IPv6 Traffic at wireless clients with role denying traffic

[FES]

We have a VNS with 802.1x auth with role that deny ipv6 traffic.
We are configured this rules:

InOutEthTypeMACIP : PortProtocolPriorityToS/DSCPAccess
destnone0x0800Any0.0.0.0/058AnyN/ADeny
destnone0x0800Any0.0.0.0/041AnyN/ADeny
destnone0x0800Any0.0.0.0/0AnyAnyN/AAllow

Ehter Proto 41 deny ipv6 traffic.
We are capturing eth0 traffic remotely from the ap and we can see clients in this topology sending ipv6 traffic.

We are doing something wrong?
Thanks in advance

[FES]

Here is,
the topology is bridge@AP

[Ronald_Dvorak]

Could you please post a screenshot of the "VLAN & Class of Service" & "Policy Rules" GUI page of this role - the string of text is hard to decipher and I'm also interested in the other settings on this page.

What type of topology is used?

-Ron