diff --git a/client/firewall/uspfilter/allow_netbird_windows.go b/client/firewall/uspfilter/allow_netbird_windows.go
index 61a27f171..10a2b9116 100644
--- a/client/firewall/uspfilter/allow_netbird_windows.go
+++ b/client/firewall/uspfilter/allow_netbird_windows.go
@@ -5,8 +5,10 @@ import (
 	"os/exec"
 	"syscall"
 
+	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 
+	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 )
 
@@ -29,19 +31,20 @@ func (m *Manager) Close(*statemanager.Manager) error {
 		return nil
 	}
 
+	var merr *multierror.Error
 	if isFirewallRuleActive(firewallRuleName) {
 		if err := manageFirewallRule(firewallRuleName, deleteRule); err != nil {
-			return fmt.Errorf("remove windows firewall rule: %w", err)
+			merr = multierror.Append(merr, fmt.Errorf("remove windows firewall rule: %w", err))
 		}
 	}
 
 	if isFirewallRuleActive(firewallRuleName + "-v6") {
 		if err := manageFirewallRule(firewallRuleName+"-v6", deleteRule); err != nil {
-			return fmt.Errorf("remove windows v6 firewall rule: %w", err)
+			merr = multierror.Append(merr, fmt.Errorf("remove windows v6 firewall rule: %w", err))
 		}
 	}
 
-	return nil
+	return nberrors.FormatErrorOrNil(merr)
 }
 
 // AllowNetbird allows netbird interface traffic
diff --git a/client/firewall/uspfilter/filter_test.go b/client/firewall/uspfilter/filter_test.go
index d82545771..ed8bf77d5 100644
--- a/client/firewall/uspfilter/filter_test.go
+++ b/client/firewall/uspfilter/filter_test.go
@@ -1424,6 +1424,7 @@ func TestShouldForward(t *testing.T) {
 	for _, tt := range v6Cases {
 		t.Run(tt.name, func(t *testing.T) {
 			manager.localForwarding = true
+			manager.netstack = false
 			decoder := createTCPDecoder(8080)
 			result := manager.shouldForward(decoder, tt.dstIP)
 			require.Equal(t, tt.expected, result, tt.description)
diff --git a/client/iface/wgproxy/bind/proxy.go b/client/iface/wgproxy/bind/proxy.go
index e7e596edb..5bf670e07 100644
--- a/client/iface/wgproxy/bind/proxy.go
+++ b/client/iface/wgproxy/bind/proxy.go
@@ -200,6 +200,10 @@ func (p *ProxyBind) proxyToLocal(ctx context.Context) {
 // The fake address is in the format of 127.1.x.x where x.x is derived from the
 // last two bytes of the peer address (works for both IPv4 and IPv6).
 func fakeAddress(peerAddress *net.UDPAddr) (*netip.AddrPort, error) {
+	if peerAddress == nil {
+		return nil, fmt.Errorf("nil peer address")
+	}
+
 	addr, ok := netip.AddrFromSlice(peerAddress.IP)
 	if !ok {
 		return nil, fmt.Errorf("invalid IP format")
diff --git a/client/internal/debug/debug_test.go b/client/internal/debug/debug_test.go
index 8cf900ceb..e242b8b1b 100644
--- a/client/internal/debug/debug_test.go
+++ b/client/internal/debug/debug_test.go
@@ -557,7 +557,7 @@ COMMIT`
 	assert.NotContains(t, anonNftables, "2607:f8b0:4005::1")
 	assert.NotContains(t, anonNftables, "2607:f8b0:4005::200e")
 	assert.NotContains(t, anonNftables, "2001:db8::")
-	assert.Contains(t, anonNftables, "100::") // Default anonymous v6 range
+	assert.Contains(t, anonNftables, "2001:db8:ffff::") // Default anonymous v6 range
 
 	// ULA addresses in nftables should remain unchanged (private)
 	assert.Contains(t, anonNftables, "fd00:1234::1")
@@ -576,7 +576,7 @@ COMMIT`
 	assert.NotContains(t, anonIp6tablesSave, "2607:f8b0:4005::1")
 	assert.NotContains(t, anonIp6tablesSave, "2607:f8b0:4005::200e")
 	assert.NotContains(t, anonIp6tablesSave, "2001:db8::")
-	assert.Contains(t, anonIp6tablesSave, "100::") // Default anonymous v6 range
+	assert.Contains(t, anonIp6tablesSave, "2001:db8:ffff::") // Default anonymous v6 range
 
 	// Structure should be preserved
 	assert.Contains(t, anonIp6tablesSave, "*filter")
diff --git a/client/internal/engine.go b/client/internal/engine.go
index 620cd9ccd..1e5698ab9 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -677,10 +677,15 @@ func (e *Engine) blockLanAccess() {
 
 	log.Infof("blocking route LAN access for networks: %v", toBlock)
 	v4 := netip.PrefixFrom(netip.IPv4Unspecified(), 0)
+	v6 := netip.PrefixFrom(netip.IPv6Unspecified(), 0)
 	for _, network := range toBlock {
+		source := v4
+		if network.Addr().Is6() {
+			source = v6
+		}
 		if _, err := e.firewall.AddRouteFiltering(
 			nil,
-			[]netip.Prefix{v4},
+			[]netip.Prefix{source},
 			firewallManager.Network{Prefix: network},
 			firewallManager.ProtocolALL,
 			nil,