Hi. I've been trying to set up my hEX S to work with my internet connection, and I've been having a hard time getting IPv6 to work for everything other than the router. It's a native IPv6-only connection, with IPv4 connections established through an IPIPv6 tunnel. I was able to get the tunnel working, so IPv4 works for all devices. Pinging various IPv6 addresses on the internet from the router works as well. However, devices like my PC are unable to establish any IPv6 connection outside LAN, so they fall back to IPv4. Looking at the router's IPv6 firewall "connections" list, it shows that the devices try to connect to IPv6 addresses, but all of the connections remain "unreplied". Connections from the router itself to the same IPv6 addresses do get replied just fine according to the same list. The IPv6 firewall has been left using default settings. What am I doing wrong?

Just in case, the internet (WAN) connection is on sfp1, which is on a bridge called "bridge-wan". The other ethernet ports that devices are connected to are on a bridge just called "bridge".

I've been troubleshooting the issue a bit more, and it looks like I might have no choice but to bridge the LAN and WAN interfaces, according to this thread: viewtopic.php?p=732688#p732215
I'm in a similar situation as that thread, using a Japanese ISP, except using an IPIPv6 tunnel instead of PPPoE, and not having to use bridge filters.
I did get the IPv6 firewall to to work even with the interfaces bridged though, by enabling "Use IP firewall" in bridge settings. Not sure if this has a performance penalty on connections within LAN, but it works, and connections from my devices do get listed in the IPv6 firewall connections list.