number, m
 
 function normalizeCreateForm(form: CreateContainerRequest): CreateContainerRequest {
   const normalized = applyTemplateDefaults(form)
-  const wantsNAT = normalized.assign_nat !== false
   const wantsIPv4 = !!normalized.assign_ipv4
   const wantsIPv6 = !!normalized.assign_ipv6
+  // IPv4 and NAT are mutually exclusive
+  const wantsNAT = wantsIPv4 ? false : normalized.assign_nat !== false
   const linuxTemplate = !isWindowsTemplate(normalized.template_id)
   const sshAuthMode = linuxTemplate ? (normalized.ssh_auth_mode || 'auto_password') : 'auto_password'
   return {

frontend/src/pages/ApiIntegration.tsx

@@ -176,6 +176,8 @@ const endpointGroups: Array<{ title: string; endpoints: EndpointTuple[] }> = [
       ['POST', '/api/v1/containers/{id}/port-mappings', '添加端口映射'],
       ['PUT', '/api/v1/containers/{id}/port-mappings/{index}', '更新端口映射'],
       ['DELETE', '/api/v1/containers/{id}/port-mappings/{index}', '删除端口映射'],
+      ['GET', '/api/v1/containers/{id}/firewall', '获取防火墙设置'],
+      ['PUT', '/api/v1/containers/{id}/firewall', '更新防火墙设置'],
       ['GET', '/api/v1/snapshots', '快照总览'],
       ['GET', '/api/v1/containers/{id}/snapshots', '容器快照'],
       ['POST', '/api/v1/containers/{id}/snapshots', '创建快照'],
@@ -817,6 +819,15 @@ const requestBodySamples: Record<string, Record<string, unknown>> = {
     limit: 64,
   },
   'POST /api/v1/security/check': { container_name: 'example-vm' },
+  'PUT /api/v1/containers/{id}/firewall': {
+    enabled: true,
+    default_action: 'DROP',
+    rules: [
+      { id: '', network: 'ipv4', direction: 'in', protocol: 'tcp', port: '22', source_ip: '', action: 'ACCEPT', description: 'Allow SSH over IPv4/NAT4', enabled: true },
+      { id: '', network: 'ipv6', direction: 'in', protocol: 'tcp', port: '22', source_ip: '', action: 'ACCEPT', description: 'Allow SSH over IPv6', enabled: true },
+      { id: '', network: 'all', direction: 'out', protocol: 'tcp', port: '', source_ip: '', action: 'ACCEPT', description: 'Allow outbound TCP', enabled: true },
+    ],
+  },
   'PUT /api/v1/security/settings': { auto_shutdown: false },
   'POST /api/v1/swap': { action: 'resize', size_mb: 16384 },
   'POST /api/v1/batch-create': {
@@ -1025,6 +1036,31 @@ const responseSamples: Record<string, unknown> = {
     data: [{ container_port: 8081, host_port: 61320, protocol: 'tcp', description: 'HTTP' }],
   },
   'DELETE /api/v1/containers/{id}/port-mappings/{index}': { success: true, data: [] },
+  'GET /api/v1/containers/{id}/firewall': {
+    success: true,
+    data: {
+      enabled: true,
+      default_action: 'DROP',
+      rules: [
+        { id: 'a1b2c3d4', network: 'ipv4', direction: 'in', protocol: 'tcp', port: '22', source_ip: '', action: 'ACCEPT', description: 'Allow SSH over IPv4/NAT4', enabled: true },
+        { id: 'e5f6g7h8', network: 'ipv6', direction: 'in', protocol: 'tcp', port: '22', source_ip: '', action: 'ACCEPT', description: 'Allow SSH over IPv6', enabled: true },
+        { id: 'i9j0k1l2', network: 'all', direction: 'out', protocol: 'tcp', port: '', source_ip: '', action: 'ACCEPT', description: 'Allow outbound TCP', enabled: true },
+      ],
+    },
+  },
+  'PUT /api/v1/containers/{id}/firewall': {
+    success: true,
+    message: 'Firewall updated',
+    data: {
+      enabled: true,
+      default_action: 'DROP',
+      rules: [
+        { id: 'a1b2c3d4', network: 'ipv4', direction: 'in', protocol: 'tcp', port: '22', source_ip: '', action: 'ACCEPT', description: 'Allow SSH over IPv4/NAT4', enabled: true },
+        { id: 'e5f6g7h8', network: 'ipv6', direction: 'in', protocol: 'tcp', port: '22', source_ip: '', action: 'ACCEPT', description: 'Allow SSH over IPv6', enabled: true },
+        { id: 'i9j0k1l2', network: 'all', direction: 'out', protocol: 'tcp', port: '', source_ip: '', action: 'ACCEPT', description: 'Allow outbound TCP', enabled: true },
+      ],
+    },
+  },
   'GET /api/v1/snapshots': { success: true, data: null },
   'GET /api/v1/containers/{id}/snapshots': {
     success: true,
@@ -1139,6 +1175,9 @@ function endpointNoteFor(key: string) {
   if (key === 'POST /api/v1/batch-create') {
     notes.push('批量创建的单个 containers[] 项支持与 POST /api/v1/containers 相同的网络和 SSH 认证字段。')
   }
+  if (key === 'PUT /api/v1/containers/{id}/firewall') {
+    notes.push('兼容旧请求：default_action 可不传，不传时保留现有策略；rule.network 可不传，不传按 ipv4 处理。default_action: DROP=未命中规则时拒绝, ACCEPT=未命中规则时放行。network: ipv4=IPv4 NAT/公网 IPv4, ipv6=IPv6, all=同时应用到 IPv4 和 IPv6。NAT 入站规则的 port 填容器内端口，不是宿主机公网端口。')
+  }
   if (key === 'POST /api/v1/batch-action') {
     notes.push('action=reinstall 时可追加 template_id、ssh_auth_mode、ssh_password、ssh_public_key；其他 action 会忽略这些重装字段。')
   }

frontend/src/pages/ContainerDetail.tsx

@@ -19,7 +19,6 @@ import {
   Plus,
   RefreshCw,
   Save,
-
   Settings,
   Square,
   TerminalSquare,
@@ -47,7 +46,9 @@ import {
   HostInfo,
   TrafficInfo,
   getEnabledImages,
+  getFirewall,
   PortMapping,
+  FirewallRule,
   reinstallContainer,
   resetSSHPassword,
   restartContainer,
@@ -57,6 +58,7 @@ import {
   SnapshotSchedule,
   Template,
   updateContainerExpiry,
+  updateFirewall,
   updateSnapshotQuota,
   updateSnapshotSchedule,
   restoreContainerSnapshot,
@@ -163,6 +165,14 @@ export default function ContainerDetail() {
   const [snapshotBusy, setSnapshotBusy] = useState('')
   const [showSnapshotSchedule, setShowSnapshotSchedule] = useState(false)
   const [snapshotScheduleDraft, setSnapshotScheduleDraft] = useState({ intervalHours: 24, time: '03:00' })
+  const [showFirewall, setShowFirewall] = useState(false)
+  const [firewallEnabled, setFirewallEnabled] = useState(false)
+  const [firewallDefaultAction, setFirewallDefaultAction] = useState<'ACCEPT' | 'DROP'>('DROP')
+  const [firewallRules, setFirewallRules] = useState<FirewallRule[]>([])
+  const [firewallSaving, setFirewallSaving] = useState(false)
+  const [firewallMessage, setFirewallMessage] = useState<{ type: 'success' | 'error'; text: string } | null>(null)
+  const [editingFirewallRule, setEditingFirewallRule] = useState<FirewallRule | null>(null)
+  const [showFirewallEditor, setShowFirewallEditor] = useState(false)
 
   const fetchContainer = useCallback(async () => {
     if (!containerIdentifier) return
@@ -410,6 +420,91 @@ export default function ContainerDetail() {
     }
   }
 
+  const syncFirewallState = (enabled: boolean, defaultAction: 'ACCEPT' | 'DROP', rules: FirewallRule[]) => {
+    const nextRules = rules.map(r => ({ ...r }))
+    setFirewallEnabled(enabled)
+    setFirewallDefaultAction(defaultAction)
+    setFirewallRules(nextRules)
+    setContainer(prev => prev ? {
+      ...prev,
+      firewall_enabled: enabled,
+      firewall_default_action: defaultAction,
+      firewall_rules: nextRules.map(r => ({ ...r })),
+    } : prev)
+  }
+
+  const openFirewall = async () => {
+    if (!container) return
+    syncFirewallState(container.firewall_enabled || false, container.firewall_default_action || 'DROP', container.firewall_rules || [])
+    setFirewallMessage(null)
+    setShowFirewall(true)
+    try {
+      const res = await getFirewall(container.id)
+      const data = res.data.data
+      if (data) syncFirewallState(data.enabled, data.default_action || 'DROP', data.rules || [])
+    } catch (err) {
+      console.error('Failed to load firewall:', err)
+    }
+  }
+
+  const saveFirewall = async () => {
+    if (!container) return
+    setFirewallSaving(true)
+    try {
+      const res = await updateFirewall(container.id, { enabled: firewallEnabled, default_action: firewallDefaultAction, rules: firewallRules })
+      const data = res.data.data
+      if (data) {
+        syncFirewallState(data.enabled, data.default_action || 'DROP', data.rules || [])
+      }
+      setFirewallMessage({ type: 'success', text: '防火墙设置已保存并应用' })
+      fetchContainer()
+    } catch (err: any) {
+      const message = err?.response?.data?.message || '保存防火墙设置失败'
+      setFirewallMessage({ type: 'error', text: message })
+      dialog.alert('错误', message)
+    } finally {
+      setFirewallSaving(false)
+    }
+  }
+
+  const addFirewallRule = () => {
+    const hasIPv4Firewall = (container?.public_ipv4s?.length || 0) > 0 || Math.max(container?.port_mapping_limit || 0, container?.port_mappings?.length || 0) > 0
+    const hasIPv6Firewall = !!container?.ipv6 || (container?.ipv6_addresses?.length || 0) > 0
+    setEditingFirewallRule({
+      id: '',
+      network: hasIPv4Firewall ? 'ipv4' : hasIPv6Firewall ? 'ipv6' : 'ipv4',
+      direction: 'in',
+      protocol: 'tcp',
+      port: '',
+      source_ip: '',
+      action: 'DROP',
+      description: '',
+      enabled: true,
+    })
+    setShowFirewallEditor(true)
+  }
+
+  const saveFirewallRule = (rule: FirewallRule) => {
+    if (rule.id) {
+      // Update existing
+      setFirewallRules(firewallRules.map(r => r.id === rule.id ? rule : r))
+    } else {
+      // Add new with temporary ID
+      const newRule = { ...rule, id: `tmp-${Date.now()}` }
+      setFirewallRules([...firewallRules, newRule])
+    }
+    setShowFirewallEditor(false)
+    setEditingFirewallRule(null)
+  }
+
+  const deleteFirewallRule = (ruleId: string) => {
+    setFirewallRules(firewallRules.filter(r => r.id !== ruleId))
+  }
+
+  const toggleFirewallRule = (ruleId: string) => {
+    setFirewallRules(firewallRules.map(r => r.id === ruleId ? { ...r, enabled: !r.enabled } : r))
+  }
+
   const openReinstall = async () => {
     try {
       const res = await getEnabledImages(container?.virtualization || 'lxc')
@@ -753,6 +848,7 @@ export default function ContainerDetail() {
   }
 
   const isRunning = container.status === 'running'
+  const isInitializing = container.status === 'initializing'
   const isKVM = (container.virtualization || 'lxc') === 'kvm'
   const isWindows = container.template?.includes('windows')
   const reinstallLinuxTemplate = !isWindowsTemplate(selectedTemplate)
@@ -770,8 +866,29 @@ export default function ContainerDetail() {
   if (ipv6List.length === 0 && container.ipv6) ipv6List.push(container.ipv6)
   const maxVCPU = hostInfo?.cpu.cores || 64
   const maxRAMMB = hostInfo?.ram.total_mb ? Number(hostInfo.ram.total_mb) : undefined
-  const publicEndpoint = container.ssh_port > 0 ? `${publicHost}:${container.ssh_port}` : '-'
-  const sshCommand = container.ssh_port > 0 ? `ssh -p ${container.ssh_port} root@${publicHost}` : ''
+  const hasIndependentIPv4 = assignedIPv4List.length > 0
+  const hasIndependentIPv6 = ipv6List.length > 0
+  const defaultConnPort = isWindows ? 3389 : 22
+
+  let publicEndpoint = '-'
+  let sshCommand = ''
+
+  if (hasIndependentIPv4) {
+    // Direct connection via independent IPv4 — all ports forwarded
+    publicEndpoint = `${assignedIPv4List[0]}:${defaultConnPort}`
+    if (!isWindows) {
+      sshCommand = `ssh root@${assignedIPv4List[0]}`
+    }
+  } else if (hasIndependentIPv6) {
+    publicEndpoint = `[${ipv6List[0]}]:${defaultConnPort}`
+    if (!isWindows) {
+      sshCommand = `ssh root@[${ipv6List[0]}]`
+    }
+  } else if (container.ssh_port > 0) {
+    // NAT port mapping mode
+    publicEndpoint = `${publicHost}:${container.ssh_port}`
+    sshCommand = `ssh -p ${container.ssh_port} root@${publicHost}`
+  }
   const editingSSH = draft.index !== null && !!container.port_mappings?.[draft.index] && (
     container.port_mappings[draft.index].description === 'SSH' || container.port_mappings[draft.index].container_port === 22 ||
     container.port_mappings[draft.index].description === 'RDP' || container.port_mappings[draft.index].container_port === 3389
@@ -792,6 +909,20 @@ export default function ContainerDetail() {
   const mappingLimit = Math.max(container.port_mapping_limit || 0, mappingCount)
   const hasNATQuota = mappingLimit > 0
   const canAddMapping = hasNATQuota && mappingCount < mappingLimit && !isSubUserPolicyBlocked
+  const hasFirewallIPv4 = hasIndependentIPv4 || hasNATQuota
+  const firewallNetworkOptions: Array<{ value: NonNullable<FirewallRule['network']>; label: string }> = []
+  if (hasFirewallIPv4) {
+    firewallNetworkOptions.push({
+      value: 'ipv4',
+      label: hasIndependentIPv4 ? 'IPv4（公网 IPv4）' : 'IPv4（NAT）',
+    })
+  }
+  if (hasIndependentIPv6) {
+    firewallNetworkOptions.push({ value: 'ipv6', label: 'IPv6' })
+  }
+  if (hasFirewallIPv4 && hasIndependentIPv6) {
+    firewallNetworkOptions.push({ value: 'all', label: '全部网络' })
+  }
   const managementUrl = subUser?.access_code
     ? `${window.location.origin}/login?code=${encodeURIComponent(subUser.access_code)}`
     : ''
@@ -854,13 +985,17 @@ export default function ContainerDetail() {
             <div>
               <div className="flex items-center gap-2 flex-wrap">
                 <h1 className="text-xl font-bold text-black">{container.name}</h1>
-                <StatusBadge running={isRunning} />
+                <StatusBadge running={isRunning} initializing={isInitializing} />
               </div>
               <div className="flex items-center gap-2 flex-wrap mt-2">
                 <InfoTag color="blue">系统 {container.template}</InfoTag>
                 <InfoTag color="slate">类型 {(container.virtualization || 'lxc').toUpperCase()}</InfoTag>
                 <InfoTag color="emerald">内网 {container.ip || '-'}</InfoTag>
-                <InfoTag color="amber">IPv4 NAT {hasNATQuota ? `${mappingCount} 条` : '未分配'}</InfoTag>
+                {hasIndependentIPv4 ? (
+                  <InfoTag color="amber">独立 IPv4 {assignedIPv4List[0]}</InfoTag>
+                ) : (
+                  <InfoTag color="amber">IPv4 NAT {hasNATQuota ? `${mappingCount} 条` : '未分配'}</InfoTag>
+                )}
                 <InfoTag color="violet">{isWindows ? 'RDP' : 'SSH'} {publicEndpoint}</InfoTag>
                 {isPolicyBlocked && <InfoTag color="red">策略封禁</InfoTag>}
               </div>
@@ -903,22 +1038,24 @@ export default function ContainerDetail() {
                 管理链接
               </ActionButton>
             )}
-            <>
+            {!hasIndependentIPv4 && hasNATQuota && (
               <ActionButton disabled={isSubUserPolicyBlocked} onClick={() => setShowNat(true)}>
                 <Settings className="w-3.5 h-3.5" />
                 IPv4 NAT 管理
               </ActionButton>
-            </>
+            )}
+            <ActionButton onClick={openFirewall} disabled={isSubUserPolicyBlocked}>
+              <FirewallIcon className="w-3.5 h-3.5" />
+              防火墙
+            </ActionButton>
             <ActionButton onClick={() => setShowSnapshots(true)} disabled={!!taskStatus || !!snapshotBusy || isSubUserPolicyBlocked}>
               <Camera className="w-3.5 h-3.5" />
               快照
             </ActionButton>
-            {!isSubUser && (
-              <ActionButton onClick={openReinstall} disabled={!!taskStatus || isExpired}>
-                <RefreshCw className="w-3.5 h-3.5" />
-                {isExpired ? '已到期' : taskStatus === 'reinstall' ? taskActionLabels['reinstall'] : '重装'}
-              </ActionButton>
-            )}
+            <ActionButton onClick={openReinstall} disabled={!!taskStatus || isExpired || isSubUserPolicyBlocked}>
+              <RefreshCw className="w-3.5 h-3.5" />
+              {isExpired ? '已到期' : taskStatus === 'reinstall' ? taskActionLabels['reinstall'] : '重装'}
+            </ActionButton>
             {!isSubUser && (
               <ActionButton disabled={!!taskStatus} onClick={() => handleAction('delete')}>
                 <Trash2 className="w-3.5 h-3.5" />
@@ -942,7 +1079,7 @@ export default function ContainerDetail() {
       <div className="grid grid-cols-1 lg:grid-cols-3 gap-5">
         <Panel
           title="连接信息"
-          extra={!isSubUser && !isWindows && !isSubUserPolicyBlocked ? (
+          extra={!isWindows && !isSubUserPolicyBlocked ? (
             <button
               onClick={openResetPassword}
               className="inline-flex items-center gap-1.5 rounded-md px-2.5 py-1.5 text-xs text-gray-600 hover:bg-gray-100 hover:text-black"
@@ -1418,7 +1555,242 @@ export default function ContainerDetail() {
         </Modal>
       )}
 
-      {showNat && (
+      {showFirewall && (
+        <Modal title="防火墙设置" onClose={() => { setShowFirewall(false); setShowFirewallEditor(false); setEditingFirewallRule(null) }} wide extra={
+          !isSubUser && (
+            <button
+              onClick={addFirewallRule}
+              disabled={firewallNetworkOptions.length === 0}
+              title={firewallNetworkOptions.length === 0 ? '当前容器没有可配置的 NAT、公网 IPv4 或 IPv6' : undefined}
+              className="inline-flex items-center gap-1.5 px-3 py-1.5 bg-black text-white rounded-md text-xs hover:bg-gray-800 disabled:cursor-not-allowed disabled:opacity-50"
+            >
+              <Plus className="w-3.5 h-3.5" />添加规则
+            </button>
+          )
+        }>
+          <div className="space-y-5">
+            {/* Global toggle */}
+            <div className="flex items-center justify-between gap-4">
+              <div>
+                <div className="text-sm font-medium text-gray-800">防火墙</div>
+                <div className="text-xs text-gray-500">
+                  {firewallEnabled
+                    ? (firewallDefaultAction === 'DROP' ? '已启用，未匹配规则的流量将被拒绝' : '已启用，未匹配规则的流量将被放行')
+                    : '未启用时不接管该容器流量'}
+                </div>
+              </div>
+              <button
+                onClick={() => setFirewallEnabled(!firewallEnabled)}
+                className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors ${firewallEnabled ? 'bg-emerald-500' : 'bg-gray-300'}`}
+              >
+                <span className={`inline-block h-4 w-4 transform rounded-full bg-white transition-transform ${firewallEnabled ? 'translate-x-6' : 'translate-x-1'}`} />
+              </button>
+            </div>
+
+            <div className="flex items-center justify-between gap-4 rounded-md border border-gray-200 px-3 py-2">
+              <div>
+                <div className="text-sm font-medium text-gray-800">默认动作</div>
+                <div className="text-xs text-gray-500">没有命中下方规则时如何处理</div>
+              </div>
+              <select
+                value={firewallDefaultAction}
+                onChange={(e) => setFirewallDefaultAction(e.target.value as 'ACCEPT' | 'DROP')}
+                disabled={isSubUser}
+                className="rounded-md border border-gray-300 bg-white px-2.5 py-1.5 text-xs text-gray-800 focus:border-black focus:outline-none focus:ring-2 focus:ring-black disabled:opacity-60"
+              >
+                <option value="DROP">未匹配拒绝</option>
+                <option value="ACCEPT">未匹配放行</option>
+              </select>
+            </div>
+
+            <div className="rounded-md border border-blue-100 bg-blue-50 px-3 py-2 text-xs text-blue-800">
+              <div className="font-medium text-blue-900">网络范围</div>
+              <div className="mt-1">
+                {firewallNetworkOptions.length > 0
+                  ? `可配置：${firewallNetworkOptions.filter((option) => option.value !== 'all').map((option) => option.label).join('、')}。`
+                  : '当前容器未分配 IPv4 NAT、独立公网 IPv4 或 IPv6，暂无可配置网络。'}
+                {hasFirewallIPv4 ? ` IPv4 规则覆盖${hasIndependentIPv4 ? '独立公网 IPv4' : 'IPv4 NAT 端口映射'}。` : ''}
+                {hasNATQuota && !hasIndependentIPv4 ? ' NAT 入站端口按容器内部端口匹配，不是宿主机公网端口。' : ''}
+                {hasIndependentIPv6 ? ' IPv6 规则覆盖该容器已分配的 IPv6 地址。' : ''}
+              </div>
+            </div>
+
+            {firewallMessage && (
+              <div className={`rounded-md px-3 py-2 text-xs ${firewallMessage.type === 'success' ? 'border border-emerald-100 bg-emerald-50 text-emerald-700' : 'border border-red-100 bg-red-50 text-red-700'}`}>
+                {firewallMessage.text}
+              </div>
+            )}
+
+            {/* Rules table */}
+            <div className="overflow-x-auto">
+              <table className="w-full text-sm">
+                <thead className="border-b border-gray-200 bg-gray-50 text-xs text-gray-500">
+                  <tr>
+                    <th className="px-3 py-2 text-left font-medium">状态</th>
+                    <th className="px-3 py-2 text-left font-medium">网络</th>
+                    <th className="px-3 py-2 text-left font-medium">方向</th>
+                    <th className="px-3 py-2 text-left font-medium">协议</th>
+                    <th className="px-3 py-2 text-left font-medium">端口</th>
+                    <th className="px-3 py-2 text-left font-medium">来源/目标 IP</th>
+                    <th className="px-3 py-2 text-left font-medium">动作</th>
+                    <th className="px-3 py-2 text-left font-medium">描述</th>
+                    {!isSubUser && <th className="px-3 py-2 text-right font-medium">操作</th>}
+                  </tr>
+                </thead>
+                <tbody className="divide-y divide-gray-100">
+                  {firewallRules.map((rule) => (
+                    <tr key={rule.id} className={!rule.enabled ? 'opacity-50' : ''}>
+                      <td className="px-3 py-2">
+                        <button onClick={() => toggleFirewallRule(rule.id)} className={`inline-flex h-4 w-7 items-center rounded-full transition-colors ${rule.enabled ? 'bg-emerald-500' : 'bg-gray-300'}`}>
+                          <span className={`inline-block h-3 w-3 transform rounded-full bg-white transition-transform ${rule.enabled ? 'translate-x-3.5' : 'translate-x-0.5'}`} />
+                        </button>
+                      </td>
+                      <td className="px-3 py-2">
+                        <span className="inline-flex rounded bg-gray-100 px-1.5 py-0.5 text-xs font-medium text-gray-700">
+                          {(rule.network || 'ipv4') === 'ipv6' ? 'IPv6' : (rule.network || 'ipv4') === 'all' ? '全部' : 'IPv4'}
+                        </span>
+                      </td>
+                      <td className="px-3 py-2">
+                        <span className={`inline-flex px-1.5 py-0.5 rounded text-xs font-medium ${rule.direction === 'in' ? 'bg-blue-50 text-blue-700' : 'bg-orange-50 text-orange-700'}`}>
+                          {rule.direction === 'in' ? '入站' : '出站'}
+                        </span>
+                      </td>
+                      <td className="px-3 py-2 font-mono text-xs">{rule.protocol.toUpperCase()}</td>
+                      <td className="px-3 py-2 font-mono text-xs">{rule.port || '全部'}</td>
+                      <td className="px-3 py-2 font-mono text-xs">{rule.source_ip || '任意'}</td>
+                      <td className="px-3 py-2">
+                        <span className={`inline-flex px-1.5 py-0.5 rounded text-xs font-medium ${rule.action === 'ACCEPT' ? 'bg-emerald-50 text-emerald-700' : 'bg-red-50 text-red-700'}`}>
+                          {rule.action === 'ACCEPT' ? '放行' : '拒绝'}
+                        </span>
+                      </td>
+                      <td className="px-3 py-2 text-xs text-gray-600 max-w-32 truncate">{rule.description || '-'}</td>
+                      {!isSubUser && (
+                        <td className="px-3 py-2 text-right">
+                          <div className="inline-flex items-center gap-1">
+                            <button onClick={() => {
+                              const currentNetwork = (rule.network || 'ipv4') as NonNullable<FirewallRule['network']>
+                              const network = firewallNetworkOptions.some((option) => option.value === currentNetwork)
+                                ? currentNetwork
+                                : (firewallNetworkOptions[0]?.value || currentNetwork)
+                              setEditingFirewallRule({ ...rule, network })
+                              setShowFirewallEditor(true)
+                            }} className="p-1.5 text-gray-400 hover:text-gray-700 rounded hover:bg-gray-100">
+                              <Pencil className="h-3.5 w-3.5" />
+                            </button>
+                            <button onClick={() => deleteFirewallRule(rule.id)} className="p-1.5 text-gray-400 hover:text-red-600 rounded hover:bg-red-50">
+                              <Trash2 className="h-3.5 w-3.5" />
+                            </button>
+                          </div>
+                        </td>
+                      )}
+                    </tr>
+                  ))}
+                  {firewallRules.length === 0 && (
+                    <tr><td colSpan={isSubUser ? 8 : 9} className="px-3 py-6 text-center text-xs text-gray-400">暂无防火墙规则</td></tr>
+                  )}
+                </tbody>
+              </table>
+            </div>
+
+            {/* Save button */}
+            {!isSubUser && (
+              <div className="flex justify-end">
+                <button onClick={saveFirewall} disabled={firewallSaving} className="inline-flex items-center gap-1.5 px-4 py-2 bg-black text-white rounded-md text-sm hover:bg-gray-800 disabled:opacity-50">
+                  <Save className="w-3.5 h-3.5" />
+                  {firewallSaving ? '保存中...' : '保存'}
+                </button>
+              </div>
+            )}
+          </div>
+        </Modal>
+      )}
+
+      {showFirewallEditor && editingFirewallRule && (
+        <Modal title={editingFirewallRule.id ? '编辑规则' : '添加规则'} onClose={() => { setShowFirewallEditor(false); setEditingFirewallRule(null) }}>
+          <div className="space-y-4">
+            <Field label="网络">
+              {firewallNetworkOptions.length > 0 ? (
+                <select value={editingFirewallRule.network || firewallNetworkOptions[0].value} onChange={(e) => setEditingFirewallRule({ ...editingFirewallRule, network: e.target.value as FirewallRule['network'] })} className={inputClass}>
+                  {firewallNetworkOptions.map((option) => (
+                    <option key={option.value} value={option.value}>{option.label}</option>
+                  ))}
+                </select>
+              ) : (
+                <input value="当前容器没有可配置网络" disabled className={`${inputClass} bg-gray-100 text-gray-400`} />
+              )}
+            </Field>
+            <Field label="方向">
+              <select value={editingFirewallRule.direction} onChange={(e) => setEditingFirewallRule({ ...editingFirewallRule, direction: e.target.value as 'in' | 'out' })} className={inputClass}>
+                <option value="in">入站 (Inbound)</option>
+                <option value="out">出站 (Outbound)</option>
+              </select>
+            </Field>
+            <Field label="协议">
+              <select
+                value={editingFirewallRule.protocol}
+                onChange={(e) => {
+                  const protocol = e.target.value as FirewallRule['protocol']
+                  setEditingFirewallRule({
+                    ...editingFirewallRule,
+                    protocol,
+                    port: protocol === 'tcp' || protocol === 'udp' ? editingFirewallRule.port : '',
+                  })
+                }}
+                className={inputClass}
+              >
+                <option value="tcp">TCP</option>
+                <option value="udp">UDP</option>
+                <option value="icmp">ICMP</option>
+                <option value="all">全部</option>
+              </select>
+            </Field>
+            <Field
+              label="端口"
+              hint={editingFirewallRule.protocol === 'tcp' || editingFirewallRule.protocol === 'udp'
+                ? (editingFirewallRule.direction === 'in'
+                  ? ((editingFirewallRule.network || 'ipv4') === 'ipv4' && hasNATQuota && !hasIndependentIPv4
+                    ? 'NAT 入站填容器内部端口，例如公网 22023 -> 容器 22，这里填 22'
+                    : '入站填容器服务端口；留空为全部端口，支持: 22 | 80,443 | 8000-9000')
+                  : '出站填远端目标端口；留空为全部端口，支持: 22 | 80,443 | 8000-9000')
+                : '端口仅适用于 TCP/UDP'}
+            >
+              <input
+                value={editingFirewallRule.port}
+                onChange={(e) => setEditingFirewallRule({ ...editingFirewallRule, port: e.target.value })}
+                placeholder={editingFirewallRule.protocol === 'tcp' || editingFirewallRule.protocol === 'udp' ? '如: 22 或 80,443 或 8000-9000' : '当前协议不使用端口'}
+                disabled={editingFirewallRule.protocol !== 'tcp' && editingFirewallRule.protocol !== 'udp'}
+                className={`${inputClass} disabled:bg-gray-100 disabled:text-gray-400`}
+              />
+            </Field>
+            <Field
+              label={editingFirewallRule.direction === 'in' ? '来源 IP' : '目标 IP'}
+              hint={(editingFirewallRule.network || 'ipv4') === 'ipv6' ? '留空为任意 IPv6，支持 CIDR: 2001:db8::/64' : (editingFirewallRule.network || 'ipv4') === 'all' ? '留空为任意 IP，支持 IPv4/IPv6 CIDR' : '留空为任意 IPv4，支持 CIDR: 192.168.1.0/24'}
+            >
+              <input
+                value={editingFirewallRule.source_ip}
+                onChange={(e) => setEditingFirewallRule({ ...editingFirewallRule, source_ip: e.target.value })}
+                placeholder={(editingFirewallRule.network || 'ipv4') === 'ipv6' ? '如: 2001:db8::/64' : (editingFirewallRule.network || 'ipv4') === 'all' ? '如: 192.168.1.0/24 或 2001:db8::/64' : '如: 192.168.1.0/24'}
+                className={inputClass}
+              />
+            </Field>
+            <Field label="动作">
+              <select value={editingFirewallRule.action} onChange={(e) => setEditingFirewallRule({ ...editingFirewallRule, action: e.target.value as 'ACCEPT' | 'DROP' })} className={inputClass}>
+                <option value="ACCEPT">放行 (ACCEPT)</option>
+                <option value="DROP">拒绝 (DROP)</option>
+              </select>
+            </Field>
+            <Field label="描述">
+              <input value={editingFirewallRule.description} onChange={(e) => setEditingFirewallRule({ ...editingFirewallRule, description: e.target.value })} placeholder="规则描述" className={inputClass} />
+            </Field>
+            <div className="flex justify-end gap-2 pt-2">
+              <button onClick={() => { setShowFirewallEditor(false); setEditingFirewallRule(null) }} className="px-4 py-2 text-sm text-gray-700 hover:bg-gray-100 rounded-md">取消</button>
+              <button onClick={() => saveFirewallRule(editingFirewallRule)} className="px-4 py-2 text-sm bg-black text-white rounded-md hover:bg-gray-800">确定</button>
+            </div>
+          </div>
+        </Modal>
+      )}
+
+      {showNat && !hasIndependentIPv4 && (
         <Modal title="IPv4 NAT 端口管理" onClose={() => { setShowNat(false); setDraft(emptyDraft); setShowMappingEditor(false) }} wide extra={
           !isSubUser && canAddMapping && (
             <button onClick={openAddMapping} className="inline-flex items-center gap-1.5 px-3 py-1.5 bg-black text-white rounded-md text-xs hover:bg-gray-800">
@@ -1652,7 +2024,23 @@ function RangeSwitch({ value, onChange }: { value: StatsRangeKey; onChange: (val
   )
 }
 
-function StatusBadge({ running }: { running: boolean }) {
+function FirewallIcon({ className }: { className?: string }) {
+  return (
+    <svg className={className} viewBox="0 0 1024 1024" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+      <path d="M979.989543 469.308394H757.450516c4.519899-21.887511 7.247838-45.094992 7.247838-69.798441 0-137.428929-116.773391-270.417958-121.72528-276.001833a21.415521 21.415521 0 0 0-21.887511-6.319858 21.287524 21.287524 0 0 0-15.103663 16.98362l-12.583719 75.438315C571.854663 148.115571 533.535519 69.229333 467.241 5.910748A21.46352 21.46352 0 0 0 441.585573 2.982813a21.295524 21.295524 0 0 0-9.727782 23.935466c15.703649 58.366696-2.815937 152.996581-22.911488 226.978928-5.591875-35.7912-15.615651-66.214521-32.935264-76.414293a21.351523 21.351523 0 0 0-32.167282 18.399589c0 31.359299-15.999643 60.278653-34.519228 93.813904-24.703448 44.759-52.734822 95.525866-52.734822 167.972247 0 4.055909 0.599987 7.727827 0.767983 11.64774H41.346516A21.343523 21.343523 0 0 0 20.010993 490.651917v511.98856a21.343523 21.343523 0 0 0 21.335523 21.335524H979.989543a21.343523 21.343523 0 0 0 21.335524-21.335524v-511.98856A21.343523 21.343523 0 0 0 979.989543 469.308394z m-149.332663 42.663047v127.99714H660.380685c33.879243-29.183348 65.878528-72.702376 85.334093-127.99714h84.942102zM346.699693 310.255948c7.559831-13.599696 14.895667-26.919399 21.167527-40.399098 3.495922 28.543362 5.503877 64.510559 5.071887 100.26176a21.311524 21.311524 0 0 0 17.367612 21.199526 21.255525 21.255525 0 0 0 23.935465-13.351701c3.071931-8.191817 63.918572-169.980202 65.958527-293.241448 78.462247 104.493665 96.429845 228.906885 96.63784 230.354853a21.279525 21.279525 0 0 0 20.823535 18.431588c9.85578-0.255994 19.631561-7.383835 21.335523-17.791602L640.077138 189.29865c32.895265 46.422963 81.958169 129.277111 81.958169 210.219303 0 157.772475-113.837456 240.458627-153.212577 240.458628H455.241268c-19.023575-5.247883-155.940516-47.742933-155.940516-182.347926 0-61.486626 24.111461-105.133651 47.398941-147.372707zM659.996693 682.647627v127.99714H361.339366v-127.99714H659.996693zM190.67118 511.971441h72.750374c15.311658 60.974638 54.910773 101.717727 93.693907 127.99714H190.67118v-127.99714z m-127.99714 0H148.008133v127.99714H62.67404v-127.99714z m0 170.668186h255.99428v127.99714h-255.99428v-127.99714zM148.008133 981.296954H62.67404v-127.99714H148.008133v127.99714z m341.328373 0H190.67118v-127.99714h298.665326v127.99714z m341.320374 0H531.999553v-127.99714h298.657327v127.99714z m127.99714 0h-85.326093v-127.99714h85.326093v127.99714z m0-170.660187h-255.99428v-127.99714h255.99428v127.99714z m0-170.668186h-85.326093v-127.99714h85.326093v127.99714z" />
+    </svg>
+  )
+}
+
+function StatusBadge({ running, initializing }: { running: boolean; initializing?: boolean }) {
+  if (initializing) {
+    return (
+      <span className="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium whitespace-nowrap bg-amber-50 text-amber-700">
+        <span className="w-1.5 h-1.5 rounded-full flex-shrink-0 bg-amber-500 animate-pulse"></span>
+        正在初始化
+      </span>
+    )
+  }
   return (
     <span className={`inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium whitespace-nowrap ${running ? 'bg-emerald-100 text-emerald-700' : 'bg-rose-100 text-rose-700'}`}>
       <span className={`w-1.5 h-1.5 rounded-full flex-shrink-0 ${running ? 'bg-emerald-500' : 'bg-rose-500'}`}></span>
@@ -2005,11 +2393,12 @@ function TableHead({ children }: { children: ReactNode }) {
   return <th className="text-left px-3 py-2 text-xs font-medium text-gray-500">{children}</th>
 }
 
-function Field({ label, children }: { label: string; children: ReactNode }) {
+function Field({ label, children, hint }: { label: string; children: ReactNode; hint?: string }) {
   return (
     <label className="block">
       <span className="block text-xs font-medium text-gray-600 mb-1.5">{label}</span>
       {children}
+      {hint && <span className="block text-[11px] text-gray-400 mt-1">{hint}</span>}
     </label>
   )
 }

frontend/src/pages/Containers.tsx

@@ -390,6 +390,7 @@ export default function Containers() {
               <tbody className="divide-y divide-gray-100">
                 {pageContainers.map((container) => {
                   const isRunning = container.status === 'running'
+                  const isInitializing = container.status === 'initializing'
                   const task = (container.id > 0 ? taskStatusMap[container.id] : taskNameMap[container.name]) || container.createTask
                   const isPlaceholder = !!container.isPlaceholder
                   const isPolicyBlocked = !!container.policy_blocked
@@ -437,7 +438,7 @@ export default function Containers() {
                         </button>
                       </td>
                       <td className="px-2.5 py-2 align-top">
-                        <StatusBadge running={isRunning} task={task} placeholder={isPlaceholder} policyBlocked={isPolicyBlocked} />
+                        <StatusBadge running={isRunning} initializing={isInitializing} task={task} placeholder={isPlaceholder} policyBlocked={isPolicyBlocked} />
                       </td>
                       <td className="px-2.5 py-2 align-top text-xs text-gray-600 whitespace-nowrap">
                         <span className="inline-flex items-center gap-1">
@@ -483,7 +484,7 @@ export default function Containers() {
                                 try {
                                   const { default: api } = await import('../services/api')
                                   await api.delete(`/tasks/${task.id}`)
-                                  fetchData()
+                                  await Promise.all([fetchData(), fetchTasks()])
                                 } catch { /* ignore */ }
                               }}
                               className="inline-flex items-center gap-1 px-2 py-1 rounded-md border border-red-200 text-[11px] text-red-600 hover:bg-red-50 transition-colors whitespace-nowrap"
@@ -581,7 +582,7 @@ type DisplayContainer = Container & {
   createTask?: Task
 }
 
-function StatusBadge({ running, task, placeholder, policyBlocked }: { running: boolean; task?: Task; placeholder?: boolean; policyBlocked?: boolean }) {
+function StatusBadge({ running, initializing, task, placeholder, policyBlocked }: { running: boolean; initializing?: boolean; task?: Task; placeholder?: boolean; policyBlocked?: boolean }) {
   const baseClass = "inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium whitespace-nowrap"
   if (policyBlocked) {
     return (
@@ -640,6 +641,15 @@ function StatusBadge({ running, task, placeholder, policyBlocked }: { running: b
     )
   }
 
+  if (initializing) {
+    return (
+      <span className={`${baseClass} bg-amber-50 text-amber-700`}>
+        <span className="w-1.5 h-1.5 rounded-full bg-amber-500 animate-pulse"></span>
+        正在初始化
+      </span>
+    )
+  }
+
   return (
     <span className={`${baseClass} ${running ? 'bg-green-50 text-green-700' : 'bg-red-50 text-red-600'}`}>
       <span className={`w-1.5 h-1.5 rounded-full flex-shrink-0 ${running ? 'bg-green-500' : 'bg-red-500'}`}></span>
@@ -714,6 +724,9 @@ function toPlaceholder(cfg: CreateContainerRequest): DisplayContainer {
     ssh_password: '',
     port_mappings: [],
     port_mapping_limit: cfg.assign_nat === false ? 0 : (cfg.port_mapping_count || 0),
+    firewall_enabled: false,
+    firewall_default_action: 'DROP',
+    firewall_rules: [],
     snapshot_limit: cfg.snapshot_limit || 3,
     created_at: '',
     expires_at: cfg.expires_at,

frontend/src/pages/Login.tsx

@@ -66,7 +66,7 @@ export default function Login() {
                 <AppIcon className="w-10 h-10" />
               </div>
               <h1 className="text-2xl font-bold text-gray-950">CLICD</h1>
-              <p className="text-gray-500 mt-1 text-sm">{isAccessCodeLogin ? '容器管理登录' : 'LXC Container Manager'}</p>
+              <p className="text-gray-500 mt-1 text-sm">{isAccessCodeLogin ? '容器管理登录' : 'Container Manager'}</p>
             </div>
 
             <form onSubmit={handleSubmit} className="space-y-5">
@@ -128,7 +128,7 @@ export default function Login() {
           </form>
         </div>
 
-        <p className="text-center text-xs text-gray-400 mt-6">CLICD v1.1.13</p>
+        <p className="text-center text-xs text-gray-400 mt-6">CLICD v1.1.18</p>
       </div>
     </div>
   )

frontend/src/pages/Routing.tsx

@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useMemo, useState, type ReactNode } from 'react'
+import { useCallback, useEffect, useMemo, useRef, useState, type ReactNode } from 'react'
 import { Globe2, Network, Pencil, Plus, RefreshCw, Router, Save, Search, Server, Trash2, X } from 'lucide-react'
 import { useNavigate } from 'react-router-dom'
 import { useLanguage, type Language } from '../contexts/LanguageContext'
@@ -23,7 +23,8 @@ export default function Routing() {
   const [ipv4EditMode, setIPv4EditMode] = useState<'pool' | 'address'>('pool')
   const [editingIPv4Address, setEditingIPv4Address] = useState('')
   const [savingIPv4, setSavingIPv4] = useState(false)
-  const [ipv4Draft, setIPv4Draft] = useState<PublicIPv4Info[]>([])
+  const [ipv4Draft, setIPv4Draft] = useState<(PublicIPv4Info & { _id: number })[]>([])
+  const nextDraftId = useRef(0)
   const [nat4Page, setNat4Page] = useState(1)
   const [ipv6Page, setIPv6Page] = useState(1)
   const [nat4Search, setNat4Search] = useState('')
@@ -54,7 +55,7 @@ export default function Routing() {
 
   useEffect(() => {
     if (!editingIPv4) {
-      setIPv4Draft(publicIPv4s.map((ip) => ({ ...ip })))
+      setIPv4Draft(publicIPv4s.map((ip) => ({ ...ip, _id: nextDraftId.current++ })))
     }
   }, [editingIPv4, publicIPv4s])
 
@@ -65,14 +66,14 @@ export default function Routing() {
   }, [ipv4Assignments])
 
   const startEditIPv4 = () => {
-    setIPv4Draft(publicIPv4s.map((ip) => ({ ...ip })))
+    setIPv4Draft(publicIPv4s.map((ip) => ({ ...ip, _id: nextDraftId.current++ })))
     setIPv4EditMode('pool')
     setEditingIPv4Address('')
     setEditingIPv4(true)
   }
 
   const startEditIPv4Address = (ip: PublicIPv4Info) => {
-    setIPv4Draft([{ ...ip }])
+    setIPv4Draft([{ ...ip, _id: nextDraftId.current++ }])
     setIPv4EditMode('address')
     setEditingIPv4Address(ip.address)
     setEditingIPv4(true)
@@ -82,13 +83,14 @@ export default function Routing() {
     setEditingIPv4(false)
     setIPv4EditMode('pool')
     setEditingIPv4Address('')
-    setIPv4Draft(publicIPv4s.map((ip) => ({ ...ip })))
+    setIPv4Draft([])
   }
 
   const addIPv4Row = () => {
     setIPv4Draft((items) => [
       ...items,
       {
+        _id: nextDraftId.current++,
         address: '',
         interface: defaultIPv4Interface,
         prefix: '',
@@ -108,7 +110,7 @@ export default function Routing() {
     setSavingIPv4(true)
     try {
       const draftItems = ipv4Draft
-        .map((item) => ({
+        .map(({ _id, ...item }) => ({
           ...item,
           address: (item.address || '').trim(),
           interface: (item.interface || defaultIPv4Interface).trim(),
@@ -285,7 +287,7 @@ export default function Routing() {
                 </thead>
                 <tbody className="divide-y divide-gray-100">
                   {ipv4Draft.map((item, index) => (
-                    <tr key={`${item.address}-${index}`}>
+                    <tr key={item._id}>
                       <td className="px-3 py-2"><input value={item.address || ''} onChange={(e) => updateIPv4Draft(index, { address: e.target.value })} placeholder={text.ipv4CIDR} className={smallInputClass} /></td>
                       <td className="px-3 py-2"><input value={item.gateway || ''} onChange={(e) => updateIPv4Draft(index, { gateway: e.target.value })} placeholder={defaultIPv4Gateway || text.gateway} className={smallInputClass} /></td>
                       <td className="px-3 py-2"><input value={item.interface || ''} onChange={(e) => updateIPv4Draft(index, { interface: e.target.value })} placeholder={defaultIPv4Interface} className={smallInputClass} /></td>

frontend/src/services/api.ts

@@ -45,6 +45,18 @@ export interface PortMapping {
   description: string
 }
 
+export interface FirewallRule {
+  id: string
+  network?: 'ipv4' | 'ipv6' | 'all'
+  direction: 'in' | 'out'
+  protocol: 'tcp' | 'udp' | 'icmp' | 'all'
+  port: string
+  source_ip: string
+  action: 'ACCEPT' | 'DROP'
+  description: string
+  enabled: boolean
+}
+
 export interface PublicIPv4Assignment {
   address: string
   interface?: string
@@ -88,6 +100,9 @@ export interface Container {
   ssh_password: string
   port_mappings: PortMapping[]
   port_mapping_limit: number
+  firewall_enabled: boolean
+  firewall_default_action: 'ACCEPT' | 'DROP'
+  firewall_rules: FirewallRule[]
   snapshot_limit: number
   created_at: string
   expires_at: string
@@ -487,6 +502,12 @@ export const updatePortMapping = (id: ContainerIdentifier, index: number, data:
 export const deletePortMapping = (id: ContainerIdentifier, index: number) =>
   api.delete<APIResponse<PortMapping[]>>(`/containers/${id}/port-mappings/${index}`)
 
+export const getFirewall = (id: ContainerIdentifier) =>
+  api.get<APIResponse<{ enabled: boolean; default_action: 'ACCEPT' | 'DROP'; rules: FirewallRule[] }>>(`/containers/${id}/firewall`)
+
+export const updateFirewall = (id: ContainerIdentifier, data: { enabled?: boolean; default_action?: 'ACCEPT' | 'DROP'; rules?: FirewallRule[] }) =>
+  api.put<APIResponse<{ enabled: boolean; default_action: 'ACCEPT' | 'DROP'; rules: FirewallRule[] }>>(`/containers/${id}/firewall`, data)
+
 export const updateContainerExpiry = (id: ContainerIdentifier, expiresAt: string) =>
   api.put<APIResponse>(`/containers/${id}/expiry`, { expires_at: expiresAt })
 

frontend/src/utils/i18n.ts

@@ -788,6 +788,37 @@ const exact: Record<string, string> = {
   '50 / 页': '50 / page',
   '全局快照列表，共': 'Global snapshot list, total',
   '容器分配的子用户列表，共': 'Sub-user list assigned to containers, total',
+  '防火墙': 'Firewall',
+  '防火墙设置': 'Firewall Settings',
+  '独立 IPv4': 'Dedicated IPv4',
+  '添加规则': 'Add Rule',
+  '启用后默认拒绝所有入站和出站流量，仅放行下方规则': 'When enabled, all inbound and outbound traffic is blocked by default. Only the rules below are allowed.',
+  '方向': 'Direction',
+  '来源/目标 IP': 'Source / Destination IP',
+  '动作': 'Action',
+  '入站': 'Inbound',
+  '出站': 'Outbound',
+  '任意': 'Any',
+  '放行': 'Allow',
+  '拒绝': 'Deny',
+  '暂无防火墙规则': 'No firewall rules',
+  '编辑规则': 'Edit Rule',
+  '入站 (Inbound)': 'Inbound',
+  '出站 (Outbound)': 'Outbound',
+  '留空为全部端口，支持: 22 | 80,443 | 8000-9000': 'Leave empty for all ports. Supports: 22 | 80,443 | 8000-9000',
+  '如: 22 或 80,443 或 8000-9000': 'e.g. 22 or 80,443 or 8000-9000',
+  '来源 IP': 'Source IP',
+  '目标 IP': 'Destination IP',
+  '留空为任意 IP，支持 CIDR: 192.168.1.0/24': 'Leave empty for any IP. Supports CIDR: 192.168.1.0/24',
+  '如: 192.168.1.0/24': 'e.g. 192.168.1.0/24',
+  '放行 (ACCEPT)': 'Allow (ACCEPT)',
+  '拒绝 (DROP)': 'Deny (DROP)',
+  '规则描述': 'Rule description',
+  '登录方式': 'SSH Auth Method',
+  '保留当前密码': 'Keep current password',
+  '生成新密码': 'Generate new password',
+  '自定义密码': 'Custom password',
+  '生成密码': 'Generate password',
 }
 
 const artifactPatterns: RegExp[] = [
@@ -853,6 +884,7 @@ const replacements: Array<[RegExp, string]> = [
   [/搜索\s*"([^"]+)"\s*结果\s*(\d+)\s*个地址/g, 'Search "$1" returned $2 addresses, '],
   [/(\d+)\s*个/g, '$1 items'],
   [/(\d+)\s*条/g, '$1 records'],
+  [/1\s*核\b/g, '1 core'],
   [/(\d+)\s*核/g, '$1 cores'],
   [/(\d+)\s*线程/g, '$1 threads'],
   [/已用/g, 'used'],