update 2026-09-25 06:56:42

liep/luci-app-ipsec-server/root/etc/init.d/luci-app-ipsec-server

@@ -27,39 +27,39 @@ get_enabled_anonymous_secs() {
 ipt_rule() {
 	if [ "$1" = "add" ]; then
 		iptables -w -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
-		iptables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-		iptables -w -I forwarding_rule -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-		iptables -w -I forwarding_rule -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+		iptables -w -I INPUT -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+		iptables -w -I FORWARD -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+		iptables -w -I FORWARD -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
 
 		ip6tables -w -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
-		ip6tables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-		ip6tables -w -I forwarding_rule -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-		ip6tables -w -I forwarding_rule -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+		ip6tables -w -I INPUT -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+		ip6tables -w -I FORWARD -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+		ip6tables -w -I FORWARD -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
 
 		if [ "${vt_type}" = "L2TP" ]; then
 			iptables -w -t mangle -I OUTPUT -p udp --sport 1701 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
-			iptables -w -I input_rule -p udp --dport 1701 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -I input_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -I input_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -I forwarding_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -I forwarding_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -I output_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -I output_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -t nat -I postrouting_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
-			[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
-			iptables -w -t nat -I postrouting_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
-			[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
+			iptables -w -I INPUT -p udp --dport 1701 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -I INPUT -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -I INPUT -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -I FORWARD -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -I FORWARD -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -I OUTPUT -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -I OUTPUT -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -t nat -I POSTROUTING -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
+			[ "$?" != "0" ] && iptables -w -t nat -I POSTROUTING -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
+			iptables -w -t nat -I POSTROUTING -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
+			[ "$?" != "0" ] && iptables -w -t nat -I POSTROUTING -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
 		else
-			iptables -w -I input_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -I input_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -I forwarding_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -I forwarding_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -I output_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -I output_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
-			iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
-			[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
-			iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
-			[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
+			iptables -w -I INPUT -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -I INPUT -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -I FORWARD -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -I FORWARD -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -I OUTPUT -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -I OUTPUT -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
+			iptables -w -t nat -I POSTROUTING -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
+			[ "$?" != "0" ] && iptables -w -t nat -I POSTROUTING -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
+			iptables -w -t nat -I POSTROUTING -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
+			[ "$?" != "0" ] && iptables -w -t nat -I POSTROUTING -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
 			
 
 			uci -q batch <<-EOF >/dev/null
@@ -80,13 +80,13 @@ ipt_rule() {
 				$1 -w -D $2 $index 2>/dev/null
 			done
 		}
-		ipt_del "iptables -w" "input_rule"
-		ipt_del "iptables -w" "forwarding_rule"
-		ipt_del "iptables -w" "output_rule"
-		ipt_del "iptables -w -t nat" "postrouting_rule"
+		ipt_del "iptables -w" "INPUT"
+		ipt_del "iptables -w" "FORWARD"
+		ipt_del "iptables -w" "OUTPUT"
+		ipt_del "iptables -w -t nat" "POSTROUTING"
 		ipt_del "iptables -w -t mangle" "OUTPUT"
-		ipt_del "ip6tables -w" "input_rule"
-		ipt_del "ip6tables -w" "forwarding_rule"
+		ipt_del "ip6tables -w" "INPUT"
+		ipt_del "ip6tables -w" "FORWARD"
 		ipt_del "ip6tables -w -t mangle" "OUTPUT"
 		uci -q batch <<-EOF >/dev/null
 			delete network.ipsec_server
@@ -123,6 +123,7 @@ gen_include() {
 		$(extract_rules6 filter)
 		$(extract_rules6 mangle)
 		EOT
+		exit 0
 	EOF
 	return 0
 }

liep/luci-app-ipsec-server/root/etc/uci-defaults/luci-app-ipsec-server

@@ -5,9 +5,16 @@ uci -q batch <<-EOF >/dev/null
 	set firewall.luci_app_ipsec_server=include
 	set firewall.luci_app_ipsec_server.type=script
 	set firewall.luci_app_ipsec_server.path=/var/etc/ipsecvpn.include
-	set firewall.luci_app_ipsec_server.reload=1
 EOF
 
+if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+	uci -q set firewall.luci_app_ipsec_server.reload='1'
+else
+	uci -q delete firewall.luci_app_ipsec_server.reload
+	uci -q delete firewall.luci_app_ipsec_server.fw4_compatible
+fi
+uci commit firewall
+
 /etc/init.d/ipsec disable 2>/dev/null
 /etc/init.d/ipsec stop 2>/dev/null
 /etc/init.d/xl2tpd disable 2>/dev/null

liep/luci-app-openvpn-client/root/etc/init.d/luci-app-openvpn-client

@@ -129,11 +129,11 @@ start_instance() {
 	cat <<-EOF >> ${TMP_OVPN_PATH}/${cfgid}/iptables_add.sh
 		${TMP_OVPN_PATH}/${cfgid}/iptables_del.sh
 		#允许服务端配置静态路由表访问内网
-		iptables -w -t nat -I postrouting_rule -s \$(cat ${TMP_OVPN_PATH}/${cfgid}/network)/\$(cat ${TMP_OVPN_PATH}/${cfgid}/mask) -m comment --comment "${c_dev}" -j MASQUERADE
-		iptables -w -t nat -I postrouting_rule -o ${c_dev} -m comment --comment "${c_dev}" -j MASQUERADE
-		iptables -w -I input_rule -s \$(cat ${TMP_OVPN_PATH}/${cfgid}/network)/\$(cat ${TMP_OVPN_PATH}/${cfgid}/mask) -m comment --comment "${c_dev}" -j ${c_allow_access_action}
-		iptables -w -I forwarding_rule -i ${c_dev} -m comment --comment "${c_dev}" -j ACCEPT
-		iptables -w -I forwarding_rule -o ${c_dev} -m comment --comment "${c_dev}" -j ACCEPT
+		iptables -w -t nat -I POSTROUTING -s \$(cat ${TMP_OVPN_PATH}/${cfgid}/network)/\$(cat ${TMP_OVPN_PATH}/${cfgid}/mask) -m comment --comment "${c_dev}" -j MASQUERADE
+		iptables -w -t nat -I POSTROUTING -o ${c_dev} -m comment --comment "${c_dev}" -j MASQUERADE
+		iptables -w -I INPUT -s \$(cat ${TMP_OVPN_PATH}/${cfgid}/network)/\$(cat ${TMP_OVPN_PATH}/${cfgid}/mask) -m comment --comment "${c_dev}" -j ${c_allow_access_action}
+		iptables -w -I FORWARD -i ${c_dev} -m comment --comment "${c_dev}" -j ACCEPT
+		iptables -w -I FORWARD -o ${c_dev} -m comment --comment "${c_dev}" -j ACCEPT
 	EOF
 	
 	cat <<-EOF >> ${TMP_OVPN_PATH}/${cfgid}/iptables_del.sh
@@ -143,9 +143,9 @@ start_instance() {
 				\$1 -w -D \$2 \$index 2>/dev/null
 			done
 		}
-		ipt_del "iptables -w" "input_rule"
-		ipt_del "iptables -w" "forwarding_rule"
-		ipt_del "iptables -w -t nat" "postrouting_rule"
+		ipt_del "iptables -w" "INPUT"
+		ipt_del "iptables -w" "FORWARD"
+		ipt_del "iptables -w -t nat" "POSTROUTING"
 	EOF
 	
 	cat <<-EOF >> ${TMP_OVPN_PATH}/${cfgid}/ipchange.sh
@@ -162,6 +162,7 @@ start_instance() {
 	
 	cat <<-EOF >> /var/etc/${CONFIG}.include
 		${TMP_OVPN_PATH}/${cfgid}/iptables_add.sh
+		exit 0
 	EOF
 	
 	local c_routes=$(uci -q get ${CONFIG}.${cfgid}.routes)

liep/luci-app-openvpn-client/root/etc/uci-defaults/luci-app-openvpn-client

@@ -5,8 +5,15 @@ uci -q batch <<-EOF >/dev/null
 	set firewall.openvpn_client=include
 	set firewall.openvpn_client.type=script
 	set firewall.openvpn_client.path=/var/etc/luci-app-openvpn-client.include
-	set firewall.openvpn_client.reload=1
 EOF
 
+if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+	uci -q set firewall.openvpn_client.reload='1'
+else
+	uci -q delete firewall.openvpn_client.reload
+	uci -q delete firewall.openvpn_client.fw4_compatible
+fi
+uci commit firewall
+
 rm -rf /tmp/luci-*cache
 exit 0

liep/luci-app-openvpn-server/root/etc/init.d/luci-app-openvpn-server

@@ -23,13 +23,13 @@ ipt_flag="OpenVPN Server"
 
 ipt_rule() {
 	if [ "$1" = "add" ]; then
-		iptables -w -t nat -I postrouting_rule -s ${ip_segment%.*}.0/${ip_prefix} -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
-		iptables -w -I forwarding_rule -s ${ip_segment%.*}.0/${ip_prefix} -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
-		iptables -w -I input_rule -p ${proto} --dport ${port} -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
+		iptables -w -t nat -I POSTROUTING -s ${ip_segment%.*}.0/${ip_prefix} -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
+		iptables -w -I FORWARD -s ${ip_segment%.*}.0/${ip_prefix} -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
+		iptables -w -I INPUT -p ${proto} --dport ${port} -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
 		iptables -w -t mangle -I OUTPUT -p ${proto} --sport ${port} -m comment --comment "${ipt_flag}" -j RETURN 2>/dev/null
 		
 		[ "${ipv6}" -eq 1 ] && {
-			ip6tables -w -I input_rule -p ${proto} --dport ${port} -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
+			ip6tables -w -I INPUT -p ${proto} --dport ${port} -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
 			ip6tables -w -t mangle -I OUTPUT -p ${proto} --sport ${port} -m comment --comment "${ipt_flag}" -j RETURN 2>/dev/null
 		}
 	else
@@ -39,11 +39,11 @@ ipt_rule() {
 				$1 -w -D $2 $index 2>/dev/null
 			done
 		}
-		ipt_del "iptables" "forwarding_rule"
-		ipt_del "iptables" "input_rule"
-		ipt_del "iptables -t nat" "postrouting_rule"
+		ipt_del "iptables" "FORWARD"
+		ipt_del "iptables" "INPUT"
+		ipt_del "iptables -t nat" "POSTROUTING"
 		ipt_del "iptables -t mangle" "OUTPUT"
-		ipt_del "ip6tables" "input_rule"
+		ipt_del "ip6tables" "INPUT"
 		ipt_del "ip6tables -t mangle" "OUTPUT"
 	fi
 }
@@ -72,6 +72,7 @@ gen_include() {
 			$(extract_rules 6 mangle)
 			EOT
 		}
+		exit 0
 	EOF
 	return 0
 }

liep/luci-app-openvpn-server/root/etc/uci-defaults/luci-app-openvpn-server

@@ -8,12 +8,6 @@ done
 uci -q commit firewall
 
 uci -q batch <<-EOF >/dev/null
-	delete firewall.openvpn_server
-	set firewall.openvpn_server=include
-	set firewall.openvpn_server.type=script
-	set firewall.openvpn_server.path=/var/etc/luci-app-openvpn-server.include
-	set firewall.openvpn_server.reload=1
-	
 	delete firewall.ovpn_server
 	set firewall.ovpn_server=zone
 	set firewall.ovpn_server.name='ovpn_server'
@@ -26,8 +20,20 @@ uci -q batch <<-EOF >/dev/null
 	set firewall.lantoovpnserver=forwarding
 	set firewall.lantoovpnserver.src='lan'
 	set firewall.lantoovpnserver.dest='ovpn_server'
-	commit firewall
+
+	delete firewall.openvpn_server
+	set firewall.openvpn_server=include
+	set firewall.openvpn_server.type=script
+	set firewall.openvpn_server.path=/var/etc/luci-app-openvpn-server.include
 EOF
 
+if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+	uci -q set firewall.openvpn_server.reload='1'
+else
+	uci -q delete firewall.openvpn_server.reload
+	uci -q delete firewall.openvpn_server.fw4_compatible
+fi
+uci commit firewall
+
 rm -rf /tmp/luci-*cache
 exit 0

liep/luci-app-pppoe-server/root/etc/init.d/luci-app-pppoe-server

@@ -21,8 +21,9 @@ localip=$(config_t_get service localip 10.0.1.1)
 
 ipt_rule() {
 	if [ "$1" = "add" ]; then
-		iptables -t nat -I postrouting_rule -s ${localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
-		iptables -I forwarding_rule -s ${localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
+		iptables -w -t nat -I POSTROUTING -s ${localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
+		iptables -w -t nat -I POSTROUTING -d ${localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
+		iptables -w -I FORWARD -s ${localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
 	else
 		ipt_del() {
 			for i in $(seq 1 $($1 -nL $2 | grep -c "${ipt_flag}")); do
@@ -30,8 +31,8 @@ ipt_rule() {
 				$1 -w -D $2 $index 2>/dev/null
 			done
 		}
-		ipt_del "iptables" "forwarding_rule"
-		ipt_del "iptables -t nat" "postrouting_rule"
+		ipt_del "iptables" "FORWARD"
+		ipt_del "iptables -t nat" "POSTROUTING"
 	fi
 }
 
@@ -49,6 +50,7 @@ gen_include() {
 		$(extract_rules filter)
 		$(extract_rules nat)
 		EOT
+		exit 0
 	EOF
 	return 0
 }

liep/luci-app-pppoe-server/root/etc/uci-defaults/luci-app-pppoe-server

@@ -5,8 +5,15 @@ uci -q batch <<-EOF >/dev/null
 	set firewall.luci_app_pppoe_server=include
 	set firewall.luci_app_pppoe_server.type=script
 	set firewall.luci_app_pppoe_server.path=/var/etc/luci-app-pppoe-server.include
-	set firewall.luci_app_pppoe_server.reload=1
 EOF
 
+if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+	uci -q set firewall.luci_app_pppoe_server.reload='1'
+else
+	uci -q delete firewall.luci_app_pppoe_server.reload
+	uci -q delete firewall.luci_app_pppoe_server.fw4_compatible
+fi
+uci commit firewall
+
 rm -rf /tmp/luci-*cache
 exit 0

liep/luci-app-pptp-server/root/etc/init.d/luci-app-pptp-server

@@ -18,10 +18,11 @@ get_enabled_anonymous_secs() {
 
 ipt_rule() {
 	if [ "$1" = "add" ]; then
-		iptables -t nat -I postrouting_rule -s ${localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
-		iptables -I forwarding_rule -s ${localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
-		iptables -I input_rule -p tcp --dport 1723 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
-		iptables -t mangle -I OUTPUT -p tcp --sport 1723 -m comment --comment "${ipt_flag}" -j RETURN 2>/dev/null
+		iptables -w -t nat -I POSTROUTING -s ${localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
+		iptables -w -t nat -I POSTROUTING -d ${localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
+		iptables -w -I FORWARD -s ${localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
+		iptables -w -I INPUT -p tcp --dport 1723 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
+		iptables -w -t mangle -I OUTPUT -p tcp --sport 1723 -m comment --comment "${ipt_flag}" -j RETURN 2>/dev/null
 	else
 		ipt_del() {
 			for i in $(seq 1 $($1 -nL $2 | grep -c "${ipt_flag}")); do
@@ -29,9 +30,9 @@ ipt_rule() {
 				$1 -w -D $2 $index 2>/dev/null
 			done
 		}
-		ipt_del "iptables" "forwarding_rule"
-		ipt_del "iptables" "input_rule"
-		ipt_del "iptables -t nat" "postrouting_rule"
+		ipt_del "iptables" "FORWARD"
+		ipt_del "iptables" "INPUT"
+		ipt_del "iptables -t nat" "POSTROUTING"
 		ipt_del "iptables -t mangle" "OUTPUT"
 	fi
 }
@@ -50,6 +51,7 @@ gen_include() {
 		$(extract_rules filter)
 		$(extract_rules nat)
 		EOT
+		exit 0
 	EOF
 	return 0
 }

liep/luci-app-pptp-server/root/etc/uci-defaults/luci-app-pptp-server

@@ -5,9 +5,16 @@ uci -q batch <<-EOF >/dev/null
 	set firewall.luci_app_pptp_server=include
 	set firewall.luci_app_pptp_server.type=script
 	set firewall.luci_app_pptp_server.path=/var/etc/pptpd.include
-	set firewall.luci_app_pptp_server.reload=1
 EOF
 
+if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+	uci -q set firewall.luci_app_pptp_server.reload='1'
+else
+	uci -q delete firewall.luci_app_pptp_server.reload
+	uci -q delete firewall.luci_app_pptp_server.fw4_compatible
+fi
+uci commit firewall
+
 /etc/init.d/pptpd disable 2>/dev/null
 /etc/init.d/pptpd stop 2>/dev/null
 rm -rf /tmp/luci-*cache

liep/luci-app-softethervpn/root/etc/init.d/luci-app-softethervpn

@@ -55,6 +55,7 @@ gen_include() {
 		iptables-restore -n <<-EOT
 		$(extract_rules filter)
 		EOT
+		exit 0
 	EOF
 	return 0
 }

liep/luci-app-softethervpn/root/etc/uci-defaults/luci-app-softethervpn

@@ -5,9 +5,16 @@ uci -q batch <<-EOF >/dev/null
 	set firewall.luci_app_softethervpn=include
 	set firewall.luci_app_softethervpn.type=script
 	set firewall.luci_app_softethervpn.path=/var/etc/luci-app-softethervpn.include
-	set firewall.luci_app_softethervpn.reload=1
 EOF
 
+if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+	uci -q set firewall.luci_app_softethervpn.reload='1'
+else
+	uci -q delete firewall.luci_app_softethervpn.reload
+	uci -q delete firewall.luci_app_softethervpn.fw4_compatible
+fi
+uci commit firewall
+
 /etc/init.d/softethervpnserver stop 2>/dev/null
 /etc/init.d/softethervpnserver disable 2>/dev/null
 

liep/luci-app-ssr-mudb-server/root/etc/init.d/ssr_mudb_server

@@ -49,6 +49,7 @@ gen_include() {
 		iptables-restore -n <<-EOT
 		$(extract_rules filter)
 		EOT
+		exit 0
 	EOF
 	return 0
 }

liep/luci-app-ssr-mudb-server/root/etc/uci-defaults/luci-app-ssr-mudb-server

@@ -5,9 +5,16 @@ uci -q batch <<-EOF >/dev/null
 	set firewall.ssr_mudb_server=include
 	set firewall.ssr_mudb_server.type=script
 	set firewall.ssr_mudb_server.path=/var/etc/ssr_mudb_server.include
-	set firewall.ssr_mudb_server.reload=1
 EOF
 
+if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+	uci -q set firewall.ssr_mudb_server.reload='1'
+else
+	uci -q delete firewall.ssr_mudb_server.reload
+	uci -q delete firewall.ssr_mudb_server.fw4_compatible
+fi
+uci commit firewall
+
 chmod a+x /usr/share/ssr_mudb_server/* >/dev/null 2>&1
 cp -rf /usr/bin/python3 /usr/bin/python
 rm -rf /tmp/luci-*cache

liep/luci-app-timecontrol/root/etc/init.d/luci-app-timecontrol

@@ -81,6 +81,7 @@ start(){
 	iptables_w -t nat -I TIMECONTROL -i $interface -j TIMECONTROL_RULES
 	iptables_w -t nat -I PREROUTING -j TIMECONTROL
 	echo "/etc/init.d/${CONFIG} restart" > "/var/etc/${CONFIG}.include"
+	echo "exit 0" >> "/var/etc/${CONFIG}.include"
 }
 
 stop(){

liep/luci-app-timecontrol/root/etc/uci-defaults/luci-app-timecontrol

@@ -5,8 +5,15 @@ uci -q batch <<-EOF >/dev/null
 	set firewall.luci_app_timecontrol=include
 	set firewall.luci_app_timecontrol.type=script
 	set firewall.luci_app_timecontrol.path=/var/etc/luci-app-timecontrol.include
-	set firewall.luci_app_timecontrol.reload=1
 EOF
 
+if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+	uci -q set firewall.luci_app_timecontrol.reload='1'
+else
+	uci -q delete firewall.luci_app_timecontrol.reload
+	uci -q delete firewall.luci_app_timecontrol.fw4_compatible
+fi
+uci commit firewall
+
 rm -rf /tmp/luci-*cache
 exit 0

liep/other/lean/luci-app-adbyby-plus/root/etc/init.d/adbyby

@@ -192,6 +192,7 @@ add_rule()
 	
 	mkdir -p /var/etc
 	echo -e "/etc/init.d/adbyby restart" > "/var/etc/adbyby.include"
+	echo -e "exit 0" >> "/var/etc/adbyby.include"
 }
 
 del_rule()

liep/other/lean/luci-app-adbyby-plus/root/etc/uci-defaults/luci-adbyby

@@ -1,26 +1,29 @@
 #!/bin/sh
 
 uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@adbyby[-1]
-	add ucitrack adbyby
-	set ucitrack.@adbyby[-1].init=adbyby
-	commit ucitrack
+	delete firewall.adblock
+	add firewall rule
+	rename firewall.@rule[-1]="adblock"
+	set firewall.@rule[-1].name="adblock"
+	set firewall.@rule[-1].target="DROP"
+	set firewall.@rule[-1].src="wan"
+	set firewall.@rule[-1].proto="tcp"
+	set firewall.@rule[-1].dest_port="8118"
+
 	delete firewall.adbyby
 	set firewall.adbyby=include
 	set firewall.adbyby.type=script
 	set firewall.adbyby.path=/var/etc/adbyby.include
-	set firewall.adbyby.reload=1
-	delete firewall.adblock
-  add firewall rule
-  rename firewall.@rule[-1]="adblock"
-  set firewall.@rule[-1].name="adblock"
-  set firewall.@rule[-1].target="DROP"
-  set firewall.@rule[-1].src="wan"
-  set firewall.@rule[-1].proto="tcp"
-  set firewall.@rule[-1].dest_port="8118"
-	commit firewall
 EOF
 
+if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+	uci -q set firewall.adbyby.reload='1'
+else
+	uci -q delete firewall.adbyby.reload
+	uci -q delete firewall.adbyby.fw4_compatible
+fi
+uci commit firewall
+
 mkdir -p /etc/dnsmasq.d
 
 /etc/init.d/adbyby stop

liep/other/lean/luci-app-arpbind/root/etc/uci-defaults/luci-arpbind

@@ -1,12 +1,5 @@
 #!/bin/sh
 touch /etc/config/arpbind
 
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@arpbind[-1]
-	add ucitrack arpbind
-	set ucitrack.@arpbind[-1].init=arpbind
-	commit ucitrack
-EOF
-
 rm -f /tmp/luci-indexcache
 exit 0

liep/other/lean/luci-app-autoreboot/root/etc/uci-defaults/luci-app-autoreboot

@@ -1,11 +0,0 @@
-#!/bin/sh
-
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@autoreboot[-1]
-	add ucitrack autoreboot
-	set ucitrack.@autoreboot[-1].init=autoreboot
-	commit ucitrack
-EOF
-
-rm -rf /tmp/luci-*
-exit 0

liep/other/lean/luci-app-baidupcs-web/root/etc/uci-defaults/luci-baidupcs-web

@@ -1,11 +0,0 @@
-#!/bin/sh
-
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@baidupcs-web[-1]
-	add ucitrack baidupcs-web
-	set ucitrack.@baidupcs-web[-1].init=baidupcs-web
-	commit ucitrack
-EOF
-
-rm -f /tmp/luci-indexcache
-exit 0

liep/other/lean/luci-app-cifs-mount/root/etc/uci-defaults/luci-cifs

@@ -1,11 +0,0 @@
-#!/bin/sh
-
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@cifs[-1]
-	add ucitrack cifs
-	set ucitrack.@cifs[-1].init=cifs
-	commit ucitrack
-EOF
-
-rm -f /tmp/luci-indexcache
-exit 0

liep/other/lean/luci-app-frpc/root/etc/uci-defaults/luci-frp

@@ -1,11 +0,0 @@
-#!/bin/sh
-
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@frp[-1]
-	add ucitrack frp
-	set ucitrack.@frp[-1].init=frp
-	commit ucitrack
-EOF
-
-rm -f /tmp/luci-indexcache
-exit 0

liep/other/lean/luci-app-frps/root/etc/uci-defaults/40_luci-frps

@@ -1,11 +0,0 @@
-#!/bin/sh
-
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@frps[-1]
-	add ucitrack frps
-	set ucitrack.@frps[-1].init=frps
-	commit ucitrack
-EOF
-
-rm -rf /tmp/luci-indexcache /tmp/luci-modulecache
-exit 0

liep/other/lean/luci-app-mwan3helper/root/etc/uci-defaults/luci-mwan3helper

@@ -1,11 +0,0 @@
-#!/bin/sh
-
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@mwan3helper[-1]
-	add ucitrack mwan3helper
-	set ucitrack.@mwan3helper[-1].init=mwan3helper
-	commit ucitrack
-EOF
-
-rm -f /tmp/luci*
-exit 0

liep/other/lean/luci-app-nfs/root/etc/uci-defaults/luci-nfs

@@ -1,12 +1,5 @@
 #!/bin/sh
 
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@nfs[-1]
-	add ucitrack nfs
-	set ucitrack.@nfs[-1].init=nfs
-	commit ucitrack
-EOF
-
 /etc/init.d/nfs enable && /etc/init.d/nfs restart
 
 rm -f /tmp/luci-indexcache

liep/other/lean/luci-app-nps/root/etc/uci-defaults/luci-nps

@@ -1,11 +0,0 @@
-#!/bin/sh
-
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@nps[-1]
-	add ucitrack nps
-	set ucitrack.@nps[-1].init=nps
-	commit ucitrack
-EOF
-
-rm -f /tmp/luci-indexcache
-exit 0

liep/other/lean/luci-app-qbittorrent/root/etc/uci-defaults/50_luci-qbittorrent

@@ -1,12 +1,5 @@
 #!/bin/sh
 
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@qbittorrent[-1]
-	add ucitrack qbittorrent
-	set ucitrack.@qbittorrent[-1].init=qbittorrent
-	commit ucitrack
-EOF
-
 mkdir /opt
 
 rm -f /tmp/luci-indexcache*

liep/other/lean/luci-app-syncdial/root/etc/uci-defaults/luci-syncdial

@@ -1,12 +1,5 @@
 #!/bin/sh
 touch /etc/config/syncdial
 
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@syncdial[-1]
-	add ucitrack syncdial
-	set ucitrack.@syncdial[-1].exec='/bin/genwancfg'
-	commit ucitrack
-EOF
-
 rm -f /tmp/luci-indexcache
 exit 0

liep/other/lean/luci-app-turboacc/root/etc/uci-defaults/luci-turboacc

@@ -1,12 +1,5 @@
 #!/bin/sh
 
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@turboacc[-1]
-	add ucitrack turboacc
-	set ucitrack.@turboacc[-1].init=turboacc
-	commit ucitrack
-EOF
-
 [ -n "$(lsmod | grep mtkhnat)" ] && \
 	uci set turboacc.config.sw_flow='0' && \
 	uci set turboacc.config.hw_flow='0'

liep/other/lean/luci-app-usb-printer/root/etc/uci-defaults/luci-usb-printer

@@ -1,12 +1,5 @@
 #!/bin/sh
 
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@usb_printer[-1]
-	add ucitrack usb_printer
-	set ucitrack.@usb_printer[-1].init=usb_printer
-	commit ucitrack
-EOF
-
 [ -f /etc/init.d/p910nd ] && /etc/init.d/p910nd disable
 
 exit 0

liep/other/lean/luci-app-uugamebooster/root/etc/uci-defaults/45_luci-uugamebooster

@@ -1,11 +0,0 @@
-#!/bin/sh
-
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@uugamebooster[-1]
-	add ucitrack uugamebooster
-	set ucitrack.@uugamebooster[-1].init=uugamebooster
-	commit ucitrack
-EOF
-
-rm -f /tmp/luci-indexcache
-exit 0

liep/other/lean/luci-app-vlmcsd/root/etc/uci-defaults/luci-vlmcsd

@@ -1,11 +1,6 @@
 #!/bin/sh
 
 uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@vlmcsd[-1]
-	add ucitrack vlmcsd
-	set ucitrack.@vlmcsd[-1].init=kms
-	commit ucitrack
-
 	delete firewall.kms
 	add firewall rule 
 	rename firewall.@rule[-1]="kms"

liep/other/lean/luci-app-vsftpd/root/etc/uci-defaults/luci-vsftpd

@@ -1,11 +0,0 @@
-#!/bin/sh
-
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@vsftpd[-1]
-	add ucitrack vsftpd
-	set ucitrack.@vsftpd[-1].init=vsftpd
-	commit ucitrack
-EOF
-
-rm -f /tmp/luci-vsftpd
-exit 0

liep/other/lean/luci-app-wrtbwmon/root/etc/uci-defaults/luci-wrtbwmon

@@ -5,10 +5,16 @@ uci -q batch <<-EOF >/dev/null
 	set firewall.wrtbwmon=include
 	set firewall.wrtbwmon.type=script
 	set firewall.wrtbwmon.path='/etc/wrtbwmon.include'
-	set firewall.wrtbwmon.reload=1
-	commit firewall
 EOF
 
+if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+	uci -q set firewall.wrtbwmon.reload='1'
+else
+	uci -q delete firewall.wrtbwmon.reload
+	uci -q delete firewall.wrtbwmon.fw4_compatible
+fi
+uci commit firewall
+
 /etc/init.d/wrtbwmon enable
 /etc/init.d/wrtbwmon start
 exit 0

liep/other/lean/luci-app-xlnetacc/root/etc/uci-defaults/luci-xlnetacc

@@ -1,6 +0,0 @@
-uci batch <<EOF
-	delete ucitrack.@xlnetacc[-1]
-	add ucitrack xlnetacc
-	set ucitrack.@xlnetacc[-1].init=xlnetacc
-	commit ucitrack
-EOF

liep/other/lean/luci-app-zerotier/root/etc/uci-defaults/40_luci-zerotier

@@ -1,18 +1,19 @@
 #!/bin/sh
 
 uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@zerotier[-1]
-	add ucitrack zerotier
-	set ucitrack.@zerotier[-1].init=zerotier
-	commit ucitrack
-
 	delete firewall.zerotier
 	set firewall.zerotier=include
 	set firewall.zerotier.type=script
 	set firewall.zerotier.path=/etc/zerotier.start
-	set firewall.zerotier.reload=1
-	commit firewall
 EOF
 
+if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+	uci -q set firewall.zerotier.reload='1'
+else
+	uci -q delete firewall.zerotier.reload
+	uci -q delete firewall.zerotier.fw4_compatible
+fi
+uci commit firewall
+
 rm -f /tmp/luci-indexcache
 exit 0

liep/other/lean/vlmcsd/files/vlmcsd.init

@@ -6,10 +6,10 @@ START=90
 start(){
 	if [ ! -f "/tmp/vlmcsd.pid" ]; then
 		/usr/bin/vlmcsd -i /etc/vlmcsd/vlmcsd.ini -p /tmp/vlmcsd.pid -L 0.0.0.0:1688
-		iptables -D input_rule -p tcp --dport 1688 -j ACCEPT
-		iptables -A input_rule -p tcp --dport 1688 -j ACCEPT 
+		iptables -w -D INPUT -p tcp --dport 1688 -j ACCEPT
+		iptables -w -A INPUT -p tcp --dport 1688 -j ACCEPT 
 		sed -i '/## luci-app-vlmcsd/d' /etc/firewall.user
-		echo "iptables -A input_rule -p tcp --dport 1688 -j ACCEPT ## luci-app-vlmcsd" >> /etc/firewall.user
+		echo "iptables -w -A INPUT -p tcp --dport 1688 -j ACCEPT ## luci-app-vlmcsd" >> /etc/firewall.user
 		echo "KMS Server has started."
 	else
 		echo "KMS Server has already started."
@@ -23,7 +23,7 @@ stop(){
 		pid=`cat /tmp/vlmcsd.pid`
 		kill $pid
 		rm -f /tmp/vlmcsd.pid
-		iptables -D input_rule -p tcp --dport 1688 -j ACCEPT
+		iptables -w -D INPUT -p tcp --dport 1688 -j ACCEPT
 		sed -i '/## luci-app-vlmcsd/d' /etc/firewall.user
 		echo "KMS Server has stopped."
 	fi

liep/other/luci-app-adguardhome/Makefile

@@ -61,10 +61,6 @@ define Package/luci-app-adguardhome/prerm
 if [ -z "$${IPKG_INSTROOT}" ]; then
      /etc/init.d/AdGuardHome disable
      /etc/init.d/AdGuardHome stop
-uci -q batch <<-EOF >/dev/null 2>&1
-	delete ucitrack.@AdGuardHome[-1]
-	commit ucitrack
-EOF
 fi
 exit 0
 endef

liep/other/luci-app-adguardhome/root/etc/init.d/AdGuardHome

@@ -63,13 +63,18 @@ set_iptable()
 	local ipv6_server=$1
 	local tcp_server=$2
 	uci -q batch <<-EOF >/dev/null 2>&1
-  delete firewall.AdGuardHome
+	delete firewall.AdGuardHome
 	set firewall.AdGuardHome=include
 	set firewall.AdGuardHome.type=script
 	set firewall.AdGuardHome.path=/usr/share/AdGuardHome/firewall.start
-	set firewall.AdGuardHome.reload=1
-	commit firewall
 EOF
+	if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
+		uci -q set firewall.AdGuardHome.reload='1'
+	else
+		uci -q delete firewall.AdGuardHome.reload
+		uci -q delete firewall.AdGuardHome.fw4_compatible
+	fi
+	uci commit firewall
 	
 	[ "$tcp_server" == "1" ] && iptables -t nat -I PREROUTING 1 -m comment --comment "AdGuardHome" -p tcp --dport 53 -j REDIRECT --to-ports $AdGuardHome_PORT
 	iptables -t nat -I PREROUTING 1 -m comment --comment "AdGuardHome" -p udp --dport 53 -j REDIRECT --to-ports $AdGuardHome_PORT
@@ -83,7 +88,7 @@ EOF
 clear_iptable()
 {
 	uci -q batch <<-EOF >/dev/null 2>&1
-  delete firewall.AdGuardHome
+	delete firewall.AdGuardHome
 	commit firewall
 EOF
 

liep/other/luci-app-adguardhome/root/etc/uci-defaults/40_luci-AdGuardHome

@@ -1,12 +0,0 @@
-#!/bin/sh
-
-uci -q batch <<-EOF >/dev/null 2>&1
-	delete ucitrack.@AdGuardHome[-1]
-	add ucitrack AdGuardHome
-	set ucitrack.@AdGuardHome[-1].init=AdGuardHome
-	commit ucitrack
-	delete AdGuardHome.AdGuardHome.ucitracktest
-EOF
-
-rm -f /tmp/luci-indexcache
-exit 0

liep/other/luci-app-adguardhome/root/usr/share/ucitrack/luci-app-adguardhome.json

@@ -1,4 +1,4 @@
 {
-	"config": "adguardhome",
-	"init": "adguardhome"
+	"config": "AdGuardHome",
+	"init": "AdGuardHome"
 }