🎁 Sync 2026-09-30 10:14:19

firewall/Makefile

@@ -9,20 +9,18 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=firewall
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/firewall3.git
-PKG_SOURCE_DATE:=2025-10-03
-PKG_SOURCE_VERSION:=3a65fde5a3e675fdf2a24cb3f5d12d0a426be36e
+PKG_SOURCE_DATE:=2022-02-17
+PKG_SOURCE_VERSION:=4cd7d4f36bea731bf901cb067456f1d460294926
 PKG_MIRROR_HASH:=skip
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=ISC
 
 PKG_CONFIG_DEPENDS := CONFIG_IPV6
 
-PKG_BUILD_FLAGS:=gc-sections lto
-
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
 
@@ -30,11 +28,8 @@ define Package/firewall
   SECTION:=net
   CATEGORY:=Base system
   TITLE:=OpenWrt C Firewall
-  DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libiptext +IPV6:libiptext6 \
-	+libxtables +kmod-ipt-core +kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +kmod-ipt-nat \
-	+iptables-mod-fullconenat \
-	+iptables-mod-fullconenat +ip6tables-mod-fullconenat +iptables-legacy +ip6tables-legacy +kmod-ipt-nat6 +kmod-ipt-offload \
-	+ipset +iptables-mod-conntrack-extra +iptables-mod-iprange +iptables-mod-socket +iptables-mod-tproxy
+  DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libiptext +IPV6:libiptext6 +libxtables +kmod-ipt-core +kmod-ipt-conntrack +iptables-mod-conntrack-extra +IPV6:kmod-nf-conntrack6 +kmod-ipt-nat +iptables-mod-fullconenat \
+           +ipset +iptables-mod-conntrack-extra +iptables-mod-iprange +iptables-mod-socket +iptables-mod-tproxy
   PROVIDES:=uci-firewall
 endef
 
@@ -47,6 +42,8 @@ define Package/firewall/conffiles
 /etc/firewall.user
 endef
 
+TARGET_CFLAGS += -ffunction-sections -fdata-sections -flto
+TARGET_LDFLAGS += -Wl,--gc-sections -flto
 CMAKE_OPTIONS += $(if $(CONFIG_IPV6),,-DDISABLE_IPV6=1)
 
 define Package/firewall/install

firewall/files/firewall.config

@@ -1,10 +1,9 @@
 config defaults
 	option synflood_protect	1
-	option input		REJECT
+	option input		ACCEPT
 	option output		ACCEPT
 	option forward		REJECT
-	option flow_offloading	1
-	option fullcone		1
+	option fullcone		0
 # Uncomment this line to disable ipv6 rules
 #	option disable_ipv6	1
 
@@ -56,12 +55,13 @@ config rule
 	option target		ACCEPT
 
 # Allow DHCPv6 replies
-# see https://github.com/openwrt/openwrt/issues/5066
+# see https://dev.openwrt.org/ticket/10381
 config rule
 	option name		Allow-DHCPv6
 	option src		wan
 	option proto		udp
-	option dest_ip		fe80::/10
+	option src_ip		fc00::/6
+	option dest_ip		fc00::/6
 	option dest_port	546
 	option family		ipv6
 	option target		ACCEPT
@@ -82,7 +82,7 @@ config rule
 config rule
 	option name		Allow-ICMPv6-Input
 	option src		wan
-	option proto	icmp
+	option proto		icmp
 	list icmp_type		echo-request
 	list icmp_type		echo-reply
 	list icmp_type		destination-unreachable
@@ -141,7 +141,7 @@ config rule
 	option proto		udp
 	option family		ipv4
 	option target		REJECT
-	option enabled		0
+	option enabled		false
 
 # include a file with users custom iptables rules
 config include

firewall/files/firewall.init

@@ -4,6 +4,17 @@ START=19
 USE_PROCD=1
 QUIET=""
 
+LOCK_FILE="/var/lock/procd_firewall.lock"
+set_lock() {
+	exec 1000>"$LOCK_FILE"
+	flock -xn 1000
+}
+
+unset_lock() {
+	flock -u 1000
+	rm -rf "$LOCK_FILE"
+}
+
 validate_firewall_redirect()
 {
 	uci_validate_section firewall redirect "${1}" \
@@ -30,27 +41,39 @@ validate_firewall_rule()
 
 service_triggers() {
 	procd_add_reload_trigger firewall	
+	set_lock
 
 	procd_open_validate
 	validate_firewall_redirect
 	validate_firewall_rule
 	procd_close_validate
+	unset_lock
 }
 
 restart() {
+	unset_lock
+	set_lock
 	fw3 restart
+	unset_lock
 }
 
 start_service() {
+	set_lock
 	fw3 ${QUIET} start
+	unset_lock
 }
 
 stop_service() {
 	fw3 flush
+	unset_lock
 }
 
 reload_service() {
+  unset_lock
+  set_lock
+	reload_config firewall
 	fw3 reload
+	unset_lock
 }
 
 boot() {

firewall/patches/101-bcm-fullconenat.patch

@@ -1,18 +1,17 @@
 --- a/defaults.c
 +++ b/defaults.c
-@@ -49,7 +49,7 @@
+@@ -49,7 +49,7 @@ const struct fw3_option fw3_flag_opts[]
  	FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
  	FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
- 
+ 	
 -	FW3_OPT("fullcone",           bool,     defaults, fullcone),
 +	FW3_OPT("fullcone",           int,     defaults, fullcone),
- 
+ 	
  	FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
  	FW3_OPT("tcp_ecn",             int,      defaults, tcp_ecn),
-
 --- a/options.h
 +++ b/options.h
-@@ -98,6 +98,13 @@
+@@ -98,6 +98,13 @@ enum fw3_reject_code
  	__FW3_REJECT_CODE_MAX
  };
  
@@ -26,7 +25,7 @@
  extern const char *fw3_flag_names[__FW3_FLAG_MAX];
  
  
-@@ -297,7 +304,7 @@
+@@ -297,7 +304,7 @@ struct fw3_defaults
  	enum fw3_reject_code any_reject_code;
  
  	bool syn_flood;
@@ -35,10 +34,9 @@
  	struct fw3_limit syn_flood_rate;
  
  	bool tcp_syncookies;
-
 --- a/zones.c
 +++ b/zones.c
-@@ -756,7 +756,7 @@
+@@ -757,7 +757,7 @@ print_zone_rule(struct fw3_ipt_handle *h
  					r = fw3_ipt_rule_new(handle);
  					fw3_ipt_rule_src_dest(r, msrc, mdest);
  					/*FIXME: Workaround for FULLCONE-NAT*/
@@ -47,7 +45,7 @@
  					{
  						warn("%s will enable FULLCONE-NAT", zone->name);
  						fw3_ipt_rule_target(r, "FULLCONENAT");
-@@ -766,6 +766,12 @@
+@@ -767,6 +767,12 @@ print_zone_rule(struct fw3_ipt_handle *h
  						fw3_ipt_rule_target(r, "FULLCONENAT");
  						fw3_ipt_rule_append(r, "zone_%s_prerouting", zone->name);
  					}