From c301ba154596063192059b41ddc7c00198058473 Mon Sep 17 00:00:00 2001
From: hotyue <52734432+hotyue@users.noreply.github.com>
Date: Mon, 1 Jun 2026 06:18:18 +0000
Subject: [PATCH] =?UTF-8?q?fix(ui):=20=E4=BF=AE=E6=AD=A3=E9=98=B2=E7=81=AB?=
 =?UTF-8?q?=E5=A2=99=E6=8F=90=E7=A4=BA=E8=A7=84=E5=88=99=EF=BC=8C=E4=B8=A5?=
 =?UTF-8?q?=E6=A0=BC=E5=9F=BA=E4=BA=8E=E5=8F=8C=E8=BD=A8=E5=88=86=E7=A6=BB?=
 =?UTF-8?q?=E6=9E=B6=E6=9E=84=E7=9A=84=E6=8E=A7=E5=88=B6=E9=9D=A2=E9=80=9A?=
 =?UTF-8?q?=E8=AE=AF=20IP=20(COMM=5FIP)=20=E5=8D=8F=E8=AE=AE=E6=A0=88?=
 =?UTF-8?q?=E5=8A=A8=E6=80=81=E7=94=9F=E6=88=90=E7=B2=BE=E7=A1=AE=E7=9A=84?=
 =?UTF-8?q?=20iptables/ip6tables=20=E6=94=BE=E8=A1=8C=E6=8C=87=E4=BB=A4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 core/install.sh | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/core/install.sh b/core/install.sh
index 108da908..444d22d8 100755
--- a/core/install.sh
+++ b/core/install.sh
@@ -1023,13 +1023,22 @@ if [[ -n "$TG_TOKEN" ]]; then
     echo "📡 Webhook 监听已启动 (端口: $AGENT_PORT) 并向中枢发送了注册请求。"
     
     FW_MSG=""
+    # [v4.2.1 防火墙修正] 严格依据通讯面专线 (COMM_IP) 协议栈生成放行指令
+    IS_V6_COMM="false"
+    [[ "$SAFE_COMM_IP" == *":"* ]] && IS_V6_COMM="true"
+
     if command -v ufw >/dev/null 2>&1 && ufw status | grep -qw active; then
+        # UFW 默认同时添加双栈规则，无需特地区分，但注释中可指明
         FW_MSG="ufw allow $AGENT_PORT/tcp"
     elif command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active firewalld | grep -qw active; then
         FW_MSG="firewall-cmd --zone=public --add-port=$AGENT_PORT/tcp --permanent && firewall-cmd --reload"
     elif command -v iptables >/dev/null 2>&1; then
-        if [[ "$SAFE_PUBLIC_IP" == *":"* ]]; then
-            FW_MSG="ip6tables -I INPUT -p tcp --dport $AGENT_PORT -j ACCEPT"
+        if [ "$IS_V6_COMM" == "true" ]; then
+            if command -v ip6tables >/dev/null 2>&1; then
+                FW_MSG="ip6tables -I INPUT -p tcp --dport $AGENT_PORT -j ACCEPT"
+            else
+                FW_MSG="iptables -I INPUT -p tcp --dport $AGENT_PORT -j ACCEPT  # 提示: 系统缺失 ip6tables 命令"
+            fi
         else
             FW_MSG="iptables -I INPUT -p tcp --dport $AGENT_PORT -j ACCEPT"
         fi