diff --git a/.github/diy/packages/firewall/patches/101-bcm-fullconenat.patch b/.github/diy/packages/firewall/patches/101-bcm-fullconenat.patch
new file mode 100644
index 000000000..8c429387f
--- /dev/null
+++ b/.github/diy/packages/firewall/patches/101-bcm-fullconenat.patch
@@ -0,0 +1,62 @@
+--- a/defaults.c
++++ b/defaults.c
+@@ -49,7 +49,7 @@
+ 	FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
+ 	FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
+ 
+-	FW3_OPT("fullcone",           bool,     defaults, fullcone),
++	FW3_OPT("fullcone",           int,     defaults, fullcone),
+ 
+ 	FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
+ 	FW3_OPT("tcp_ecn",             int,      defaults, tcp_ecn),
+
+--- a/options.h
++++ b/options.h
+@@ -98,6 +98,13 @@
+ 	__FW3_REJECT_CODE_MAX
+ };
+ 
++enum fullcone_code
++{
++	FULLCONE_DISABLED = 0,
++	FULLCONE_CHION = 1,
++	FULLCONE_BCM = 2,
++};
++
+ extern const char *fw3_flag_names[__FW3_FLAG_MAX];
+ 
+ 
+@@ -297,7 +304,7 @@
+ 	enum fw3_reject_code any_reject_code;
+ 
+ 	bool syn_flood;
+-	bool fullcone;
++	int fullcone;
+ 	struct fw3_limit syn_flood_rate;
+ 
+ 	bool tcp_syncookies;
+
+--- a/zones.c
++++ b/zones.c
+@@ -756,7 +756,7 @@
+ 					r = fw3_ipt_rule_new(handle);
+ 					fw3_ipt_rule_src_dest(r, msrc, mdest);
+ 					/*FIXME: Workaround for FULLCONE-NAT*/
+-					if(defs->fullcone)
++					if(defs->fullcone == FULLCONE_CHION)
+ 					{
+ 						warn("%s will enable FULLCONE-NAT", zone->name);
+ 						fw3_ipt_rule_target(r, "FULLCONENAT");
+@@ -766,6 +766,12 @@
+ 						fw3_ipt_rule_target(r, "FULLCONENAT");
+ 						fw3_ipt_rule_append(r, "zone_%s_prerouting", zone->name);
+ 					}
++					else if (defs->fullcone == FULLCONE_BCM)
++					{
++						fw3_ipt_rule_target(r, "MASQUERADE");
++						fw3_ipt_rule_extra(r, "--mode fullcone");
++						fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
++					}
+ 					else
+ 					{
+ 						fw3_ipt_rule_target(r, "MASQUERADE");