Firewall rules update for ds-lite

I got my IPv6 connection up and running, as well as IPv4 connectivity through ds-lite:

Mon Sep 18 23:54:11 2017 daemon.notice netifd: Interface 'wan_6' is now up
Mon Sep 18 23:54:11 2017 daemon.notice netifd: Interface 'wan_6_4' is setting up now
Mon Sep 18 23:54:11 2017 daemon.notice netifd: wan_6 (4929): Command failed: Unknown error
Mon Sep 18 23:54:12 2017 daemon.notice netifd: Interface 'wan_6_4' is now up
Mon Sep 18 23:54:12 2017 daemon.notice netifd: tunnel 'ds-wan_6_4' link is up
Mon Sep 18 23:56:19 2017 daemon.notice netifd: wan_6 (4929): Command failed: Unknown error
Tue Sep 19 00:00:47 2017 daemon.notice netifd: wan_6 (4929): Command failed: Unknown error

But while router can ping both IPv6 and IPv4 hosts, node in LAN can ping only IPv6. Looks like 'wan' IPv4 firewall zone contains only main interface 'pppoe-wan' while probably it should be ds-wan_6_4. I would assume firewall rules would be updated via hotplug script however it does not seem to succeed due to:

#  fw3 network wan_6_4
Warning: Warning: ubus nat (ubus:wan_6_4[dslite] nat 0) does not specify a protocol, assuming all
# echo $?
1

Any idea what it might be caused by?

Replying to myself for reference -- found this bug which indicated behavior somehow differs between ipv6=1 and ipv6=auto. Indeed with "auto" changed to "1" and with wan6 interface pointing to @wan firewall is updated correctly.