diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc
index cd136f95..fece692c 100644
--- a/fw-addr-lists.rsc
+++ b/fw-addr-lists.rsc
@@ -22,10 +22,12 @@
   :global EitherOr;
   :global FetchHuge;
   :global HumanReadableNum;
+  :global IfThenElse;
   :global LogPrint;
   :global LogPrintOnce;
   :global LogPrintVerbose;
-  :global MIN;
+  :global NetMask4;
+  :global NetMask6;
   :global ScriptLock;
   :global WaitFullyConnected;
 
@@ -114,8 +116,13 @@
         :do {
           :local Branch;
           :if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$") do={
-            :if ($Address ~ "/32\$") do={
-              :set Address [ :pick $Address 0 ([ :len $Address ] - 3) ];
+            :local Net $Address;
+            :local CIDR "32";
+            :local Slash [ :find $Address "/" ];
+            :if ([ :typeof $Slash ] = "num") do={
+              :set Net [ :toip [ :pick $Address 0 $Slash ] ]
+              :set CIDR [ :pick $Address ($Slash + 1) [ :len $Address ] ];
+              :set Address [ :tostr (([ :toip $Net ] & [ $NetMask4 $CIDR ]) . [ $IfThenElse ($CIDR < 32) ("/" . $CIDR) ]) ];
             }
             :set Branch [ $GetBranch $Address ];
             :set ($IPv4Addresses->$Branch->$Address) $TimeOut;
@@ -123,13 +130,13 @@
           }
           :if ($Address ~ "^[0-9a-zA-Z]*:[0-9a-zA-Z:\\.]+(/[0-9]{1,3})?\$") do={
             :local Net $Address;
-            :local Cidr 64;
+            :local CIDR "128";
             :local Slash [ :find $Address "/" ];
             :if ([ :typeof $Slash ] = "num") do={
               :set Net [ :toip6 [ :pick $Address 0 $Slash ] ]
-              :set Cidr [ $MIN [ :pick $Address ($Slash + 1) [ :len $Address ] ] 64 ];
+              :set CIDR [ :pick $Address ($Slash + 1) [ :len $Address ] ];
             }
-            :set Address (([ :toip6 $Net ] & ffff:ffff:ffff:ffff::) . "/" . $Cidr);
+            :set Address (([ :toip6 $Net ] & [ $NetMask6 $CIDR ]) . "/" . $CIDR);
             :set Branch [ $GetBranch $Address ];
             :set ($IPv6Addresses->$Branch->$Address) $TimeOut;
             :error true;
diff --git a/global-functions.rsc b/global-functions.rsc
index 5c98a206..7b3a56fd 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -62,6 +62,7 @@
 :global MIN;
 :global MkDir;
 :global NetMask4;
+:global NetMask6;
 :global NotificationFunctions;
 :global ParseDate;
 :global ParseKeyValueStore;
@@ -998,6 +999,34 @@
   :return ((255.255.255.255 << (32 - $CIDR)) & 255.255.255.255);
 }
 
+# return an IPv6 netmask for CIDR
+:set NetMask6 do={
+  :local FuncName $0;
+  :local CIDR [ :tostr $1 ];
+
+  :global NetMask6Cache;
+
+  :global GetRandom20CharAlNum;
+
+  :if ([ :typeof $NetMask6Cache ] = "array") do={
+    :return ($NetMask6Cache->$CIDR);
+  }
+
+  :set NetMask6Cache { "128"=(~::) };
+
+  :local GenList ($FuncName . "-" . [ $GetRandom20CharAlNum ]);
+  :for I from=0 to=127 do={
+    /ipv6/firewall/address-list/add dynamic=yes timeout=1m list=$GenList address=((~::) . "/" . $I) comment=$I;
+  }
+  :foreach FwAddrList in=[ /ipv6/firewall/address-list/find where list=$GenList ] do={
+    :local Address [ /ipv6/firewall/address-list/get $FwAddrList ];
+    :set ($NetMask6Cache->($Address->"comment")) \
+      [ :toip6 [ :pick ($Address->"address") 0 [ :find ($Address->"address") "/" ] ] ];
+  }
+
+  :return ($NetMask6Cache->$CIDR);
+}
+
 # prepare NotificationFunctions array
 :if ([ :typeof $NotificationFunctions ] != "array") do={
   :set NotificationFunctions ({});
diff --git a/mod/ipcalc.rsc b/mod/ipcalc.rsc
index eacff6d9..fecf6f26 100644
--- a/mod/ipcalc.rsc
+++ b/mod/ipcalc.rsc
@@ -34,9 +34,12 @@
 # calculate and return netmask, network, min host, max host and broadcast
 :set IPCalcReturn do={
   :local Input [ :tostr $1 ];
+
+  :global NetMask4;
+
   :local Address [ :toip [ :pick $Input 0 [ :find $Input "/" ] ] ];
   :local Bits [ :tonum [ :pick $Input ([ :find $Input "/" ] + 1) [ :len $Input ] ] ];
-  :local Mask ((255.255.255.255 << (32 - $Bits)) & 255.255.255.255);
+  :local Mask [ $NetMask4 $Bits ];
 
   :local Return {
     "address"=$Address;