So, another new version that should now be relatively feature-complete. It should be possible to just install these two packages: http://archive.tohojo.dk/cerowrt/wndr/3.10.32-9-tohojo/packages/bcp38_4-1_ar71xx.ipk http://archive.tohojo.dk/cerowrt/wndr/3.10.32-9-tohojo/packages/luci-app-bcp38_2-1_all.ipk and have everything enabled and working. This version does away with the firewall rules in the config (so no need to add them; if they exist it shouldn't hurt, I think, but might as well just remove them) in favour of inserting a whole separate iptables chain to do the matching on. There's now also an auto-detection feature for the upstream network, which should automatically whitelist it when the rules are set up. It does this by looking at the routing table for the upstream interface, and testing all 'scope link' routes against the configured ipset, adding exceptions if they match. There's a config toggle to turn off this behaviour, and manual exceptions can be added instead of (or in addition to) the auto-detection. Since this detection is done at every run time, it should also include hotplugging; the firewall is reloaded every time an interface is hotplugged, which also reloads the bcp38 configuration and re-does the auto-detection. Testing is very much appreciated; until some of you tell me different, I believe this version is suitable for inclusion in cerowrt. At least all the issues on my own previous lists have been fixed AFAIK. :) -Toke