diff --git a/easytier/Makefile b/easytier/Makefile
index cc2073a7..4ad99601 100644
--- a/easytier/Makefile
+++ b/easytier/Makefile
@@ -2,8 +2,8 @@ include $(TOPDIR)/rules.mk
 -include $(dir $(lastword $(MAKEFILE_LIST)))../version.mk
 
 PKG_NAME:=easytier
-PKG_VERSION:=$(or $(EASYTIER_VERSION),2.6.0)
-PKG_RELEASE:=2
+PKG_VERSION:=$(or $(EASYTIER_VERSION),2.6.1)
+PKG_RELEASE:=3
 
 ifeq ($(ARCH),mipsel)
 	APP_ARCH:=mipsel
diff --git a/luci-app-easytier/Makefile b/luci-app-easytier/Makefile
index 64c540d0..61c8eb14 100644
--- a/luci-app-easytier/Makefile
+++ b/luci-app-easytier/Makefile
@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 -include $(dir $(lastword $(MAKEFILE_LIST)))../version.mk
 
 PKG_VERSION:=$(or $(EASYTIER_VERSION),2.6.0)
-PKG_RELEASE:=6
+PKG_RELEASE:=7
 
 LUCI_TITLE:=LuCI support for EasyTier
 LUCI_DEPENDS:=+kmod-tun +easytier +luci-compat
diff --git a/luci-app-easytier/luasrc/controller/easytier.lua b/luci-app-easytier/luasrc/controller/easytier.lua
index 5d1dc11e..44531cb8 100644
--- a/luci-app-easytier/luasrc/controller/easytier.lua
+++ b/luci-app-easytier/luasrc/controller/easytier.lua
@@ -163,7 +163,7 @@ function get_upload_config()
 		easytierbin = uci:get_first("easytier", "easytier", "easytierbin") or "/usr/bin/easytier-core",
 		webbin = uci:get_first("easytier", "easytier", "webbin") or "/usr/bin/easytier-web",
 		github_proxys = {},
-		fallback_version = uci:get_first("easytier", "easytier", "fallback_version") or "v2.6.0"
+		fallback_version = uci:get_first("easytier", "easytier", "fallback_version") or "v2.6.1"
 	}
 	
 	-- 读取代理列表（list 类型）
@@ -200,7 +200,7 @@ function save_upload_config()
 	-- 保存配置
 	uci:set("easytier", "@easytier[0]", "easytierbin", data.easytierbin or "/usr/bin/easytier-core")
 	uci:set("easytier", "@easytier[0]", "webbin", data.webbin or "/usr/bin/easytier-web")
-	uci:set("easytier", "@easytier[0]", "fallback_version", data.fallback_version or "v2.6.0")
+	uci:set("easytier", "@easytier[0]", "fallback_version", data.fallback_version or "v2.6.1")
 	
 	-- 删除旧的代理列表
 	uci:delete("easytier", "@easytier[0]", "github_proxys")
diff --git a/luci-app-easytier/luasrc/view/easytier/easytier_upload.htm b/luci-app-easytier/luasrc/view/easytier/easytier_upload.htm
index 21b74d0b..5f25fbb6 100644
--- a/luci-app-easytier/luasrc/view/easytier/easytier_upload.htm
+++ b/luci-app-easytier/luasrc/view/easytier/easytier_upload.htm
@@ -383,7 +383,7 @@ local translate = i18n.translate
 					<select id="fallback_version_select" class="config-input" style="display:none;width:100%;">
 						<option value=""><%=translate("Loading versions...")%></option>
 					</select>
-					<input type="text" id="fallback_version" class="config-input" placeholder="v2.6.0" style="display:none;width:100%;">
+					<input type="text" id="fallback_version" class="config-input" placeholder="v2.6.1" style="display:none;width:100%;">
 				</div>
 				<button type="button" class="upload-btn" onclick="showDownloadModal()" style="padding:8px 16px;min-width:auto;flex-shrink:0;">
 					<%=translate("Online Download")%>
@@ -758,14 +758,14 @@ function loadConfig() {
 				proxyList = Array.isArray(proxys) ? proxys : [];
 				
 				renderProxyList();
-				versionManager.setVersion(config.fallback_version || 'v2.6.0');
+				versionManager.setVersion(config.fallback_version || 'v2.6.1');
 				
 				// 保存原始配置
 				originalConfig = {
 					easytierbin: config.easytierbin || '/usr/bin/easytier-core',
 					webbin: config.webbin || '/usr/bin/easytier-web',
 					github_proxys: JSON.stringify(proxyList),
-					fallback_version: config.fallback_version || 'v2.6.0'
+					fallback_version: config.fallback_version || 'v2.6.1'
 				};
 				
 				checkDiskSpace('easytierbin');
@@ -843,7 +843,7 @@ function getCurrentConfig() {
 		easytierbin: document.getElementById('easytierbin').value || '/usr/bin/easytier-core',
 		webbin: document.getElementById('webbin').value || '/usr/bin/easytier-web',
 		github_proxys: JSON.stringify(proxyList),
-		fallback_version: versionManager.getCurrentVersion() || 'v2.6.0'
+		fallback_version: versionManager.getCurrentVersion() || 'v2.6.1'
 	};
 }
 
@@ -868,7 +868,7 @@ function saveConfig() {
 		easytierbin: document.getElementById('easytierbin').value || '/usr/bin/easytier-core',
 		webbin: document.getElementById('webbin').value || '/usr/bin/easytier-web',
 		github_proxys: proxyList,
-		fallback_version: versionManager.getCurrentVersion() || 'v2.6.0'
+		fallback_version: versionManager.getCurrentVersion() || 'v2.6.1'
 	};
 	
 	var xhr = new XMLHttpRequest();
diff --git a/luci-app-easytier/root/etc/init.d/easytier b/luci-app-easytier/root/etc/init.d/easytier
index 79158751..e5f5e115 100755
--- a/luci-app-easytier/root/etc/init.d/easytier
+++ b/luci-app-easytier/root/etc/init.d/easytier
@@ -44,7 +44,7 @@ while true; do
         break
     fi
     sleep $((time))
-    [ "$(du -k /log/easytier.log | cut -f1)" = "1000" ] && echo " " >/tmp/easytier.log
+    [ "$(du -k /tmp/easytier.log | cut -f1)" = "1000" ] && echo " " >/tmp/easytier.log
 done
 EOF
         chmod +x /tmp/easytier_check
@@ -103,7 +103,7 @@ check_bin() {
 	# 如果获取失败，从 UCI 配置或使用默认版本
 	if [ -z "$tag" ]; then
 		tag=$(uci -q get easytier.@easytier[0].fallback_version)
-		[ -z "$tag" ] && tag="v2.6.0"
+		[ -z "$tag" ] && tag="v2.6.1"
 	fi
 	echo "$(date '+%Y-%m-%d %H:%M:%S') easytier : 开始在线下载${tag}版本，${proxy}https://github.com/EasyTier/EasyTier/releases/download/${tag}/easytier-linux-${cpucore}-${tag}.zip下载较慢耐心等候" >>/tmp/easytier.log
 	echo "$(date '+%Y-%m-%d %H:%M:%S') easytier : 开始在线下载${tag}版本，${proxy}https://github.com/EasyTier/EasyTier/releases/download/${tag}/easytier-linux-${cpucore}-${tag}.zip下载较慢耐心等候" >>/tmp/easytierweb.log
@@ -165,7 +165,7 @@ check_config() {
                    get_tz
 		   [ -z "$SET_TZ" ] || procd_set_param env TZ="$SET_TZ"
 		   procd_set_param command /bin/sh -c "
-			${easytierbin} -c ${config_file} --console-log-level ${log} >> /tmp/easytier.log 2>&1 &
+			cd /tmp ; ${easytierbin} -c ${config_file} --console-log-level ${log} >> /tmp/easytier.log 2>&1 &
 			ET_CORE_PID=\$!
 			{
 			while true; do
@@ -583,7 +583,7 @@ start_et() {
 				[ -z "$desvice_name" ] || core_cmd="${core_cmd} --hostname $desvice_name"
 			fi
 	     		procd_set_param command /bin/sh -c "
-			${easytierbin} ${core_cmd} --console-log-level ${log} >> /tmp/easytier.log 2>&1 &
+			cd /tmp ; ${easytierbin} ${core_cmd} --console-log-level ${log} >> /tmp/easytier.log 2>&1 &
 			ET_CORE_PID=\$!
 			{
 			while true; do
@@ -636,6 +636,7 @@ start_et() {
 
 start_web() {
 	webbin="$(uci -q get easytier.@easytier[0].webbin)"
+	path=$(dirname "$webbin")
 	if [ -f /tmp/easytier-web-embed ] ; then
 		echo "$(date '+%Y-%m-%d %H:%M:%S') easytier : 找到上传的easytier-web程序，替换${webbin} " >>/tmp/easytierweb.log
 		mv -f /tmp/easytier-web-embed "$webbin"
@@ -730,7 +731,7 @@ start_web() {
 		web_cmd="${web_cmd} --console-log-level $weblog"	
 	fi
 	procd_set_param command /bin/sh -c "
-		${webbin} ${web_cmd} >> /tmp/easytierweb.log 2>&1 &
+		cd /tmp ; ${webbin} ${web_cmd} >> /tmp/easytierweb.log 2>&1 &
 		ET_WEB_PID=\$!
 		{
 			while true; do
diff --git a/luci-app-onekeyap/Makefile b/luci-app-onekeyap/Makefile
new file mode 100644
index 00000000..301161bc
--- /dev/null
+++ b/luci-app-onekeyap/Makefile
@@ -0,0 +1,15 @@
+# See /LICENSE for more information.
+# This is free software, licensed under the GNU General Public License v2.
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI support for one-click AP mode switching
+LUCI_DEPENDS:=+luci-base +luci-mod-network
+LUCI_PKGARCH:=all
+
+PKG_LICENSE:=GPL-2.0
+PKG_MAINTAINER:=lean (coolsnowwolf@gmail.com)
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
diff --git a/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js b/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js
new file mode 100644
index 00000000..328d7909
--- /dev/null
+++ b/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js
@@ -0,0 +1,91 @@
+'use strict';
+'require view';
+'require fs';
+'require ui';
+
+return view.extend({
+	handleSaveApply: null,
+	handleSave: null,
+	handleReset: null,
+
+	load: function() {
+		return L.resolveDefault(fs.exec_direct('/usr/libexec/onekeyap', [ 'status' ], 'json'), {});
+	},
+
+	renderValue: function(title, value) {
+		return E('div', { 'class': 'cbi-value' }, [
+			E('label', { 'class': 'cbi-value-title' }, [ title ]),
+			E('div', { 'class': 'cbi-value-field' }, [ value || _('Not detected') ])
+		]);
+	},
+
+	handleToggle: function() {
+		var status = this.status || {};
+		var command = (status.mode === 'ap') ? 'enable-router' : 'enable-ap';
+		var buttonText = (status.mode === 'ap') ? _('Enable Router Mode') : _('Enable AP Mode');
+
+		ui.showModal(_('Switching mode'), [
+			E('p', { 'class': 'spinning' }, [
+				_('Running %s, the network will reload briefly. Please wait...').format(buttonText)
+			])
+		]);
+
+		return L.resolveDefault(fs.exec_direct('/usr/libexec/onekeyap', [ command ], 'json'), {
+			code: 1,
+			message: _('Command execution failed')
+		}).then(function(res) {
+			ui.hideModal();
+
+			if (+res.code !== 0)
+				throw new Error(res.message || _('Switching failed'));
+
+			ui.addNotification(null, E('p', [
+				res.message || _('The switch request has been submitted. The page will refresh in a few seconds. If the address changes, you can still use 192.168.0.1.')
+			]));
+
+			window.setTimeout(function() {
+				location.reload();
+			}, 8000);
+		}).catch(function(err) {
+			ui.hideModal();
+			ui.addNotification(null, E('p', [
+				err.message || String(err)
+			]), 'danger');
+		});
+	},
+
+	render: function(status) {
+		this.status = status || {};
+
+		var modeText = (this.status.mode === 'ap') ? _('AP Mode') : _('Router Mode');
+		var buttonText = (this.status.mode === 'ap') ? _('Enable Router Mode') : _('Enable AP Mode');
+		var currentLanPorts = (this.status.current_lan_ports || []).join(', ');
+		var savedLanPorts = (this.status.saved_lan_ports || []).join(', ');
+		var savedWanPorts = (this.status.saved_wan_ports || []).join(', ');
+		var currentIps = (this.status.current_lan_ipv4 || []).join(', ');
+		var fallbackIp = this.status.fallback_ip || '192.168.0.1/24';
+
+		return E('div', { 'class': 'cbi-map' }, [
+			E('h2', [ _('One-Key AP Mode') ]),
+			E('div', { 'class': 'cbi-map-descr' }, [
+				_('Merge current WAN ports into LAN with one click. In AP mode, LAN becomes a DHCP client while keeping 192.168.0.1/24 as a fallback management address.')
+			]),
+			E('div', { 'class': 'cbi-section' }, [
+				this.renderValue(_('Current Mode'), modeText),
+				this.renderValue(_('Current LAN Ports'), currentLanPorts),
+				this.renderValue(_('Current LAN IPv4'), currentIps),
+				this.renderValue(_('Original LAN Ports'), savedLanPorts),
+				this.renderValue(_('Original WAN Ports'), savedWanPorts),
+				this.renderValue(_('Fallback Address'), fallbackIp),
+				E('div', { 'class': 'cbi-page-actions' }, [
+					E('button', {
+						'id': 'onekeyap-toggle',
+						'class': 'cbi-button cbi-button-action',
+						'type': 'button',
+						'click': ui.createHandlerFn(this, 'handleToggle')
+					}, [ buttonText ])
+				])
+			])
+		]);
+	}
+});
diff --git a/luci-app-onekeyap/po/templates/onekeyap.pot b/luci-app-onekeyap/po/templates/onekeyap.pot
new file mode 100644
index 00000000..663bc20f
--- /dev/null
+++ b/luci-app-onekeyap/po/templates/onekeyap.pot
@@ -0,0 +1,79 @@
+msgid ""
+msgstr "Content-Type: text/plain; charset=UTF-8"
+
+#: applications/luci-app-onekeyap/root/usr/share/rpcd/acl.d/luci-app-onekeyap.json:3
+msgid "Grant access to one-key AP mode switching"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:16
+msgid "Not detected"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:22
+msgid "Enable Router Mode"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:22
+msgid "Enable AP Mode"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:24
+msgid "Switching mode"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:26
+msgid "Running %s, the network will reload briefly. Please wait..."
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:32
+msgid "Command execution failed"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:37
+msgid "Switching failed"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:40
+msgid "The switch request has been submitted. The page will refresh in a few seconds. If the address changes, you can still use 192.168.0.1."
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:54
+msgid "AP Mode"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:54
+msgid "Router Mode"
+msgstr ""
+
+#: applications/luci-app-onekeyap/root/usr/share/luci/menu.d/luci-app-onekeyap.json:3
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:62
+msgid "One-Key AP Mode"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:64
+msgid "Merge current WAN ports into LAN with one click. In AP mode, LAN becomes a DHCP client while keeping 192.168.0.1/24 as a fallback management address."
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:67
+msgid "Current Mode"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:68
+msgid "Current LAN Ports"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:69
+msgid "Current LAN IPv4"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:70
+msgid "Original LAN Ports"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:71
+msgid "Original WAN Ports"
+msgstr ""
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:72
+msgid "Fallback Address"
+msgstr ""
diff --git a/luci-app-onekeyap/po/zh-cn b/luci-app-onekeyap/po/zh-cn
new file mode 120000
index 00000000..8d69574d
--- /dev/null
+++ b/luci-app-onekeyap/po/zh-cn
@@ -0,0 +1 @@
+zh_Hans
\ No newline at end of file
diff --git a/luci-app-onekeyap/po/zh_Hans/onekeyap.po b/luci-app-onekeyap/po/zh_Hans/onekeyap.po
new file mode 100644
index 00000000..a03a6320
--- /dev/null
+++ b/luci-app-onekeyap/po/zh_Hans/onekeyap.po
@@ -0,0 +1,86 @@
+msgid ""
+msgstr ""
+"Content-Type: text/plain; charset=UTF-8\n"
+"Project-Id-Version: luci-app-onekeyap\n"
+"Last-Translator: Automatically generated\n"
+"Language-Team: none\n"
+"Language: zh-Hans\n"
+"MIME-Version: 1.0\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#: applications/luci-app-onekeyap/root/usr/share/rpcd/acl.d/luci-app-onekeyap.json:3
+msgid "Grant access to one-key AP mode switching"
+msgstr "授予一键 AP 模式切换访问权限"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:16
+msgid "Not detected"
+msgstr "未检测到"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:22
+msgid "Enable Router Mode"
+msgstr "开启路由器模式"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:22
+msgid "Enable AP Mode"
+msgstr "开启 AP 模式"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:24
+msgid "Switching mode"
+msgstr "正在切换模式"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:26
+msgid "Running %s, the network will reload briefly. Please wait..."
+msgstr "正在执行 %s，网络会短暂重载，请稍候..."
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:32
+msgid "Command execution failed"
+msgstr "命令执行失败"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:37
+msgid "Switching failed"
+msgstr "切换失败"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:40
+msgid "The switch request has been submitted. The page will refresh in a few seconds. If the address changes, you can still use 192.168.0.1."
+msgstr "切换请求已提交。页面将在几秒后自动刷新，如果地址变化，可继续通过 192.168.0.1 访问。"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:54
+msgid "AP Mode"
+msgstr "AP 模式"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:54
+msgid "Router Mode"
+msgstr "路由器模式"
+
+#: applications/luci-app-onekeyap/root/usr/share/luci/menu.d/luci-app-onekeyap.json:3
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:62
+msgid "One-Key AP Mode"
+msgstr "一键 AP 模式"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:64
+msgid "Merge current WAN ports into LAN with one click. In AP mode, LAN becomes a DHCP client while keeping 192.168.0.1/24 as a fallback management address."
+msgstr "一键把当前 WAN 口并入 LAN，并在 AP 模式下让 LAN 改为 DHCP Client，同时保留 192.168.0.1/24 作为保底管理地址。"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:67
+msgid "Current Mode"
+msgstr "当前模式"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:68
+msgid "Current LAN Ports"
+msgstr "当前 LAN 口"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:69
+msgid "Current LAN IPv4"
+msgstr "当前 LAN IPv4"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:70
+msgid "Original LAN Ports"
+msgstr "原始 LAN 口"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:71
+msgid "Original WAN Ports"
+msgstr "原始 WAN 口"
+
+#: applications/luci-app-onekeyap/htdocs/luci-static/resources/view/network/onekeyap.js:72
+msgid "Fallback Address"
+msgstr "保底地址"
diff --git a/luci-app-onekeyap/root/etc/config/onekeyap b/luci-app-onekeyap/root/etc/config/onekeyap
new file mode 100644
index 00000000..24635776
--- /dev/null
+++ b/luci-app-onekeyap/root/etc/config/onekeyap
@@ -0,0 +1,5 @@
+config settings 'main'
+	option mode 'router'
+	option fallback_ip '192.168.0.1'
+	option fallback_mask '255.255.255.0'
+	option fallback_cidr '24'
diff --git a/luci-app-onekeyap/root/etc/hotplug.d/iface/99-onekeyap b/luci-app-onekeyap/root/etc/hotplug.d/iface/99-onekeyap
new file mode 100755
index 00000000..32016568
--- /dev/null
+++ b/luci-app-onekeyap/root/etc/hotplug.d/iface/99-onekeyap
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+[ "$ACTION" = "ifup" ] || [ "$ACTION" = "ifupdate" ] || exit 0
+[ "$INTERFACE" = "lan" ] || exit 0
+
+/usr/libexec/onekeyap refresh-fallback >/dev/null 2>&1
diff --git a/luci-app-onekeyap/root/usr/libexec/onekeyap b/luci-app-onekeyap/root/usr/libexec/onekeyap
new file mode 100755
index 00000000..61113cf0
--- /dev/null
+++ b/luci-app-onekeyap/root/usr/libexec/onekeyap
@@ -0,0 +1,490 @@
+#!/bin/sh
+
+. /lib/functions.sh
+. /usr/share/libubox/jshn.sh
+
+STATE_CONFIG="onekeyap"
+STATE_SECTION="main"
+BACKUP_DIR="/etc/onekeyap"
+NETWORK_BACKUP="${BACKUP_DIR}/network.backup"
+DHCP_BACKUP="${BACKUP_DIR}/dhcp.backup"
+RELOAD_LOG="/tmp/onekeyap-reload.log"
+
+append_unique() {
+	local var="$1"
+	local item current
+
+	shift
+	eval "current=\${$var}"
+
+	for item in "$@"; do
+		[ -n "$item" ] || continue
+
+		case " $current " in
+			*" $item "*) ;;
+			*) current="${current:+$current }$item" ;;
+		esac
+	done
+
+	eval "$var=\$current"
+}
+
+ensure_state() {
+	if ! uci -q get "${STATE_CONFIG}.${STATE_SECTION}" >/dev/null; then
+		uci batch <<-EOF >/dev/null
+			set ${STATE_CONFIG}.${STATE_SECTION}=settings
+			set ${STATE_CONFIG}.${STATE_SECTION}.mode='router'
+			set ${STATE_CONFIG}.${STATE_SECTION}.fallback_ip='192.168.0.1'
+			set ${STATE_CONFIG}.${STATE_SECTION}.fallback_mask='255.255.255.0'
+			set ${STATE_CONFIG}.${STATE_SECTION}.fallback_cidr='24'
+EOF
+		uci commit "${STATE_CONFIG}" >/dev/null
+	fi
+}
+
+state_get() {
+	uci -q get "${STATE_CONFIG}.${STATE_SECTION}.$1"
+}
+
+state_set() {
+	uci set "${STATE_CONFIG}.${STATE_SECTION}.$1=$2"
+}
+
+state_set_list() {
+	local option="$1"
+	local item
+
+	shift
+	uci -q delete "${STATE_CONFIG}.${STATE_SECTION}.${option}"
+
+	for item in "$@"; do
+		[ -n "$item" ] || continue
+		uci add_list "${STATE_CONFIG}.${STATE_SECTION}.${option}=${item}"
+	done
+}
+
+reply_json() {
+	local code="${1:-0}"
+	local mode="${2}"
+	local message="${3}"
+
+	json_init
+	json_add_int code "${code}"
+	[ -n "${mode}" ] && json_add_string mode "${mode}"
+	[ -n "${message}" ] && json_add_string message "${message}"
+	json_dump
+}
+
+json_add_words() {
+	local name="$1"
+	local item
+
+	shift
+	json_add_array "${name}"
+	for item in "$@"; do
+		[ -n "${item}" ] || continue
+		json_add_string "" "${item}"
+	done
+	json_close_array
+}
+
+collect_ipv4_addrs() {
+	local dev="$1"
+
+	[ -n "${dev}" ] || return 0
+
+	ip -o -4 addr show dev "${dev}" 2>/dev/null | awk '{ print $4 }'
+}
+
+find_device_section_match=""
+
+find_device_section_cb() {
+	local section="$1"
+	local target="$2"
+	local name
+
+	config_get name "${section}" name
+	[ "${name}" = "${target}" ] && find_device_section_match="${section}"
+}
+
+find_device_section() {
+	local target="$1"
+
+	find_device_section_match=""
+	config_load network
+	config_foreach find_device_section_cb device "${target}"
+
+	printf '%s\n' "${find_device_section_match}"
+}
+
+collect_interface_devices() {
+	local iface="$1"
+	local direct dev section ports type
+
+	direct="$(uci -q get "network.${iface}.device")"
+	[ -n "${direct}" ] || direct="$(uci -q get "network.${iface}.device")"
+	[ -n "${direct}" ] || return 0
+
+	for dev in ${direct}; do
+		case "${dev}" in
+			@*) continue ;;
+		esac
+
+		section="$(find_device_section "${dev}")"
+		type="$(uci -q get "network.${section}.type")"
+
+		if [ -n "${section}" ] && [ "${type}" = "bridge" ]; then
+			ports="$(uci -q get "network.${section}.ports")"
+			if [ -n "${ports}" ]; then
+				printf '%s\n' "${ports}"
+			else
+				printf '%s\n' "${dev}"
+			fi
+		else
+			printf '%s\n' "${dev}"
+		fi
+	done
+}
+
+zone_networks=""
+
+find_zone_networks_cb() {
+	local section="$1"
+	local target="$2"
+	local name network
+
+	config_get name "${section}" name
+	[ "${name}" = "${target}" ] || return 0
+
+	config_get network "${section}" network
+	zone_networks="${network}"
+}
+
+get_wan_networks() {
+	local iface result=""
+
+	zone_networks=""
+	config_load firewall
+	config_foreach find_zone_networks_cb zone "wan"
+
+	if [ -n "${zone_networks}" ]; then
+		for iface in ${zone_networks}; do
+			uci -q get "network.${iface}" >/dev/null || continue
+			append_unique result "${iface}"
+		done
+	fi
+
+	if [ -z "${result}" ]; then
+		for iface in wan wan6; do
+			uci -q get "network.${iface}" >/dev/null || continue
+			append_unique result "${iface}"
+		done
+	fi
+
+	printf '%s\n' "${result}"
+}
+
+get_lan_ports() {
+	local result="" item
+
+	for item in $(collect_interface_devices lan); do
+		append_unique result "${item}"
+	done
+
+	printf '%s\n' "${result}"
+}
+
+get_wan_ports() {
+	local iface result="" item
+
+	for iface in $(get_wan_networks); do
+		for item in $(collect_interface_devices "${iface}"); do
+			append_unique result "${item}"
+		done
+	done
+
+	printf '%s\n' "${result}"
+}
+
+ensure_lan_bridge() {
+	local current_lan_device bridge_section final_device port
+
+	current_lan_device="$(uci -q get network.lan.device)"
+	final_device="${current_lan_device}"
+
+	if [ -n "${current_lan_device}" ]; then
+		bridge_section="$(find_device_section "${current_lan_device}")"
+	fi
+
+	if [ -n "${bridge_section}" ] && [ "$(uci -q get "network.${bridge_section}.type")" = "bridge" ]; then
+		final_device="${current_lan_device}"
+	else
+		final_device="br-lan"
+		bridge_section="$(find_device_section "${final_device}")"
+		[ -n "${bridge_section}" ] || bridge_section="$(uci add network device)"
+	fi
+
+	uci set "network.${bridge_section}=device"
+	uci set "network.${bridge_section}.name=${final_device}"
+	uci set "network.${bridge_section}.type=bridge"
+	uci -q delete "network.${bridge_section}.ports"
+
+	for port in "$@"; do
+		[ -n "${port}" ] || continue
+		uci add_list "network.${bridge_section}.ports=${port}"
+	done
+
+	uci set "network.lan.device=${final_device}"
+	uci -q delete network.lan.device
+	uci -q delete network.lan.type
+
+	printf '%s\n' "${final_device}"
+}
+
+schedule_reload() {
+	local target_mode="$1"
+
+	(
+		sleep 1
+		/etc/init.d/network restart
+		/etc/init.d/dnsmasq restart
+		/etc/init.d/odhcpd restart
+		/etc/init.d/firewall restart
+		[ "${target_mode}" = "ap" ] && /usr/libexec/onekeyap refresh-fallback
+	) >"${RELOAD_LOG}" 2>&1 &
+}
+
+get_lan_runtime_device() {
+	local json dev
+
+	json="$(ubus call network.interface.lan status 2>/dev/null)"
+	if [ -n "${json}" ]; then
+		json_load "${json}"
+		json_get_var dev l3_device
+		[ -n "${dev}" ] || json_get_var dev device
+		json_cleanup
+	fi
+
+	[ -n "${dev}" ] || dev="$(uci -q get network.lan.device)"
+	[ -n "${dev}" ] || dev="$(state_get ap_lan_device)"
+
+	printf '%s\n' "${dev}"
+}
+
+refresh_fallback() {
+	local mode dev fallback_ip fallback_cidr
+
+	ensure_state
+	mode="$(state_get mode)"
+	[ "${mode}" = "ap" ] || exit 0
+
+	dev="$(get_lan_runtime_device)"
+	fallback_ip="$(state_get fallback_ip)"
+	fallback_cidr="$(state_get fallback_cidr)"
+
+	[ -n "${dev}" ] || exit 0
+	[ -n "${fallback_ip}" ] || exit 0
+	[ -n "${fallback_cidr}" ] || fallback_cidr="24"
+
+	ip -o -4 addr show dev "${dev}" 2>/dev/null | grep -q " ${fallback_ip}/${fallback_cidr} " && exit 0
+	ip addr add "${fallback_ip}/${fallback_cidr}" dev "${dev}" 2>/dev/null
+}
+
+remove_current_fallback() {
+	local dev fallback_ip fallback_cidr
+
+	dev="$(get_lan_runtime_device)"
+	fallback_ip="$(state_get fallback_ip)"
+	fallback_cidr="$(state_get fallback_cidr)"
+
+	[ -n "${dev}" ] || return 0
+	[ -n "${fallback_ip}" ] || return 0
+	[ -n "${fallback_cidr}" ] || fallback_cidr="24"
+
+	ip addr del "${fallback_ip}/${fallback_cidr}" dev "${dev}" 2>/dev/null
+}
+
+status() {
+	local mode button_text fallback_ip fallback_cidr
+	local current_lan_ports current_lan_ipv4
+	local saved_lan_ports saved_wan_ports
+	local lan_runtime_dev item current_lan_ports_words="" current_lan_ipv4_words=""
+
+	ensure_state
+
+	mode="$(state_get mode)"
+	[ -n "${mode}" ] || mode="router"
+
+	if [ "${mode}" = "ap" ]; then
+		button_text="开启路由器模式"
+	else
+		button_text="开启 AP 模式"
+	fi
+
+	fallback_ip="$(state_get fallback_ip)"
+	fallback_cidr="$(state_get fallback_cidr)"
+	[ -n "${fallback_ip}" ] || fallback_ip="192.168.0.1"
+	[ -n "${fallback_cidr}" ] || fallback_cidr="24"
+
+	current_lan_ports="$(get_lan_ports)"
+	saved_lan_ports="$(state_get last_lan_ports)"
+	saved_wan_ports="$(state_get last_wan_ports)"
+	lan_runtime_dev="$(get_lan_runtime_device)"
+
+	for item in ${current_lan_ports}; do
+		append_unique current_lan_ports_words "${item}"
+	done
+
+	for item in $(collect_ipv4_addrs "${lan_runtime_dev}"); do
+		append_unique current_lan_ipv4_words "${item}"
+	done
+
+	json_init
+	json_add_int code 0
+	json_add_string mode "${mode}"
+	json_add_string button_text "${button_text}"
+	json_add_string fallback_ip "${fallback_ip}/${fallback_cidr}"
+	json_add_words current_lan_ports ${current_lan_ports_words}
+	json_add_words current_lan_ipv4 ${current_lan_ipv4_words}
+	json_add_words saved_lan_ports ${saved_lan_ports}
+	json_add_words saved_wan_ports ${saved_wan_ports}
+	json_dump
+}
+
+enable_ap() {
+	local mode lan_ports wan_ports all_ports="" lan_device iface item
+
+	ensure_state
+	mode="$(state_get mode)"
+
+	if [ "${mode}" = "ap" ]; then
+		reply_json 0 "ap" "当前已经是 AP 模式。"
+		return 0
+	fi
+
+	mkdir -p "${BACKUP_DIR}" || {
+		reply_json 1 "router" "无法创建备份目录。"
+		return 0
+	}
+
+	cp /etc/config/network "${NETWORK_BACKUP}" || {
+		reply_json 1 "router" "备份 network 配置失败。"
+		return 0
+	}
+
+	cp /etc/config/dhcp "${DHCP_BACKUP}" || {
+		reply_json 1 "router" "备份 dhcp 配置失败。"
+		return 0
+	}
+
+	lan_ports="$(get_lan_ports)"
+	wan_ports="$(get_wan_ports)"
+
+	for item in ${lan_ports} ${wan_ports}; do
+		append_unique all_ports "${item}"
+	done
+
+	if [ -z "${all_ports}" ]; then
+		reply_json 1 "router" "未检测到可并入 LAN 的接口。"
+		return 0
+	fi
+
+	lan_device="$(ensure_lan_bridge ${all_ports})"
+
+	uci set network.lan.proto='dhcp'
+	uci -q delete network.lan.ipaddr
+	uci -q delete network.lan.netmask
+	uci -q delete network.lan.gateway
+	uci -q delete network.lan.broadcast
+	uci -q delete network.lan.ip6assign
+	uci -q delete network.lan.ip6hint
+	uci -q delete network.lan.ip6ifaceid
+	uci -q delete network.lan.ip6class
+
+	for iface in $(get_wan_networks); do
+		uci -q get "network.${iface}" >/dev/null || continue
+		uci set "network.${iface}.proto=none"
+		uci set "network.${iface}.auto=0"
+		uci -q delete "network.${iface}.device"
+		uci -q delete "network.${iface}.device"
+	done
+
+	if ! uci -q get dhcp.lan >/dev/null; then
+		uci set dhcp.lan=dhcp
+		uci set dhcp.lan.interface='lan'
+	fi
+
+	uci set dhcp.lan.ignore='1'
+	uci set dhcp.lan.dhcpv4='disabled'
+	uci set dhcp.lan.dhcpv6='disabled'
+	uci set dhcp.lan.ra='disabled'
+	uci set dhcp.lan.ndp='disabled'
+
+	state_set mode 'ap'
+	state_set ap_lan_device "${lan_device}"
+	state_set_list last_lan_ports ${lan_ports}
+	state_set_list last_wan_ports ${wan_ports}
+	state_set_list last_wan_networks $(get_wan_networks)
+
+	uci commit network >/dev/null
+	uci commit dhcp >/dev/null
+	uci commit "${STATE_CONFIG}" >/dev/null
+
+	schedule_reload ap
+
+	reply_json 0 "ap" "AP 模式切换请求已提交，WAN 口会并入 LAN，并保留 192.168.0.1/24 作为保底地址。"
+}
+
+enable_router() {
+	local mode
+
+	ensure_state
+	mode="$(state_get mode)"
+
+	if [ "${mode}" != "ap" ]; then
+		reply_json 0 "router" "当前已经是路由器模式。"
+		return 0
+	fi
+
+	if [ ! -f "${NETWORK_BACKUP}" ] || [ ! -f "${DHCP_BACKUP}" ]; then
+		reply_json 1 "ap" "未找到原始配置备份，无法恢复路由器模式。"
+		return 0
+	fi
+
+	remove_current_fallback
+
+	cp "${NETWORK_BACKUP}" /etc/config/network || {
+		reply_json 1 "ap" "恢复 network 配置失败。"
+		return 0
+	}
+
+	cp "${DHCP_BACKUP}" /etc/config/dhcp || {
+		reply_json 1 "ap" "恢复 dhcp 配置失败。"
+		return 0
+	}
+
+	state_set mode 'router'
+	uci commit "${STATE_CONFIG}" >/dev/null
+
+	schedule_reload router
+
+	reply_json 0 "router" "路由器模式恢复请求已提交，原始 WAN/LAN 配置会被还原。"
+}
+
+case "$1" in
+	status)
+		status
+	;;
+	enable-ap)
+		enable_ap
+	;;
+	enable-router)
+		enable_router
+	;;
+	refresh-fallback)
+		refresh_fallback
+	;;
+	*)
+		reply_json 1 "" "用法: $0 {status|enable-ap|enable-router|refresh-fallback}"
+	;;
+esac
diff --git a/luci-app-onekeyap/root/usr/share/luci/menu.d/luci-app-onekeyap.json b/luci-app-onekeyap/root/usr/share/luci/menu.d/luci-app-onekeyap.json
new file mode 100644
index 00000000..18a49503
--- /dev/null
+++ b/luci-app-onekeyap/root/usr/share/luci/menu.d/luci-app-onekeyap.json
@@ -0,0 +1,13 @@
+{
+	"admin/network/onekeyap": {
+		"title": "One-Key AP Mode",
+		"order": 36,
+		"action": {
+			"type": "view",
+			"path": "network/onekeyap"
+		},
+		"depends": {
+			"acl": [ "luci-app-onekeyap" ]
+		}
+	}
+}
diff --git a/luci-app-onekeyap/root/usr/share/rpcd/acl.d/luci-app-onekeyap.json b/luci-app-onekeyap/root/usr/share/rpcd/acl.d/luci-app-onekeyap.json
new file mode 100644
index 00000000..ac04157f
--- /dev/null
+++ b/luci-app-onekeyap/root/usr/share/rpcd/acl.d/luci-app-onekeyap.json
@@ -0,0 +1,17 @@
+{
+	"luci-app-onekeyap": {
+		"description": "Grant access to one-key AP mode switching",
+		"read": {
+			"cgi-io": [ "exec" ],
+			"file": {
+				"/usr/libexec/onekeyap status": [ "exec" ]
+			}
+		},
+		"write": {
+			"file": {
+				"/usr/libexec/onekeyap enable-ap": [ "exec" ],
+				"/usr/libexec/onekeyap enable-router": [ "exec" ]
+			}
+		}
+	}
+}
diff --git a/luci-app-repeater/Makefile b/luci-app-repeater/Makefile
new file mode 100644
index 00000000..6007c259
--- /dev/null
+++ b/luci-app-repeater/Makefile
@@ -0,0 +1,15 @@
+# See /LICENSE for more information.
+# This is free software, licensed under the GNU General Public License v2.
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI support for wireless repeater / client uplink
+LUCI_DEPENDS:=+luci-base +luci-mod-network
+LUCI_PKGARCH:=all
+
+PKG_LICENSE:=GPL-2.0
+PKG_MAINTAINER:=lean (coolsnowwolf@gmail.com)
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
diff --git a/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js b/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js
new file mode 100644
index 00000000..98bb840d
--- /dev/null
+++ b/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js
@@ -0,0 +1,1132 @@
+'use strict';
+'require view';
+'require dom';
+'require form';
+'require fs';
+'require network';
+'require firewall';
+'require poll';
+'require rpc';
+'require uci';
+'require ui';
+
+const callFrequencyList = rpc.declare({
+	object: 'iwinfo',
+	method: 'freqlist',
+	params: [ 'device' ],
+	expect: { results: [] }
+});
+
+const callIwinfoInfo = rpc.declare({
+	object: 'iwinfo',
+	method: 'info',
+	params: [ 'device' ],
+	expect: { }
+});
+
+const callWirelessStatus = rpc.declare({
+	object: 'network.wireless',
+	method: 'status',
+	expect: { }
+});
+
+const callNetworkInterfaceDump = rpc.declare({
+	object: 'network.interface',
+	method: 'dump',
+	expect: { interface: [] }
+});
+
+const UNSET_MARKER = '__unset__';
+
+function next_free_sid(offset) {
+	let sid = 'wifinet' + offset;
+
+	while (uci.get('wireless', sid))
+		sid = 'wifinet' + (++offset);
+
+	return sid;
+}
+
+function getConfiguredBand(hwmode, channel, bandval) {
+	hwmode = String(hwmode || '');
+	bandval = String(bandval || '');
+	channel = +channel;
+
+	if (bandval)
+		return bandval;
+	if (/^11bea/.test(hwmode))
+		return (!isNaN(channel) && channel > 0 && channel < 36) ? '6g' : '5g';
+	if (/^11beg|^11axg|^11ng|^11g|^11b/.test(hwmode))
+		return '2g';
+	if (/^11ac|^11axa|^11na|^11a/.test(hwmode))
+		return '5g';
+	if (/a/.test(hwmode))
+		return '5g';
+	if (/g|b/.test(hwmode))
+		return '2g';
+
+	return null;
+}
+
+function getFrequencyListBand(entry, hwmode) {
+	const mhz = +entry.mhz;
+	const channel = +entry.channel;
+	const band = +entry.band;
+
+	if (!isNaN(mhz)) {
+		if (mhz >= 5925)
+			return '6g';
+		if (mhz >= 5000)
+			return '5g';
+		if (mhz >= 2400)
+			return '2g';
+	}
+
+	if (!isNaN(channel)) {
+		if (channel == 14 || (channel >= 1 && channel <= 13))
+			return '2g';
+		if (channel >= 36 && channel <= 196)
+			return '5g';
+		if (channel >= 1 && channel <= 233 && /^11bea/.test(String(hwmode || '')))
+			return '6g';
+	}
+
+	if (band == 2 || band == 5 || band == 6)
+		return '%dg'.format(band);
+
+	return null;
+}
+
+function bandToLabel(band) {
+	switch (band) {
+	case '2g':
+		return _('2.4 GHz');
+	case '5g':
+		return _('5 GHz');
+	case '6g':
+		return _('6 GHz');
+	default:
+		return _('Unknown');
+	}
+}
+
+function bandSortKey(band) {
+	switch (band) {
+	case '2g':
+		return 0;
+	case '5g':
+		return 1;
+	case '6g':
+		return 2;
+	default:
+		return 99;
+	}
+}
+
+function humanEncryption(enc) {
+	switch (enc) {
+	case 'none':
+		return _('Open / None');
+	case 'owe':
+		return _('OWE');
+	case 'wep-open':
+		return _('WEP Open System');
+	case 'wep-shared':
+		return _('WEP Shared Key');
+	case 'psk':
+		return _('WPA-PSK');
+	case 'psk2':
+		return _('WPA2-PSK');
+	case 'psk-mixed':
+		return _('WPA/WPA2-PSK Mixed');
+	case 'sae':
+		return _('WPA3-SAE');
+	case 'sae-mixed':
+		return _('WPA2/WPA3-SAE Mixed');
+	default:
+		return enc || '-';
+	}
+}
+
+function isOpenEncryption(enc) {
+	return enc == 'none' || enc == 'owe';
+}
+
+function isWepEncryption(enc) {
+	return enc == 'wep-open' || enc == 'wep-shared';
+}
+
+function needsCipher(enc) {
+	return enc == 'psk' || enc == 'psk2' || enc == 'psk-mixed' || enc == 'sae' || enc == 'sae-mixed';
+}
+
+function normalizeCipherValue(value, enc) {
+	value = String(value || 'auto').toLowerCase();
+
+	if (!needsCipher(enc))
+		return 'auto';
+
+	if (value == 'aes')
+		value = 'ccmp';
+	else if (value == 'tkip+aes' || value == 'aes+tkip' || value == 'ccmp+tkip')
+		value = 'tkip+ccmp';
+
+	if (enc == 'sae' || enc == 'sae-mixed') {
+		if (value == 'auto' || value == 'tkip' || value == 'tkip+ccmp')
+			return 'ccmp';
+	}
+
+	switch (value) {
+	case 'auto':
+	case 'ccmp':
+	case 'ccmp256':
+	case 'gcmp':
+	case 'gcmp256':
+	case 'tkip':
+	case 'tkip+ccmp':
+		return value;
+	default:
+		return 'auto';
+	}
+}
+
+function buildEncryptionValue(enc, cipher) {
+	const normalizedCipher = normalizeCipherValue(cipher, enc);
+
+	if (!needsCipher(enc) || normalizedCipher == 'auto')
+		return enc;
+
+	return '%s+%s'.format(enc, normalizedCipher);
+}
+
+function summarizeScanCipher(bss) {
+	const enc = L.isObject(bss?.encryption) ? bss.encryption : null;
+	const ciphers = L.toArray(enc?.ciphers).map((cipher) => String(cipher || '').toLowerCase());
+
+	if (ciphers.includes('tkip') && (ciphers.includes('ccmp') || ciphers.includes('aes')))
+		return 'tkip+ccmp';
+	if (ciphers.includes('ccmp256'))
+		return 'ccmp256';
+	if (ciphers.includes('gcmp256'))
+		return 'gcmp256';
+	if (ciphers.includes('gcmp'))
+		return 'gcmp';
+	if (ciphers.includes('ccmp') || ciphers.includes('aes'))
+		return 'ccmp';
+	if (ciphers.includes('tkip'))
+		return 'tkip';
+
+	return 'auto';
+}
+
+function summarizeScanEncryption(bss) {
+	const enc = L.isObject(bss?.encryption) ? bss.encryption : null;
+
+	if (!enc)
+		return 'none';
+
+	if (Array.isArray(enc.wep))
+		return 'wep-open';
+
+	const auths = L.toArray(enc.authentication);
+	const wpa = L.toArray(enc.wpa);
+
+	if (auths.includes('owe'))
+		return 'owe';
+
+	if (auths.includes('sae') && auths.includes('psk'))
+		return 'sae-mixed';
+
+	if (auths.includes('sae'))
+		return 'sae';
+
+	if (auths.includes('psk')) {
+		const hasWpa1 = wpa.includes(1);
+		const hasWpa2 = wpa.includes(2);
+
+		if (hasWpa1 && hasWpa2)
+			return 'psk-mixed';
+		if (hasWpa2)
+			return 'psk2';
+		if (hasWpa1)
+			return 'psk';
+	}
+
+	return (auths.length == 0 && wpa.length == 0) ? 'none' : null;
+}
+
+function formatSignal(bss) {
+	const quality = +bss?.quality;
+	const qualityMax = +bss?.quality_max;
+	const percent = (quality > 0 && qualityMax > 0) ? Math.floor((100 / qualityMax) * quality) : 0;
+	const signal = (bss?.signal != null) ? '%s dBm'.format(bss.signal) : '-';
+
+	return '%s%% / %s'.format(percent, signal);
+}
+
+function parseIpAddress(netStatus) {
+	const addr = L.toArray(netStatus?.['ipv4-address'])[0];
+	return addr ? '%s/%s'.format(addr.address, addr.mask) : null;
+}
+
+function parseFailure(lines, ifname, ssid) {
+	const candidates = lines.filter((line) => {
+		if (!line)
+			return false;
+
+		return line.includes('wpa_supplicant') ||
+			(ifname && line.includes(ifname)) ||
+			(ssid && line.includes(ssid));
+	});
+
+	for (let i = candidates.length - 1; i >= 0; i--) {
+		const line = candidates[i];
+
+		if (/WRONG_KEY|pre-shared key may be incorrect|4-Way Handshake failed/i.test(line))
+			return _('Password may be incorrect');
+
+		if (/ASSOC-REJECT|denied association|association request to the driver failed/i.test(line))
+			return _('The access point rejected association');
+
+		if (/authentication with .* timed out|AUTH_FAILED|auth_failures/i.test(line))
+			return _('Authentication failed or timed out');
+
+		if (/No network configuration found|ssid not found|network not found/i.test(line))
+			return _('Target SSID was not found');
+
+		if (/SSID-TEMP-DISABLED.*CONN_FAILED/i.test(line))
+			return _('Unable to complete the connection attempt');
+
+		if (/CTRL-EVENT-SSID-TEMP-DISABLED/i.test(line))
+			return line.replace(/^.*CTRL-EVENT-SSID-TEMP-DISABLED\s*/, '');
+	}
+
+	if (candidates.length > 0)
+		return candidates[candidates.length - 1].replace(/^.*wpa_supplicant[^:]*:\s*/, '');
+
+	return null;
+}
+
+function findNetStatus(dump, name) {
+	const ifaces = L.toArray(dump?.interface);
+
+	for (let iface of ifaces)
+		if (iface.interface == name)
+			return iface;
+
+	return null;
+}
+
+function findWifiRuntime(radioStatus, wifiSid, networkName) {
+	const ifaces = L.toArray(radioStatus?.interfaces);
+
+	for (let iface of ifaces) {
+		if (iface.section == wifiSid)
+			return iface;
+
+		if (L.toArray(iface?.config?.network).includes(networkName))
+			return iface;
+	}
+
+	return null;
+}
+
+return view.extend({
+	scanPollFn: null,
+	radioMeta: null,
+	selectedScan: null,
+	map: null,
+
+	load: async function() {
+		await Promise.all([
+			uci.load('repeater'),
+			uci.load('wireless'),
+			uci.load('network'),
+			uci.load('firewall')
+		]);
+
+		const radios = await network.getWifiDevices();
+		const meta = [];
+
+		for (let radio of radios) {
+			const devname = radio.getName();
+			const hwmode = radio.ubus('dev', 'config', 'hwmode') || uci.get('wireless', devname, 'hwmode');
+			const band = radio.ubus('dev', 'config', 'band') ||
+				uci.get('wireless', devname, 'band') ||
+				getConfiguredBand(hwmode, radio.ubus('dev', 'config', 'channel') || uci.get('wireless', devname, 'channel'), null);
+			const freqlist = await L.resolveDefault(callFrequencyList(devname), []);
+			const bands = [];
+
+			for (let entry of freqlist) {
+				const bandName = getFrequencyListBand(entry, hwmode);
+
+				if (bandName && bands.indexOf(bandName) == -1)
+					bands.push(bandName);
+			}
+
+			if (bands.length == 0 && band)
+				bands.push(band);
+
+			bands.sort((a, b) => bandSortKey(a) - bandSortKey(b));
+
+			meta.push({
+				name: devname,
+				radio: radio,
+				bands: bands,
+				band: bands[0] || band || '2g'
+			});
+		}
+
+		meta.sort((a, b) => {
+			return (bandSortKey(a.band) - bandSortKey(b.band)) ||
+				L.naturalCompare(a.name, b.name);
+		});
+
+		return meta;
+	},
+
+	getFormValue: function(optionName, sectionId) {
+		const res = this.map?.lookupOption(optionName, sectionId || 'main');
+		return res ? res[0].formvalue(sectionId || 'main') : null;
+	},
+
+	setFormValue: function(optionName, value) {
+		const res = this.map?.lookupOption(optionName, 'main');
+
+		if (!res)
+			return;
+
+		const opt = res[0];
+		const uiElem = opt.getUIElement('main');
+		const node = document.getElementById(opt.cbid('main'));
+
+		if (uiElem && typeof(uiElem.setValue) == 'function')
+			uiElem.setValue(value);
+		else if (node != null)
+			node.value = value;
+
+		if (node != null)
+			node.dispatchEvent(new Event('change', { bubbles: true }));
+
+		this.map.checkDepends();
+	},
+
+	handleScanStartStop: function(ev) {
+		const btn = ev.currentTarget;
+
+		if (btn.getAttribute('data-state') == 'stop') {
+			if (this.scanPollFn)
+				poll.remove(this.scanPollFn);
+
+			btn.firstChild.data = _('Start refresh');
+			btn.setAttribute('data-state', 'start');
+		}
+		else {
+			poll.add(this.scanPollFn);
+			btn.firstChild.data = _('Stop refresh');
+			btn.setAttribute('data-state', 'stop');
+			btn.classList.add('spinning');
+			btn.disabled = true;
+		}
+	},
+
+	handleScanAbort: function(ev) {
+		const md = dom.parent(ev.target, 'div[aria-modal="true"]');
+
+		if (md) {
+			md.style.maxWidth = '';
+			md.style.maxHeight = '';
+		}
+
+		ui.hideModal();
+
+		if (this.scanPollFn)
+			poll.remove(this.scanPollFn);
+
+		this.scanPollFn = null;
+	},
+
+	handleUseScanResult: function(radioName, bss) {
+		const detectedEnc = summarizeScanEncryption(bss);
+		const detectedCipher = summarizeScanCipher(bss);
+
+		this.selectedScan = Object.assign({ radio: radioName }, bss);
+
+		this.setFormValue('ssid', bss.ssid || '');
+		this.setFormValue('bssid', bss.bssid || '');
+
+		if (detectedEnc != null) {
+			this.setFormValue('encryption', detectedEnc);
+			this.setFormValue('cipher', needsCipher(detectedEnc) ? detectedCipher : 'auto');
+		}
+		else
+			ui.addNotification(null, E('p', _('The selected network uses an enterprise or unsupported authentication mode. You may need to configure it manually.')), 'warning');
+
+		if (isOpenEncryption(detectedEnc) || isWepEncryption(detectedEnc))
+			this.setFormValue('key', '');
+
+		ui.hideModal();
+
+		if (this.scanPollFn)
+			poll.remove(this.scanPollFn);
+
+		this.scanPollFn = null;
+	},
+
+	handleScanRefresh: function(radio, scanCache, table, stop) {
+		return radio.getScanList().then(L.bind(function(results) {
+			const rows = [];
+
+			for (let result of results)
+				scanCache[result.bssid] = result;
+
+			for (let bssid in scanCache)
+				if (scanCache[bssid].stale)
+					results.push(scanCache[bssid]);
+
+			results.sort(function(a, b) {
+				const diff = (b.quality - a.quality) || (a.channel - b.channel);
+
+				if (diff)
+					return diff;
+
+				if (a.ssid < b.ssid)
+					return -1;
+				if (a.ssid > b.ssid)
+					return 1;
+				if (a.bssid < b.bssid)
+					return -1;
+				if (a.bssid > b.bssid)
+					return 1;
+
+				return 0;
+			});
+
+			results.forEach((res) => {
+				const staleStyle = res.stale ? 'opacity:0.5' : null;
+				const detectedEnc = summarizeScanEncryption(res);
+
+				rows.push([
+					E('span', { style: staleStyle }, formatSignal(res)),
+					E('span', { style: staleStyle }, res.ssid || E('em', _('hidden'))),
+					E('span', { style: staleStyle }, '%s'.format(res.channel ?? '-')),
+					E('span', { style: staleStyle }, res.bssid || '-'),
+					E('span', { style: staleStyle }, detectedEnc ? humanEncryption(detectedEnc) : network.formatWifiEncryption(res.encryption)),
+					E('div', { 'class': 'right' }, E('button', {
+						'class': 'cbi-button cbi-button-action important',
+						'click': ui.createHandlerFn(this, 'handleUseScanResult', radio.getName(), res)
+					}, _('Use this network')))
+				]);
+
+				res.stale = true;
+			});
+
+			cbi_update_table(table, rows, E('em', _('No networks found nearby.')));
+
+			stop.disabled = false;
+			stop.style.display = '';
+			stop.classList.remove('spinning');
+		}, this));
+	},
+
+	handleScan: function(radio) {
+		const table = E('table', { 'class': 'table' }, [
+			E('tr', { 'class': 'tr table-titles' }, [
+				E('th', { 'class': 'th' }, _('Signal')),
+				E('th', { 'class': 'th' }, _('SSID')),
+				E('th', { 'class': 'th hide-xs' }, _('Channel')),
+				E('th', { 'class': 'th hide-xs' }, _('BSSID')),
+				E('th', { 'class': 'th' }, _('Encryption')),
+				E('th', { 'class': 'th cbi-section-actions right' }, ' ')
+			])
+		]);
+
+		const stop = E('button', {
+			'class': 'btn',
+			'click': L.bind(this.handleScanStartStop, this),
+			'style': 'display:none',
+			'data-state': 'stop'
+		}, _('Stop refresh'));
+
+		cbi_update_table(table, [], E('em', { class: 'spinning' }, _('Starting wireless scan...')));
+
+		const md = ui.showModal(_('Wireless Scan'), [
+			table,
+			E('div', { 'class': 'right' }, [
+				stop,
+				' ',
+				E('button', {
+					'class': 'btn',
+					'click': ui.createHandlerFn(this, 'handleScanAbort')
+				}, _('Dismiss'))
+			])
+		]);
+
+		md.style.maxWidth = '90%';
+		md.style.maxHeight = 'none';
+
+		this.scanPollFn = L.bind(this.handleScanRefresh, this, radio, {}, table, stop);
+
+		poll.add(this.scanPollFn);
+		poll.start();
+	},
+
+	handleScanButton: function(ev) {
+		const radioName = this.getFormValue('device');
+		const radio = this.radioMeta?.[radioName]?.radio;
+
+		if (!radio) {
+			ui.addNotification(null, E('p', _('Please choose a wireless radio first.')), 'warning');
+			return;
+		}
+
+		return this.handleScan(radio);
+	},
+
+	handleStopPrompt: function() {
+		return ui.showModal(_('Stop Wireless Repeater'), [
+			E('p', _('This will remove the wireless station, the generated network interface, and related firewall bindings created by this app.')),
+			E('div', { 'class': 'right' }, [
+				E('button', {
+					'class': 'btn',
+					'click': ui.hideModal
+				}, _('Cancel')),
+				' ',
+				E('button', {
+					'class': 'cbi-button cbi-button-negative important',
+					'click': ui.createHandlerFn(this, 'handleStopConfirm')
+				}, _('Stop'))
+			])
+		]);
+	},
+
+	handleStopConfirm: function() {
+		const sectionId = 'main';
+
+		this.selectedScan = null;
+
+		ui.showModal(null, [
+			E('p', { 'class': 'spinning' }, _('Cleaning up repeater configuration...'))
+		]);
+
+		return this.clearPreviouslyAppliedConfig(sectionId).then(L.bind(function() {
+			uci.set('repeater', sectionId, 'applied', '0');
+			uci.set('repeater', sectionId, 'managed_network', '0');
+			uci.set('repeater', sectionId, 'wireless_sid', 'repeater_sta');
+			uci.unset('repeater', sectionId, 'network_name');
+			uci.unset('repeater', sectionId, 'zone_name');
+			uci.unset('repeater', sectionId, 'band');
+
+			return this.map.data.save();
+		}, this)).then(function() {
+			ui.changes.apply(true);
+		});
+	},
+
+	ensureNamedSection: function(config, type, sid) {
+		const section = uci.get(config, sid);
+
+		if (section == null) {
+			uci.add(config, type, sid);
+			return sid;
+		}
+
+		if (section['.type'] == type)
+			return sid;
+
+		return null;
+	},
+
+	restoreManagedOption: function(config, section, option, value) {
+		if (value == null || value == UNSET_MARKER)
+			uci.unset(config, section, option);
+		else
+			uci.set(config, section, option, value);
+	},
+
+	clearRadioOverrideState: function(sectionId) {
+		uci.unset('repeater', sectionId, 'applied_device');
+		uci.unset('repeater', sectionId, 'saved_channel');
+		uci.unset('repeater', sectionId, 'saved_htmode');
+		uci.unset('repeater', sectionId, 'radio_override');
+	},
+
+	restorePreviousRadioState: function(sectionId) {
+		if (uci.get('repeater', sectionId, 'radio_override') != '1') {
+			this.clearRadioOverrideState(sectionId);
+			return;
+		}
+
+		const oldDevice = uci.get('repeater', sectionId, 'applied_device');
+
+		if (oldDevice && uci.get('wireless', oldDevice)) {
+			this.restoreManagedOption('wireless', oldDevice, 'channel', uci.get('repeater', sectionId, 'saved_channel'));
+			this.restoreManagedOption('wireless', oldDevice, 'htmode', uci.get('repeater', sectionId, 'saved_htmode'));
+		}
+
+		this.clearRadioOverrideState(sectionId);
+	},
+
+	rememberCurrentRadioState: function(sectionId, device) {
+		uci.set('repeater', sectionId, 'applied_device', device);
+		uci.set('repeater', sectionId, 'saved_channel', uci.get('wireless', device, 'channel') ?? UNSET_MARKER);
+		uci.set('repeater', sectionId, 'saved_htmode', uci.get('wireless', device, 'htmode') ?? UNSET_MARKER);
+		uci.set('repeater', sectionId, 'radio_override', '1');
+	},
+
+	clearPreviouslyAppliedConfig: async function(sectionId) {
+		const wifiSid = uci.get('repeater', sectionId, 'wireless_sid') || 'repeater_sta';
+		const networkName = uci.get('repeater', sectionId, 'network_name');
+		const managedNetwork = uci.get('repeater', sectionId, 'managed_network') == '1';
+
+		this.restorePreviousRadioState(sectionId);
+
+		if (uci.get('wireless', wifiSid)?.['.type'] == 'wifi-iface')
+			uci.remove('wireless', wifiSid);
+
+		if (networkName && managedNetwork) {
+			await firewall.deleteNetwork(networkName);
+
+			if (uci.get('network', networkName)?.['.type'] == 'interface')
+				uci.remove('network', networkName);
+		}
+	},
+
+	configureFirewallZone: async function(zoneName, networkName, role) {
+		let zone = await firewall.getZone(zoneName);
+
+		if (!zone) {
+			zone = await firewall.addZone(zoneName);
+
+			if (zoneName == 'wan' || role == 'wan') {
+				zone.set('input', 'REJECT');
+				zone.set('output', 'ACCEPT');
+				zone.set('forward', 'REJECT');
+				zone.set('masq', '1');
+				zone.set('mtu_fix', '1');
+
+				const lanZone = await firewall.getZone('lan');
+				if (lanZone)
+					lanZone.addForwardingTo(zoneName);
+			}
+			else {
+				zone.set('input', 'ACCEPT');
+				zone.set('output', 'ACCEPT');
+				zone.set('forward', 'ACCEPT');
+			}
+		}
+
+		if (networkName && networkName != 'lan') {
+			await firewall.deleteNetwork(networkName);
+			zone.addNetwork(networkName);
+		}
+		else if (zoneName == 'lan') {
+			zone.addNetwork('lan');
+		}
+	},
+
+	applyRadioSettingsFromScan: function(device, scan) {
+		if (!scan || scan.radio != device)
+			return false;
+
+		const radio = this.radioMeta?.[device]?.radio;
+		const htmodes = radio ? radio.getHTModes() : null;
+
+		if (scan.vht_operation && htmodes && htmodes.indexOf('VHT20') !== -1) {
+			for (let width = scan.vht_operation.channel_width; width >= 20; width /= 2) {
+				if (htmodes.indexOf('VHT' + width) !== -1) {
+					uci.set('wireless', device, 'htmode', 'VHT' + width);
+					break;
+				}
+			}
+		}
+		else if (scan.ht_operation && htmodes && htmodes.indexOf('HT20') !== -1) {
+			const width = (scan.ht_operation.secondary_channel_offset == 'no secondary') ? 20 : 40;
+			uci.set('wireless', device, 'htmode', 'HT' + width);
+		}
+
+		if (scan.channel != null)
+			uci.set('wireless', device, 'channel', '%s'.format(scan.channel));
+
+		return true;
+	},
+
+	saveRepeater: async function() {
+		const sectionId = 'main';
+		const device = uci.get('repeater', sectionId, 'device');
+		const role = uci.get('repeater', sectionId, 'role') || 'wan';
+		const ssid = uci.get('repeater', sectionId, 'ssid');
+		const bssid = uci.get('repeater', sectionId, 'bssid');
+		const encryption = uci.get('repeater', sectionId, 'encryption') || 'none';
+		const cipher = normalizeCipherValue(uci.get('repeater', sectionId, 'cipher'), encryption);
+		const key = uci.get('repeater', sectionId, 'key');
+		let wifiSid = uci.get('repeater', sectionId, 'wireless_sid') || 'repeater_sta';
+		const networkName = (role == 'wan') ? 'repeater_wwan' : 'lan';
+		const zoneName = (role == 'wan') ? 'wan' : 'lan';
+
+		if (!device)
+			throw new Error(_('A wireless radio must be selected.'));
+
+		if (!ssid)
+			throw new Error(_('SSID must not be empty.'));
+
+		if (!this.radioMeta?.[device])
+			throw new Error(_('The selected radio is not available.'));
+
+		if (!isOpenEncryption(encryption) && !key)
+			throw new Error(_('A password or key is required for the selected encryption mode.'));
+
+		await this.clearPreviouslyAppliedConfig(sectionId);
+
+		if (!this.ensureNamedSection('wireless', 'wifi-iface', wifiSid))
+			wifiSid = next_free_sid(uci.sections('wireless', 'wifi-iface').length);
+
+		if (!this.ensureNamedSection('wireless', 'wifi-iface', wifiSid))
+			throw new Error(_('Unable to create the managed wireless station section.'));
+
+		if (this.applyRadioSettingsFromScan(device, this.selectedScan &&
+			this.selectedScan.radio == device &&
+			this.selectedScan.ssid == ssid &&
+			(!bssid || this.selectedScan.bssid == bssid) ? this.selectedScan : null))
+			this.rememberCurrentRadioState(sectionId, device);
+		else
+			this.clearRadioOverrideState(sectionId);
+
+		uci.unset('wireless', device, 'disabled');
+		uci.set('wireless', wifiSid, 'device', device);
+		uci.set('wireless', wifiSid, 'mode', 'sta');
+		uci.set('wireless', wifiSid, 'network', networkName);
+		uci.set('wireless', wifiSid, 'ssid', ssid);
+		uci.set('wireless', wifiSid, 'disabled', '0');
+		uci.unset('wireless', wifiSid, 'wds');
+		uci.unset('wireless', wifiSid, 'key');
+		uci.unset('wireless', wifiSid, 'key1');
+
+		if (bssid)
+			uci.set('wireless', wifiSid, 'bssid', bssid);
+		else
+			uci.unset('wireless', wifiSid, 'bssid');
+
+		if (encryption == 'none' || encryption == 'owe') {
+			uci.set('wireless', wifiSid, 'encryption', encryption);
+			uci.unset('repeater', sectionId, 'key');
+		}
+		else if (isWepEncryption(encryption)) {
+			uci.set('wireless', wifiSid, 'encryption', encryption);
+			uci.set('wireless', wifiSid, 'key', '1');
+			uci.set('wireless', wifiSid, 'key1', key);
+		}
+		else {
+			uci.set('wireless', wifiSid, 'encryption', buildEncryptionValue(encryption, cipher));
+			uci.set('wireless', wifiSid, 'key', key);
+		}
+
+		uci.set('repeater', sectionId, 'cipher', cipher);
+
+		if (role == 'wan') {
+			this.ensureNamedSection('network', 'interface', networkName);
+			uci.set('network', networkName, 'proto', 'dhcp');
+			uci.unset('network', networkName, 'ipaddr');
+			uci.unset('network', networkName, 'netmask');
+			uci.unset('network', networkName, 'gateway');
+			uci.unset('network', networkName, 'dns');
+			uci.set('repeater', sectionId, 'managed_network', '1');
+		}
+		else {
+			if (!uci.get('network', 'lan'))
+				throw new Error(_('LAN interface was not found. Please create network.lan first.'));
+
+			uci.set('repeater', sectionId, 'managed_network', '0');
+		}
+
+		await this.configureFirewallZone(zoneName, networkName, role);
+
+		uci.set('repeater', sectionId, 'wireless_sid', wifiSid);
+		uci.set('repeater', sectionId, 'network_name', networkName);
+		uci.set('repeater', sectionId, 'zone_name', zoneName);
+		uci.set('repeater', sectionId, 'band', this.radioMeta[device].band || '');
+		uci.set('repeater', sectionId, 'applied', '1');
+	},
+
+	getStatusFromLog: function(ifname, ssid) {
+		return L.resolveDefault(fs.exec_direct('/sbin/logread', [ '-e', 'wpa_supplicant' ]), '').then((res) => {
+			const lines = String(res || '').trim().split(/\n/).filter(Boolean);
+			return parseFailure(lines, ifname, ssid);
+		});
+	},
+
+	collectStatus: async function() {
+		const sectionId = 'main';
+		const device = uci.get('repeater', sectionId, 'device');
+		const role = uci.get('repeater', sectionId, 'role') || 'wan';
+		const ssid = uci.get('repeater', sectionId, 'ssid');
+		const applied = uci.get('repeater', sectionId, 'applied') == '1';
+		const networkName = uci.get('repeater', sectionId, 'network_name') || (role == 'wan' ? 'repeater_wwan' : 'lan');
+		const wifiSid = uci.get('repeater', sectionId, 'wireless_sid') || 'repeater_sta';
+
+		if (!device || !ssid)
+			return {
+				state: 'idle',
+				text: _('Not configured'),
+				detail: _('Choose a radio, scan for an SSID, then save and apply the settings.')
+			};
+
+		if (!applied)
+			return {
+				state: 'stopped',
+				text: _('Stopped'),
+				detail: _('The repeater is not currently running. Click Save & Apply to start it again.')
+			};
+
+		const [wirelessStatus, networkDump] = await Promise.all([
+			callWirelessStatus(),
+			callNetworkInterfaceDump()
+		]);
+		const radioStatus = wirelessStatus[device];
+		const wifiRuntime = findWifiRuntime(radioStatus, wifiSid, networkName);
+		const ifname = wifiRuntime?.ifname || null;
+		const linkInfo = ifname ? await L.resolveDefault(callIwinfoInfo(ifname), null) : null;
+		const netStatus = findNetStatus(networkDump, networkName);
+		const ipaddr = parseIpAddress(netStatus);
+		const connectedBssid = linkInfo?.bssid;
+		const connectedSsid = linkInfo?.ssid;
+		const signal = (linkInfo?.signal != null && linkInfo.signal !== 0) ? '%s dBm'.format(linkInfo.signal) : null;
+		const isConnected = !!(connectedSsid && connectedSsid != 'unknown' && connectedBssid && connectedBssid != '00:00:00:00:00:00');
+
+		if (isConnected) {
+			if (role == 'wan' && netStatus && !netStatus.up) {
+				return {
+					state: 'dhcp',
+					text: _('Connected to %s, waiting for DHCP').format(connectedSsid),
+					detail: [ connectedBssid, signal ].filter(Boolean).join(' / ')
+				};
+			}
+
+			return {
+				state: 'connected',
+				text: _('Connected to %s').format(connectedSsid),
+				detail: [
+					connectedBssid,
+					signal,
+					role == 'wan' && ipaddr ? _('IP: %s').format(ipaddr) : null,
+					role == 'lan' && ifname ? _('Bridged through %s').format(ifname) : null
+				].filter(Boolean).join(' / ')
+			};
+		}
+
+		if (radioStatus?.pending || netStatus?.pending) {
+			return {
+				state: 'pending',
+				text: _('Authenticating / connecting...'),
+				detail: ifname ? _('Wireless interface: %s').format(ifname) : _('The station interface is starting.')
+			};
+		}
+
+		const failure = await this.getStatusFromLog(ifname, ssid);
+
+		return {
+			state: failure ? 'failed' : 'disconnected',
+			text: failure ? _('Connection failed') : _('Not connected'),
+			detail: failure || _('The repeater station is not associated with the selected SSID.')
+		};
+	},
+
+	renderStatus: function(status) {
+		const box = document.getElementById('repeater-status');
+
+		if (!box)
+			return;
+
+		let textNode;
+
+		if (status.state == 'pending' || status.state == 'dhcp')
+			textNode = E('em', { 'class': 'spinning' }, status.text);
+		else
+			textNode = E('strong', status.text);
+
+		box.replaceChildren(
+			E('div', { 'class': 'cbi-value-field' }, [ textNode ]),
+			E('div', {
+				'class': 'cbi-value-description',
+				'style': status.state == 'failed' ? 'color:#b94a48' :
+					(status.state == 'connected' ? 'color:#2d8a34' : '')
+			}, status.detail || '-')
+		);
+	},
+
+	pollStatus: function() {
+		return this.collectStatus()
+			.then(L.bind(this.renderStatus, this))
+			.catch(L.bind(function(err) {
+				this.renderStatus({
+					state: 'failed',
+					text: _('Unable to query repeater status'),
+					detail: err.message || '%s'.format(err)
+				});
+			}, this));
+	},
+
+	handleSave: function() {
+		if (!this.map)
+			return Promise.resolve();
+
+		return this.map.save(L.bind(this.saveRepeater, this));
+	},
+
+	handleSaveApply: function(ev, mode) {
+		return this.handleSave().then(() => {
+			ui.changes.apply(mode == '0');
+		});
+	},
+
+	handleReset: function() {
+		return this.map ? this.map.reset() : Promise.resolve();
+	},
+
+	render: function(radios) {
+		this.radioMeta = {};
+		radios.forEach((meta) => { this.radioMeta[meta.name] = meta; });
+
+		const m = new form.Map('repeater', _('Wireless Repeater'),
+			_('Create a wireless client uplink, scan nearby access points, and attach the resulting station either to WAN or to LAN.'));
+		let s, o;
+
+		this.map = m;
+		m.chain('wireless');
+		m.chain('network');
+		m.chain('firewall');
+
+		s = m.section(form.NamedSection, 'main', 'repeater', _('Repeater Settings'));
+
+		o = s.option(form.DummyValue, '_status', _('Connection Status'));
+		o.renderWidget = function() {
+			return E('div', { id: 'repeater-status' }, [
+				E('div', { 'class': 'cbi-value-field' }, E('em', { 'class': 'spinning' }, _('Collecting status...')))
+			]);
+		};
+
+		o = s.option(form.ListValue, 'device', _('Wireless Radio'),
+			_('Choose the 2.4 GHz, 5 GHz, or 6 GHz radio that should work as the repeater station.'));
+		for (let meta of radios) {
+			const bandLabel = meta.bands.map(bandToLabel).join(' / ');
+			o.value(meta.name, '%s (%s)'.format(meta.name, bandLabel));
+		}
+		o.rmempty = false;
+		if (!uci.get('repeater', 'main', 'device') && radios[0])
+			o.default = radios[0].name;
+
+		o = s.option(form.ListValue, 'role', _('Attach As'),
+			_('Attach the repeater client either as a WAN uplink or directly into LAN bridge mode.'));
+		o.value('wan', _('WAN'));
+		o.value('lan', _('LAN'));
+		o.default = 'wan';
+		o.rmempty = false;
+
+		o = s.option(form.Button, '_scan', _('Wireless Scan'),
+			_('Open a scan dialog similar to the standard wireless page and copy the selected SSID into the fields below.'));
+		o.inputstyle = 'action';
+		o.inputtitle = _('Scan');
+		o.onclick = L.bind(this.handleScanButton, this);
+
+		o = s.option(form.Button, '_stop', _('Stop Wireless Repeater'),
+			_('Immediately remove the wireless station, the generated network interface, and related firewall bindings created by this app.'));
+		o.inputstyle = 'remove';
+		o.inputtitle = _('Stop');
+		o.onclick = L.bind(this.handleStopPrompt, this);
+
+		o = s.option(form.Value, 'ssid', _('Target SSID'),
+			_('Filled automatically after scan, but you can also enter the SSID manually for hidden networks.'));
+		o.rmempty = false;
+
+		o = s.option(form.Value, 'bssid', _('Lock To BSSID'),
+			_('Optional. If set, only the selected BSSID will be used instead of roaming between APs with the same SSID.'));
+		o.datatype = 'macaddr';
+		o.rmempty = true;
+
+		o = s.option(form.ListValue, 'encryption', _('Encryption'),
+			_('The detected encryption is filled automatically after scan. You can still adjust it before applying.'));
+		o.value('none', humanEncryption('none'));
+		o.value('owe', humanEncryption('owe'));
+		o.value('wep-open', humanEncryption('wep-open'));
+		o.value('wep-shared', humanEncryption('wep-shared'));
+		o.value('psk', humanEncryption('psk'));
+		o.value('psk2', humanEncryption('psk2'));
+		o.value('psk-mixed', humanEncryption('psk-mixed'));
+		o.value('sae', humanEncryption('sae'));
+		o.value('sae-mixed', humanEncryption('sae-mixed'));
+		o.default = 'psk2';
+		o.rmempty = false;
+
+		o = s.option(form.ListValue, 'cipher', _('Algorithm'),
+			_('Choose the cipher algorithm used by the target wireless network, for example AES (CCMP).'));
+		o.value('auto', _('auto'));
+		o.value('ccmp', _('AES (CCMP)'));
+		o.value('ccmp256', _('AES (CCMP-256)'));
+		o.value('gcmp', _('AES (GCMP)'));
+		o.value('gcmp256', _('AES (GCMP-256)'));
+		o.value('tkip', _('TKIP'));
+		o.value('tkip+ccmp', _('TKIP + AES (CCMP)'));
+		o.default = 'auto';
+		o.rmempty = false;
+		o.depends('encryption', 'psk');
+		o.depends('encryption', 'psk2');
+		o.depends('encryption', 'psk-mixed');
+		o.depends('encryption', 'sae');
+		o.depends('encryption', 'sae-mixed');
+		o.validate = function(section_id, value) {
+			const enc = this.map.lookupOption('encryption', section_id)[0].formvalue(section_id);
+			const normalizedValue = normalizeCipherValue(value, enc);
+
+			if (!needsCipher(enc))
+				return true;
+
+			if ((enc == 'sae' || enc == 'sae-mixed') &&
+			    (normalizedValue == 'tkip' || normalizedValue == 'tkip+ccmp'))
+				return _('WPA3-SAE does not support TKIP. Please choose an AES-based algorithm.');
+
+			return true;
+		};
+
+		o = s.option(form.Value, 'key', _('Password / Key'),
+			_('Enter the WPA passphrase or WEP key for the selected network.'));
+		o.password = true;
+		o.rmempty = true;
+		o.depends('encryption', 'wep-open');
+		o.depends('encryption', 'wep-shared');
+		o.depends('encryption', 'psk');
+		o.depends('encryption', 'psk2');
+		o.depends('encryption', 'psk-mixed');
+		o.depends('encryption', 'sae');
+		o.depends('encryption', 'sae-mixed');
+		o.validate = function(section_id, value) {
+			const enc = this.map.lookupOption('encryption', section_id)[0].formvalue(section_id);
+
+			if (isOpenEncryption(enc))
+				return true;
+
+			if (!value)
+				return _('A password or key is required.');
+
+			if (isWepEncryption(enc) &&
+			    !/^(?:[A-Fa-f0-9]{10}|[A-Fa-f0-9]{26}|[A-Fa-f0-9]{32}|.{5}|.{13}|.{16})$/.test(value))
+				return _('Expecting a valid WEP key.');
+
+			if (!isWepEncryption(enc) && !(value.length >= 8 || /^[A-Fa-f0-9]{64}$/.test(value)))
+				return _('Expecting a WPA key with at least 8 characters.');
+
+			return true;
+		};
+
+		o = s.option(form.DummyValue, '_note', _('Note'));
+		o.rawhtml = true;
+		o.cfgvalue = function() {
+			return _('LAN mode bridges the wireless client into the existing LAN network. Some chipsets may require 4addr/WDS support from the upstream access point.');
+		};
+
+		return m.render().then(L.bind(function(nodes) {
+			poll.add(L.bind(this.pollStatus, this));
+			this.pollStatus();
+			return nodes;
+		}, this));
+	}
+});
diff --git a/luci-app-repeater/po/templates/repeater.pot b/luci-app-repeater/po/templates/repeater.pot
new file mode 100644
index 00000000..4d167aa2
--- /dev/null
+++ b/luci-app-repeater/po/templates/repeater.pot
@@ -0,0 +1,393 @@
+msgid ""
+msgstr "Content-Type: text/plain; charset=UTF-8"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:101
+msgid "2.4 GHz"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:103
+msgid "5 GHz"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:105
+msgid "6 GHz"
+msgstr ""
+
+#: applications/luci-app-repeater/root/usr/share/rpcd/acl.d/luci-app-repeater.json:3
+msgid "Grant access to wireless repeater configuration"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:107
+msgid "Unknown"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:127
+msgid "Open / None"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:129
+msgid "OWE"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:131
+msgid "WEP Open System"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:133
+msgid "WEP Shared Key"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:135
+msgid "WPA-PSK"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:137
+msgid "WPA2-PSK"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:139
+msgid "WPA/WPA2-PSK Mixed"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:141
+msgid "WPA3-SAE"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:143
+msgid "WPA2/WPA3-SAE Mixed"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:221
+msgid "Password may be incorrect"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:224
+msgid "The access point rejected association"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:227
+msgid "Authentication failed or timed out"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:230
+msgid "Target SSID was not found"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:233
+msgid "Unable to complete the connection attempt"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:356
+msgid "Start refresh"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:361
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:481
+msgid "Stop refresh"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:395
+msgid "The selected network uses an enterprise or unsupported authentication mode. You may need to configure it manually."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:443
+msgid "hidden"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:450
+msgid "Use this network"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:456
+msgid "No networks found nearby."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:467
+msgid "Signal"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:468
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:855
+msgid "SSID"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:469
+msgid "Channel"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:470
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:859
+msgid "BSSID"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:471
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:864
+msgid "Encryption"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:483
+msgid "Starting wireless scan..."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:485
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:849
+msgid "Wireless Scan"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:493
+msgid "Dismiss"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:511
+msgid "Please choose a wireless radio first."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:521
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:962
+msgid "Stop Wireless Repeater"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:522
+msgid "This will remove the wireless station, the generated network interface, and related firewall bindings created by this app."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:527
+msgid "Cancel"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:532
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:965
+msgid "Stop"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:543
+msgid "Cleaning up repeater configuration..."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:604
+msgid "A wireless radio must be selected."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:607
+msgid "SSID must not be empty."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:610
+msgid "The selected radio is not available."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:613
+msgid "A password or key is required for the selected encryption mode."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:670
+msgid "LAN interface was not found. Please create network.lan first."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:701
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:753
+msgid "Not configured"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:702
+msgid "Choose a radio, scan for an SSID, then save and apply the settings."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:724
+msgid "Connected to %s, waiting for DHCP"
+msgstr ""
+
+#: applications/luci-app-repeater/root/usr/share/luci/menu.d/luci-app-repeater.json:3
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:724
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:731
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:814
+msgid "Wireless Repeater"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:731
+msgid "Connected to %s"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:735
+msgid "IP: %s"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:736
+msgid "Bridged through %s"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:744
+msgid "Authenticating / connecting..."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:745
+msgid "Wireless interface: %s"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:745
+msgid "The station interface is starting."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:753
+msgid "Connection failed"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:753
+msgid "Not connected"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:754
+msgid "The repeater station is not associated with the selected SSID."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:787
+msgid "Unable to query repeater status"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:808
+msgid "Stopped"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:809
+msgid "The repeater is not currently running. Click Save & Apply to start it again."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:815
+msgid "Create a wireless client uplink, scan nearby access points, and attach the resulting station either to WAN or to LAN."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:823
+msgid "Repeater Settings"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:825
+msgid "Connection Status"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:828
+msgid "Collecting status..."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:832
+msgid "Wireless Radio"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:833
+msgid "Choose the 2.4 GHz, 5 GHz, or 6 GHz radio that should work as the repeater station."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:842
+msgid "Attach As"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:843
+msgid "Attach the repeater client either as a WAN uplink or directly into LAN bridge mode."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:844
+msgid "WAN"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:845
+msgid "LAN"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:850
+msgid "Open a scan dialog similar to the standard wireless page and copy the selected SSID into the fields below."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:963
+msgid "Immediately remove the wireless station, the generated network interface, and related firewall bindings created by this app."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:852
+msgid "Scan"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:855
+msgid "Target SSID"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:856
+msgid "Filled automatically after scan, but you can also enter the SSID manually for hidden networks."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:859
+msgid "Lock To BSSID"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:860
+msgid "Optional. If set, only the selected BSSID will be used instead of roaming between APs with the same SSID."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:865
+msgid "The detected encryption is filled automatically after scan. You can still adjust it before applying."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1060
+msgid "Algorithm"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1061
+msgid "Choose the cipher algorithm used by the target wireless network, for example AES (CCMP)."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1062
+msgid "auto"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1063
+msgid "AES (CCMP)"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1064
+msgid "AES (CCMP-256)"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1065
+msgid "AES (GCMP)"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1066
+msgid "AES (GCMP-256)"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1067
+msgid "TKIP"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1068
+msgid "TKIP + AES (CCMP)"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1085
+msgid "WPA3-SAE does not support TKIP. Please choose an AES-based algorithm."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:878
+msgid "Password / Key"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:879
+msgid "Enter the WPA passphrase or WEP key for the selected network."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:896
+msgid "A password or key is required."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:900
+msgid "Expecting a valid WEP key."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:903
+msgid "Expecting a WPA key with at least 8 characters."
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:908
+msgid "Note"
+msgstr ""
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:911
+msgid "LAN mode bridges the wireless client into the existing LAN network. Some chipsets may require 4addr/WDS support from the upstream access point."
+msgstr ""
diff --git a/luci-app-repeater/po/zh-cn b/luci-app-repeater/po/zh-cn
new file mode 120000
index 00000000..8d69574d
--- /dev/null
+++ b/luci-app-repeater/po/zh-cn
@@ -0,0 +1 @@
+zh_Hans
\ No newline at end of file
diff --git a/luci-app-repeater/po/zh_Hans/repeater.po b/luci-app-repeater/po/zh_Hans/repeater.po
new file mode 100644
index 00000000..bf5996dc
--- /dev/null
+++ b/luci-app-repeater/po/zh_Hans/repeater.po
@@ -0,0 +1,395 @@
+msgid ""
+msgstr ""
+"Content-Type: text/plain; charset=UTF-8\n"
+"Project-Id-Version: luci-app-repeater\n"
+"Last-Translator: Automatically generated\n"
+"Language-Team: none\n"
+"Language: zh-Hans\n"
+"MIME-Version: 1.0\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:101
+msgid "2.4 GHz"
+msgstr "2.4 GHz"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:103
+msgid "5 GHz"
+msgstr "5 GHz"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:105
+msgid "6 GHz"
+msgstr "6 GHz"
+
+#: applications/luci-app-repeater/root/usr/share/rpcd/acl.d/luci-app-repeater.json:3
+msgid "Grant access to wireless repeater configuration"
+msgstr "授予无线中继配置访问权限"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:107
+msgid "Unknown"
+msgstr "未知"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:127
+msgid "Open / None"
+msgstr "开放 / 无加密"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:129
+msgid "OWE"
+msgstr "OWE"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:131
+msgid "WEP Open System"
+msgstr "WEP 开放式"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:133
+msgid "WEP Shared Key"
+msgstr "WEP 共享密钥"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:135
+msgid "WPA-PSK"
+msgstr "WPA-PSK"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:137
+msgid "WPA2-PSK"
+msgstr "WPA2-PSK"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:139
+msgid "WPA/WPA2-PSK Mixed"
+msgstr "WPA/WPA2-PSK 混合"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:141
+msgid "WPA3-SAE"
+msgstr "WPA3-SAE"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:143
+msgid "WPA2/WPA3-SAE Mixed"
+msgstr "WPA2/WPA3-SAE 混合"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:221
+msgid "Password may be incorrect"
+msgstr "密码可能不正确"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:224
+msgid "The access point rejected association"
+msgstr "接入点拒绝了关联请求"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:227
+msgid "Authentication failed or timed out"
+msgstr "认证失败或超时"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:230
+msgid "Target SSID was not found"
+msgstr "未找到目标 SSID"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:233
+msgid "Unable to complete the connection attempt"
+msgstr "无法完成连接尝试"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:356
+msgid "Start refresh"
+msgstr "开始刷新"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:361
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:481
+msgid "Stop refresh"
+msgstr "停止刷新"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:395
+msgid "The selected network uses an enterprise or unsupported authentication mode. You may need to configure it manually."
+msgstr "所选网络使用企业级或当前页面不支持的认证方式，可能需要手动配置。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:443
+msgid "hidden"
+msgstr "隐藏"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:450
+msgid "Use this network"
+msgstr "使用该网络"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:456
+msgid "No networks found nearby."
+msgstr "附近未发现无线网络。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:467
+msgid "Signal"
+msgstr "信号"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:468
+msgid "SSID"
+msgstr "SSID"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:469
+msgid "Channel"
+msgstr "信道"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:470
+msgid "BSSID"
+msgstr "BSSID"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:471
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:864
+msgid "Encryption"
+msgstr "加密方式"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:483
+msgid "Starting wireless scan..."
+msgstr "正在启动无线扫描..."
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:485
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:849
+msgid "Wireless Scan"
+msgstr "无线扫描"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:493
+msgid "Dismiss"
+msgstr "关闭"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:511
+msgid "Please choose a wireless radio first."
+msgstr "请先选择一个无线射频。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:521
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:962
+msgid "Stop Wireless Repeater"
+msgstr "停止无线中继"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:522
+msgid "This will remove the wireless station, the generated network interface, and related firewall bindings created by this app."
+msgstr "这会移除本应用下发的无线客户端、生成的网络接口以及相关防火墙绑定。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:527
+msgid "Cancel"
+msgstr "取消"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:532
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:965
+msgid "Stop"
+msgstr "停止"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:543
+msgid "Cleaning up repeater configuration..."
+msgstr "正在清理无线中继配置..."
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:604
+msgid "A wireless radio must be selected."
+msgstr "必须选择一个无线射频。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:607
+msgid "SSID must not be empty."
+msgstr "SSID 不能为空。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:610
+msgid "The selected radio is not available."
+msgstr "所选射频不可用。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:613
+msgid "A password or key is required for the selected encryption mode."
+msgstr "当前加密方式需要填写密码或密钥。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:670
+msgid "LAN interface was not found. Please create network.lan first."
+msgstr "未找到 LAN 接口，请先创建 network.lan。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:701
+msgid "Not configured"
+msgstr "尚未配置"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:702
+msgid "Choose a radio, scan for an SSID, then save and apply the settings."
+msgstr "请选择射频、扫描 SSID，然后保存并应用设置。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:724
+msgid "Connected to %s, waiting for DHCP"
+msgstr "已连接到 %s，正在等待 DHCP"
+
+#: applications/luci-app-repeater/root/usr/share/luci/menu.d/luci-app-repeater.json:3
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:814
+msgid "Wireless Repeater"
+msgstr "无线中继"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:731
+msgid "Connected to %s"
+msgstr "已连接到 %s"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:735
+msgid "IP: %s"
+msgstr "IP：%s"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:736
+msgid "Bridged through %s"
+msgstr "已通过 %s 桥接"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:744
+msgid "Authenticating / connecting..."
+msgstr "正在认证 / 连接中..."
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:745
+msgid "Wireless interface: %s"
+msgstr "无线接口：%s"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:745
+msgid "The station interface is starting."
+msgstr "无线客户端接口正在启动。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:753
+msgid "Connection failed"
+msgstr "连接失败"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:753
+msgid "Not connected"
+msgstr "未连接"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:754
+msgid "The repeater station is not associated with the selected SSID."
+msgstr "无线中继客户端尚未关联到所选 SSID。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:787
+msgid "Unable to query repeater status"
+msgstr "无法获取中继状态"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:808
+msgid "Stopped"
+msgstr "已停止"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:809
+msgid "The repeater is not currently running. Click Save & Apply to start it again."
+msgstr "无线中继当前未运行，点击“保存并应用”即可再次启动。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:815
+msgid "Create a wireless client uplink, scan nearby access points, and attach the resulting station either to WAN or to LAN."
+msgstr "创建无线客户端上联，扫描附近 AP，并将生成的客户端接口接入 WAN 或 LAN。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:823
+msgid "Repeater Settings"
+msgstr "中继设置"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:825
+msgid "Connection Status"
+msgstr "连接状态"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:828
+msgid "Collecting status..."
+msgstr "正在收集状态..."
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:832
+msgid "Wireless Radio"
+msgstr "无线射频"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:833
+msgid "Choose the 2.4 GHz, 5 GHz, or 6 GHz radio that should work as the repeater station."
+msgstr "选择要作为无线中继客户端使用的 2.4 GHz、5 GHz 或 6 GHz 射频。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:842
+msgid "Attach As"
+msgstr "接入方式"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:843
+msgid "Attach the repeater client either as a WAN uplink or directly into LAN bridge mode."
+msgstr "将无线中继客户端作为 WAN 上联接入，或直接桥接到 LAN。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:844
+msgid "WAN"
+msgstr "WAN"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:845
+msgid "LAN"
+msgstr "LAN"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:850
+msgid "Open a scan dialog similar to the standard wireless page and copy the selected SSID into the fields below."
+msgstr "打开一个类似标准无线页面的扫描窗口，并将选中的 SSID 回填到下方字段。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:963
+msgid "Immediately remove the wireless station, the generated network interface, and related firewall bindings created by this app."
+msgstr "立即移除本应用下发的无线客户端、生成的网络接口以及相关防火墙绑定。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:852
+msgid "Scan"
+msgstr "扫描"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:855
+msgid "Target SSID"
+msgstr "目标 SSID"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:856
+msgid "Filled automatically after scan, but you can also enter the SSID manually for hidden networks."
+msgstr "扫描后会自动填充；对于隐藏网络，也可以手动输入 SSID。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:859
+msgid "Lock To BSSID"
+msgstr "锁定到 BSSID"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:860
+msgid "Optional. If set, only the selected BSSID will be used instead of roaming between APs with the same SSID."
+msgstr "可选。如果填写，只会连接到指定的 BSSID，而不会在相同 SSID 的多个 AP 之间漫游。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:865
+msgid "The detected encryption is filled automatically after scan. You can still adjust it before applying."
+msgstr "扫描后会自动填入检测到的加密方式，你仍可在应用前手动调整。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1060
+msgid "Algorithm"
+msgstr "算法"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1061
+msgid "Choose the cipher algorithm used by the target wireless network, for example AES (CCMP)."
+msgstr "选择目标无线网络使用的加密算法，例如 AES（CCMP）。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1062
+msgid "auto"
+msgstr "自动"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1063
+msgid "AES (CCMP)"
+msgstr "AES（CCMP）"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1064
+msgid "AES (CCMP-256)"
+msgstr "AES（CCMP-256）"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1065
+msgid "AES (GCMP)"
+msgstr "AES（GCMP）"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1066
+msgid "AES (GCMP-256)"
+msgstr "AES（GCMP-256）"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1067
+msgid "TKIP"
+msgstr "TKIP"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1068
+msgid "TKIP + AES (CCMP)"
+msgstr "TKIP + AES（CCMP）"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:1085
+msgid "WPA3-SAE does not support TKIP. Please choose an AES-based algorithm."
+msgstr "WPA3-SAE 不支持 TKIP，请选择基于 AES 的算法。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:878
+msgid "Password / Key"
+msgstr "密码 / 密钥"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:879
+msgid "Enter the WPA passphrase or WEP key for the selected network."
+msgstr "输入所选网络的 WPA 密码或 WEP 密钥。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:896
+msgid "A password or key is required."
+msgstr "需要填写密码或密钥。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:900
+msgid "Expecting a valid WEP key."
+msgstr "请输入有效的 WEP 密钥。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:903
+msgid "Expecting a WPA key with at least 8 characters."
+msgstr "请输入至少 8 个字符的 WPA 密钥。"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:908
+msgid "Note"
+msgstr "注意"
+
+#: applications/luci-app-repeater/htdocs/luci-static/resources/view/network/repeater.js:911
+msgid "LAN mode bridges the wireless client into the existing LAN network. Some chipsets may require 4addr/WDS support from the upstream access point."
+msgstr "LAN 模式会把无线客户端桥接到现有 LAN 网络。某些芯片可能需要上游 AP 支持 4addr/WDS。"
diff --git a/luci-app-repeater/root/etc/config/repeater b/luci-app-repeater/root/etc/config/repeater
new file mode 100644
index 00000000..a5e5a204
--- /dev/null
+++ b/luci-app-repeater/root/etc/config/repeater
@@ -0,0 +1,9 @@
+config repeater 'main'
+	option role 'wan'
+	option encryption 'psk2'
+	option cipher 'auto'
+	option applied '0'
+	option wireless_sid 'repeater_sta'
+	option network_name 'repeater_wwan'
+	option zone_name 'wan'
+	option managed_network '1'
diff --git a/luci-app-repeater/root/usr/share/luci/menu.d/luci-app-repeater.json b/luci-app-repeater/root/usr/share/luci/menu.d/luci-app-repeater.json
new file mode 100644
index 00000000..70a68771
--- /dev/null
+++ b/luci-app-repeater/root/usr/share/luci/menu.d/luci-app-repeater.json
@@ -0,0 +1,16 @@
+{
+	"admin/network/repeater": {
+		"title": "Wireless Repeater",
+		"order": 35,
+		"action": {
+			"type": "view",
+			"path": "network/repeater"
+		},
+		"depends": {
+			"acl": [ "luci-app-repeater" ],
+			"uci": {
+				"wireless": true
+			}
+		}
+	}
+}
diff --git a/luci-app-repeater/root/usr/share/rpcd/acl.d/luci-app-repeater.json b/luci-app-repeater/root/usr/share/rpcd/acl.d/luci-app-repeater.json
new file mode 100644
index 00000000..e1980d71
--- /dev/null
+++ b/luci-app-repeater/root/usr/share/rpcd/acl.d/luci-app-repeater.json
@@ -0,0 +1,26 @@
+{
+	"luci-app-repeater": {
+		"description": "Grant access to wireless repeater configuration",
+		"read": {
+			"file": {
+				"/sbin/logread": [ "exec" ]
+			},
+			"ubus": {
+				"file": [ "exec" ],
+				"iwinfo": [ "freqlist", "info" ],
+				"luci-rpc": [ "getBoardJSON", "getHostHints", "getNetworkDevices", "getWirelessDevices" ],
+				"network": [ "get_proto_handlers" ],
+				"network.interface": [ "dump" ],
+				"network.wireless": [ "status" ]
+			},
+			"uci": [ "firewall", "luci", "network", "repeater", "wireless" ]
+		},
+		"write": {
+			"ubus": {
+				"file": [ "exec" ],
+				"iwinfo": [ "scan" ]
+			},
+			"uci": [ "firewall", "network", "repeater", "wireless" ]
+		}
+	}
+}
diff --git a/luci-app-turboacc/htdocs/luci-static/resources/view/turboacc.js b/luci-app-turboacc/htdocs/luci-static/resources/view/turboacc.js
index e1801011..b59f8815 100644
--- a/luci-app-turboacc/htdocs/luci-static/resources/view/turboacc.js
+++ b/luci-app-turboacc/htdocs/luci-static/resources/view/turboacc.js
@@ -180,6 +180,14 @@ return view.extend({
 		o.rmempty = false;
 		o.depends('fastpath_mh_eth_hnat', '1');
 
+		if (features.hasMTKWEDWO) {
+			o = s.option(form.Flag, 'fastpath_mh_eth_hnat_wed', _('MTK WED WO offloading'),
+				_('Requires hardware support, implemented at least for Filogic 8x0'));
+			o.default = o.disabled;
+			o.rmempty = false;
+			o.depends({ 'fastpath': 'flow_offloading', 'fastpath_fo_hw': '1' });
+		}
+
 		o = s.option(form.ListValue, 'fullcone', _('Full cone NAT'),
 			_('Full cone NAT (NAT1) can improve gaming performance effectively.'));
 		o.value('0', _('Disable'))
diff --git a/luci-app-turboacc/root/etc/config/turboacc b/luci-app-turboacc/root/etc/config/turboacc
index f89f86a3..9b1f632d 100644
--- a/luci-app-turboacc/root/etc/config/turboacc
+++ b/luci-app-turboacc/root/etc/config/turboacc
@@ -2,3 +2,4 @@ config turboacc 'global'
 	option set '0'
 
 config turboacc 'config'
+	option fastpath_mh_eth_hnat_wed '0'
diff --git a/luci-app-turboacc/root/etc/init.d/turboacc b/luci-app-turboacc/root/etc/init.d/turboacc
index f8a0dbbc..73c8fecf 100755
--- a/luci-app-turboacc/root/etc/init.d/turboacc
+++ b/luci-app-turboacc/root/etc/init.d/turboacc
@@ -6,11 +6,94 @@ START=90
 STOP=10
 USE_PROCD=1
 
+MTK_WED_MODULES="mt7915e mt7996e"
+
 start_service() {
 	config_load "turboacc"
 
 	local fastpath
 	config_get fastpath "config" "fastpath"
+	local fastpath_fo_hw
+	config_get_bool fastpath_fo_hw "config" "fastpath_fo_hw" "0"
+	local fastpath_mh_eth_hnat_wed
+	config_get_bool fastpath_mh_eth_hnat_wed "config" "fastpath_mh_eth_hnat_wed" "0"
+
+	local kernel_version
+	kernel_version="$(uname -r)"
+
+	find_wed_module() {
+		local mod
+
+		for mod in $MTK_WED_MODULES; do
+			lsmod | grep -q "^$mod " && {
+				echo "$mod"
+				return 0
+			}
+		done
+
+		for mod in $MTK_WED_MODULES; do
+			[ -e "/lib/modules/$kernel_version/$mod.ko" ] && {
+				echo "$mod"
+				return 0
+			}
+		done
+
+		return 1
+	}
+
+	find_loaded_wed_module() {
+		local mod
+
+		for mod in $MTK_WED_MODULES; do
+			lsmod | grep -q "^$mod " && {
+				echo "$mod"
+				return 0
+			}
+		done
+
+		return 1
+	}
+
+	is_wed_wo_enabled() {
+		local mod="$1"
+		local value
+
+		[ -n "$mod" ] || return 1
+		[ -r "/sys/module/$mod/parameters/wed_enable" ] || return 1
+
+		value="$(cat "/sys/module/$mod/parameters/wed_enable" 2>/dev/null)"
+
+		[ "$value" = "Y" ] || [ "$value" = "1" ]
+	}
+
+	load_wed_wo() {
+		local mod
+		local loaded_mod
+
+		mod="$(find_wed_module)" || return 0
+		loaded_mod="$(find_loaded_wed_module)" || true
+
+		[ "$loaded_mod" = "$mod" ] && is_wed_wo_enabled "$mod" && return 0
+
+		wifi down >/dev/null 2>&1
+		rmmod "$mod" 2>/dev/null
+		sleep 1
+		modprobe "$mod" wed_enable=Y 2>/dev/null || modprobe "$mod" 2>/dev/null
+		wifi up >/dev/null 2>&1
+	}
+
+	unload_wed_wo() {
+		local mod
+
+		mod="$(find_loaded_wed_module)" || return 0
+		is_wed_wo_enabled "$mod" || return 0
+
+		wifi down >/dev/null 2>&1
+		rmmod "$mod" 2>/dev/null
+		sleep 1
+		modprobe "$mod" 2>/dev/null
+		wifi up >/dev/null 2>&1
+	}
 
 	if [ "$fastpath" != "fast_classifier" ] && lsmod | grep -q "fast_classifier"; then
 		echo "0" > "/sys/fast_classifier/skip_to_bridge_ingress" 2>"/dev/null"
@@ -65,6 +148,14 @@ start_service() {
 		;;
 	esac
 
+	if [ "$fastpath_mh_eth_hnat_wed" -eq "1" ] &&
+	   [ "$fastpath" = "flow_offloading" ] &&
+	   [ "$fastpath_fo_hw" -eq "1" ]; then
+		load_wed_wo
+	else
+		unload_wed_wo
+	fi
+
 	uci -q set "firewall.@defaults[0].flow_offloading"="$flow_offloading"
 	uci -q set "firewall.@defaults[0].flow_offloading_hw"="$flow_offloading_hw"
 
diff --git a/luci-app-turboacc/root/etc/uci-defaults/turboacc b/luci-app-turboacc/root/etc/uci-defaults/turboacc
index 33767349..96ae9993 100644
--- a/luci-app-turboacc/root/etc/uci-defaults/turboacc
+++ b/luci-app-turboacc/root/etc/uci-defaults/turboacc
@@ -20,6 +20,7 @@ elif [ -e "/lib/modules/$kernel_ver/mtkhnat.ko" ]; then
 	uci -q set "turboacc.config.fastpath"="mediatek_hnat"
 	uci -q set "turboacc.config.fastpath_mh_eth_hnat"="1"
 	uci -q set "turboacc.config.fastpath_mh_eth_hnat_v6"="1"
+	uci -q set "turboacc.config.fastpath_mh_eth_hnat_wed"="0"
 elif [ -e "/lib/modules/$kernel_ver/xt_FLOWOFFLOAD.ko" ]; then
 	uci -q set "turboacc.config.fastpath"="flow_offloading"
 	if grep -q "mt762" "/etc/openwrt_release"; then
diff --git a/luci-app-turboacc/root/usr/libexec/rpcd/luci.turboacc b/luci-app-turboacc/root/usr/libexec/rpcd/luci.turboacc
index ab3e6e6d..1a31824c 100755
--- a/luci-app-turboacc/root/usr/libexec/rpcd/luci.turboacc
+++ b/luci-app-turboacc/root/usr/libexec/rpcd/luci.turboacc
@@ -8,11 +8,38 @@ local sys  = require "luci.sys"
 
 string.trim = util.trim
 
+local mtk_wed_modules = {
+	"mt7915e",
+	"mt7996e"
+}
+
 local function readfile(path)
 	local s = fs.readfile(path)
 	return s and (s:gsub("^%s+", ""):gsub("%s+$", ""))
 end
 
+local function has_mtkwed_module(kernel)
+	for _, mod in ipairs(mtk_wed_modules) do
+		if fs.access("/lib/modules/" .. kernel .. "/" .. mod .. ".ko") then
+			return true
+		end
+	end
+
+	return false
+end
+
+local function get_mtkwed_param()
+	for _, mod in ipairs(mtk_wed_modules) do
+		local path = "/sys/module/" .. mod .. "/parameters/wed_enable"
+
+		if fs.access(path) then
+			return readfile(path)
+		end
+	end
+
+	return nil
+end
+
 local methods = {
 	getSystemFeatures = {
 		call = function()
@@ -24,6 +51,8 @@ local methods = {
 				hasSHORTCUTFECM   = fs.access("/lib/modules/" .. boardinfo.kernel .. "/shortcut-fe-cm.ko"),
 				hasNSSECM         = fs.access("/etc/init.d/qca-nss-ecm"),
 				hasMEDIATEKHNAT   = fs.access("/lib/modules/" .. boardinfo.kernel .. "/mtkhnat.ko"),
+				hasMTKWEDWO       = (sys.call("grep -Eq 'mediatek' /etc/openwrt_release") == 0) and
+					has_mtkwed_module(boardinfo.kernel),
 				hasXTFULLCONENAT  = fs.access("/lib/modules/" .. boardinfo.kernel .. "/xt_FULLCONENAT.ko"),
 				hasNFTFULLCONENAT  = fs.access("/lib/modules/" .. boardinfo.kernel .. "/nft_fullcone.ko"),
 				hasTCPCCA         = readfile("/proc/sys/net/ipv4/tcp_available_congestion_control")
@@ -49,8 +78,15 @@ local methods = {
 			elseif fs.stat("/sys/kernel/debug/hnat", "type") == "dir" then
 				local ethernet_hnat = (readfile("/sys/kernel/debug/hnat/hook_toggle") ~= "enabled") and
 					" / Ethernet HNAT Disabled" or ""
-				local wireless_hnat = (sys.call("grep -q 'WHNAT=1' '/etc/wireless/mediatek/'*_card*.dat") ~= 0) and
-					" / Wireless HNAT Disabled" or ""
+				local wireless_hnat = ""
+				local wed_enabled = get_mtkwed_param()
+				if wed_enabled ~= nil then
+					wireless_hnat = (wed_enabled == "Y" or wed_enabled == "1") and "" or
+						" / Wireless HNAT Disabled"
+				else
+					wireless_hnat = (sys.call("grep -q 'WHNAT=1' '/etc/wireless/mediatek/'*_card*.dat") ~= 0) and
+						" / Wireless HNAT Disabled" or ""
+				end
 				if (ethernet_hnat == "") or (wireless_hnat == "") then
 					fptype = "MediaTek HNAT" .. ethernet_hnat .. wireless_hnat
 				end
diff --git a/my-default-settings/Makefile b/my-default-settings/Makefile
index fc51e823..79993b84 100644
--- a/my-default-settings/Makefile
+++ b/my-default-settings/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=my-default-settings
 PKG_VERSION:=2
-PKG_RELEASE:=5
+PKG_RELEASE:=6
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/my-default-settings/files/etc/uci-defaults/99-default-settings b/my-default-settings/files/etc/uci-defaults/99-default-settings
index e0a23b46..37d8e088 100644
--- a/my-default-settings/files/etc/uci-defaults/99-default-settings
+++ b/my-default-settings/files/etc/uci-defaults/99-default-settings
@@ -9,11 +9,9 @@ sed -i "s/op.supes.top/dl.openwrt.ai/" /etc/opkg/distfeeds.conf
 	ln -sf /root/.bash_history /tmp/.busybox_ash_history
 }
 
-# [[ "$(df | grep overlay)" && ! "$(df | grep /rom/overlay)" ]] && firstboot
+version=$(uci -q get base_config.@status[0].version)
 
-version=`uci -q get base_config.@status[0].version`
-
-hostname=`uci -q get system.@system[0].hostname`
+hostname=$(uci -q get system.@system[0].hostname)
 [ -n "${hostname}" ] || hostname="Kwrt"
 
 if [ "$(uci -q get dhcp.@dnsmasq[0].port)" != "53" ]; then
@@ -23,31 +21,33 @@ fi
 
 sed -i '/profile.d/d' /lib/upgrade/keep.d/base-files
 
-echo $(uci -q get uhttpd.main.index_page) | grep -q "cgi-bin/luci" ||
-	uci -q add_list uhttpd.main.index_page='cgi-bin/luci' && uci commit uhttpd
+if ! echo "$(uci -q get uhttpd.main.index_page)" | grep -q "cgi-bin/luci"; then
+	uci -q add_list uhttpd.main.index_page='cgi-bin/luci'
+	uci commit uhttpd
+fi
 
-if [[ "$(uci -q get dropbear.main._direct)" != "1" && "$(uci -q get dropbear.main.Interface)" == "lan" ]]; then
+if [ "$(uci -q get dropbear.main._direct)" != "1" ] && [ -n "$(uci -q get dropbear.main.Interface)" ]; then
 	uci del dropbear.main.Interface
 	uci commit dropbear
 fi
 
-[[ -x /usr/bin/wget && ! -x /usr/bin/wget-ssl ]] && 	
+[ -x /usr/bin/wget ] && [ ! -x /usr/bin/wget-ssl ] && \
 	ln -s /usr/bin/wget /usr/bin/wget-ssl
 
 sed -i "s/git-.*-\(.*\)/git-\1/g" /usr/lib/lua/luci/version.lua
 
 if [ -f /etc/uwsgi/vassals/luci-webui.ini ]; then
-processor=`cat /proc/cpuinfo | grep 'processor' | wc -l`
-[ -n "$processor" ] || processor=3
-sed -i "/^threads =/c\threads = $processor" /etc/uwsgi/vassals/luci-webui.ini
+	processor=$(grep -c 'processor' /proc/cpuinfo)
+	[ -n "$processor" ] && [ "$processor" -gt 0 ] || processor=3
+	sed -i "/^threads =/c\threads = $processor" /etc/uwsgi/vassals/luci-webui.ini
 fi
 
 if [ -f /etc/config/attendedsysupgrade ]; then
-uci -q set attendedsysupgrade.server.url='https://openwrt.ai'
-uci commit attendedsysupgrade
+	uci -q set attendedsysupgrade.server.url='https://openwrt.ai'
+	uci commit attendedsysupgrade
 fi
 
-if [[ ! "$version" || "$version" -lt 1 ]]; then
+if [ -z "$version" ] || [ "$version" -lt 1 ]; then
 	uci -q set luci.main.lang='auto'
 	uci -q set luci.main.mediaurlbase=/luci-static/argon
 	uci commit luci
@@ -74,20 +74,20 @@ if [[ ! "$version" || "$version" -lt 1 ]]; then
 	
 	(echo "root"; sleep 1; echo "root") | /bin/busybox passwd root >/dev/null 2>&1 &
 
-		uci -q set firewall.@defaults[0].flow_offloading='1'
-		uci -q set firewall.@defaults[0].flow_offloading_hw='1'
-		uci commit firewall
+	uci -q set firewall.@defaults[0].flow_offloading='1'
+	uci -q set firewall.@defaults[0].flow_offloading_hw='1'
+	uci commit firewall
 
 	uci -q set upnpd.config.enabled='1'
 	uci commit upnpd
 	
-	grep -q log-facility /etc/dnsmasq.conf ||
+	grep -q log-facility /etc/dnsmasq.conf || \
 		echo "log-facility=/dev/null" >> /etc/dnsmasq.conf
 
-	#kernel_version="$(echo -n $(uname -r))"
-	#if [[ -f /lib/modules/$kernel_version/xt_FULLCONENAT.ko || -f /lib/modules/$kernel_version/nft_fullcone.ko ]]; then
-	#uci -q set firewall.@defaults[0].fullcone='1'
-	#uci commit firewall
+	#kernel_version=$(uname -r)
+	#if [ -f "/lib/modules/$kernel_version/xt_FULLCONENAT.ko" ] || [ -f "/lib/modules/$kernel_version/nft_fullcone.ko" ]; then
+	#	uci -q set firewall.@defaults[0].fullcone='1'
+	#	uci commit firewall
 	#fi
 
 	uci -q set fstab.@global[0].anon_mount=1
@@ -106,17 +106,14 @@ if [[ ! "$version" || "$version" -lt 1 ]]; then
 	uci -q set dhcp.lan.ra='hybrid'
 	uci -q set dhcp.lan.ndp='hybrid'
 	uci -q set dhcp.lan.dhcpv6='hybrid'
-	uci -q set dhcp.lan.force='1'
 	uci commit dhcp
 
 	uci -q set nft-qos.default.limit_enable='0'
 	uci commit nft-qos
-
-	
 fi
 
 # kB
-memtotal=`grep MemTotal /proc/meminfo | awk '{print $2}'`
+memtotal=$(grep MemTotal /proc/meminfo | awk '{print $2}')
 if [ "$memtotal" -ge 1048576 ]; then
 	# > 1024M
 	cachesize=10000
@@ -149,7 +146,7 @@ else
 	nf_conntrack_max=16384
 fi
 
-if [[ ! "$version" || "$version" -lt 1 ]]; then
+if [ -z "$version" ] || [ "$version" -lt 1 ]; then
 	uci -q get dhcp.@dnsmasq[0] || uci -q add dhcp dnsmasq
 	uci -q set dhcp.@dnsmasq[0].cachesize="$cachesize"
 	uci -q set dhcp.@dnsmasq[0].dnsforwardmax="$dnsforwardmax"
@@ -158,47 +155,49 @@ if [[ ! "$version" || "$version" -lt 1 ]]; then
 	uci -q set dhcp.@dnsmasq[0].rebind_protection='0'
 	uci -q set dhcp.@dnsmasq[0].rebind_localhost='1'
 	uci commit dhcp
+	
 	uci -q set system.@system[0].zram_comp_algo='zstd'
-	uci -q set system.@system[0].zram_size_mb="$(expr $memtotal / 1024 / 3)"
+	uci -q set system.@system[0].zram_size_mb="$((memtotal / 1024 / 3))"
 	uci commit system
 	
 	# sysctl overwrite
 	SYSCTL_LOCAL=/etc/sysctl.d/50-local.conf
 	mkdir -p /etc/sysctl.d
-	echo -n >$SYSCTL_LOCAL
-	echo net.nf_conntrack_max=$nf_conntrack_max >>$SYSCTL_LOCAL
-	echo net.core.rmem_max=$nf_conntrack_max >>$SYSCTL_LOCAL
+	> "$SYSCTL_LOCAL"
+	echo "net.nf_conntrack_max=$nf_conntrack_max" >> "$SYSCTL_LOCAL"
+	echo "net.core.rmem_max=$nf_conntrack_max" >> "$SYSCTL_LOCAL"
 
-if [ -n "$(command -v nginx)" ]; then
-	uci add wizard shortcuts
-	uci set wizard.@shortcuts[-1].shortcut='pw'
-	uci set wizard.@shortcuts[-1].to_url='http://10.0.0.1/cgi-bin/luci/admin/services/passwall'
-	uci set wizard.@shortcuts[-1].comments='passwall'
-	uci commit wizard
+	if [ -n "$(command -v nginx)" ]; then
+		uci add wizard shortcuts
+		uci set wizard.@shortcuts[-1].shortcut='pw'
+		uci set wizard.@shortcuts[-1].to_url='http://10.0.0.1/cgi-bin/luci/admin/services/passwall'
+		uci set wizard.@shortcuts[-1].comments='passwall'
+		uci commit wizard
 
-	uci -q set nginx._sc_pw=server
-	uci -q set nginx._sc_pw.server_name="pw"
-	uci -q add_list nginx._sc_pw.listen="80"
-	uci -q add_list nginx._sc_pw.listen="443"
-	uci -q set nginx._sc_pw.return="302 http://10.0.0.1/cgi-bin/luci/admin/services/passwall"
+		uci -q set nginx._sc_pw=server
+		uci -q set nginx._sc_pw.server_name="pw"
+		uci -q add_list nginx._sc_pw.listen="80"
+		uci -q add_list nginx._sc_pw.listen="443"
+		uci -q set nginx._sc_pw.return="302 http://10.0.0.1/cgi-bin/luci/admin/services/passwall"
 
-	uci -q set dhcp._sc_pw=domain
-	uci -q set dhcp._sc_pw.name="pw"
-	uci -q set dhcp._sc_pw.ip="10.0.0.1"
-	uci -q set dhcp._sc_pw.comments="PassWall"
-	uci commit dhcp
-fi
-if [ -z "`uci -q get dhcp._ta`" ]; then
-	uci -q set dhcp._ta=domain
-	uci -q set dhcp._ta.name="time.android.com"
-	uci -q set dhcp._ta.ip="203.107.6.88"
-	uci -q set dhcp._ta.comments="time.android"
-	uci commit dhcp
-fi
+		uci -q set dhcp._sc_pw=domain
+		uci -q set dhcp._sc_pw.name="pw"
+		uci -q set dhcp._sc_pw.ip="10.0.0.1"
+		uci -q set dhcp._sc_pw.comments="PassWall"
+		uci commit dhcp
+	fi
+	
+	if [ -z "$(uci -q get dhcp._ta)" ]; then
+		uci -q set dhcp._ta=domain
+		uci -q set dhcp._ta.name="time.android.com"
+		uci -q set dhcp._ta.ip="203.107.6.88"
+		uci -q set dhcp._ta.comments="time.android"
+		uci commit dhcp
+	fi
 	version=1
 fi
 
-if [ -z "`uci -q get dhcp.default_server`" ]; then
+if [ -z "$(uci -q get dhcp.default_server)" ]; then
 	uci -q set dhcp.default_server=domain
 	uci -q set dhcp.default_server.name='kwrt'
 	uci -q set dhcp.default_server.ip='10.0.0.1'
@@ -207,38 +206,40 @@ if [ -z "`uci -q get dhcp.default_server`" ]; then
 fi
 
 if [ -n "$(command -v nginx)" ]; then
-if [ -z "`uci -q get nginx.default_server`" ]; then
-	uci -q set nginx.default_server=server
-	uci -q set nginx.default_server.server_name='kwrt'
-	uci -q add_list nginx.default_server.listen='80 default_server'
-	uci -q add_list nginx.default_server.listen='[::]:80 default_server'
-	uci -q add_list nginx.default_server.include='conf.d/*.locations'
-	uci -q set nginx.default_server.access_log='off; # logd openwrt'
-	uci commit nginx
-fi
-grep -q "uwsgi_read_timeout" /etc/nginx/conf.d/luci.locations 2>/dev/null || {
-	sed -i "s/include uwsgi_params;/include uwsgi_params;\n\t\tuwsgi_read_timeout 300s;/" /etc/nginx/conf.d/luci.locations
-	sed -i '/ubus_parallel_req/a\        ubus_script_timeout 600;' /etc/nginx/conf.d/luci.locations
-}
+	if [ -z "$(uci -q get nginx.default_server)" ]; then
+		uci -q set nginx.default_server=server
+		uci -q set nginx.default_server.server_name='kwrt'
+		uci -q add_list nginx.default_server.listen='80 default_server'
+		uci -q add_list nginx.default_server.listen='[::]:80 default_server'
+		uci -q add_list nginx.default_server.include='conf.d/*.locations'
+		uci -q set nginx.default_server.access_log='off; # logd openwrt'
+		uci commit nginx
+	fi
+	
+	grep -q "uwsgi_read_timeout" /etc/nginx/conf.d/luci.locations 2>/dev/null || {
+		sed -i "s/include uwsgi_params;/include uwsgi_params;\n\t\tuwsgi_read_timeout 300s;/" /etc/nginx/conf.d/luci.locations
+		sed -i '/ubus_parallel_req/a\        ubus_script_timeout 600;' /etc/nginx/conf.d/luci.locations
+	}
 
-sed -i \
-	-e "s/client_max_body_size 128M/client_max_body_size 3072M/" \
-	-e "s/large_client_header_buffers 2 1k/large_client_header_buffers 4 512k/" \
-	/etc/nginx/uci.conf.template
-grep -q "client_body_buffer_size" /etc/nginx/uci.conf.template ||
+	sed -i \
+		-e "s/client_max_body_size 128M/client_max_body_size 3072M/" \
+		-e "s/large_client_header_buffers 2 1k/large_client_header_buffers 4 512k/" \
+		/etc/nginx/uci.conf.template
+		
+	grep -q "client_body_buffer_size" /etc/nginx/uci.conf.template || \
 		sed -i "/large_client_header_buffers/a\	client_body_buffer_size 128K;" /etc/nginx/uci.conf.template
 fi
 
 rm -rf /tmp/luci-*
-uci -q set base_config.@status[0].version=$version
+uci -q set base_config.@status[0].version="$version"
 uci commit base_config
 
 grep -q "cgi-timeout" /etc/uwsgi/vassals/luci-*.ini 2>/dev/null || sed -i '$a cgi-timeout = 500' /etc/uwsgi/vassals/luci-*.ini
 sed -i "s/limit-as = 1000/limit-as = 5000/g" /etc/uwsgi/vassals/luci-webui.ini
 
 modprobe xt_FULLCONENAT || {
-[ "$(iptables -L -t nat | grep "FULLCONENAT")" ] || {
-uci -q set firewall.@defaults[0].fullcone='0'
-uci commit firewall
-}
+	if ! iptables -L -t nat 2>/dev/null | grep -q "FULLCONENAT"; then
+		uci -q set firewall.@defaults[0].fullcone='0'
+		uci commit firewall
+	fi
 }