# No more /etc/hotplug.d/firewall? **URL:** \ **Category:** Talk about Documentation\ **Created:** [September 6, 2025, 3:14pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296 "2025-09-06T15:14:39Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![reinerotto](https://forum.openwrt.org/letter_avatar/reinerotto/32/5_5575768a8748004e209b776fc1b2916d.png) [@reinerotto](https://forum.openwrt.org/u/reinerotto)\ **Post date:** [September 6, 2025, 3:14pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/1 "2025-09-06T15:14:39Z")
In the docs, there is still inconsistent info about it: > **[\[OpenWrt Wiki\] Hotplug](https://openwrt.org/docs/guide-user/base-system/hotplug)** Pls, update,if possible. OR, much better, re-implement it. Using hotplug-event would be an elegant solution to re-establish custom routes from rc.local, which actually are wiped out in case of firewall restart. ---
**Author:** ![anon63541380](https://forum.openwrt.org/letter_avatar/anon63541380/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon63541380](https://forum.openwrt.org/u/anon63541380)\ **Post date:** [September 6, 2025, 3:25pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/2 "2025-09-06T15:25:35Z")
> 2021/03/05 01:00 Show differences to current revisions Hotplug – [How it works] add firewall vgaetera @vgaetera there are no ubus callbacks on firewall events (?to log a packet?) ---
**Author:** ![pavelgl](https://forum.openwrt.org/user_avatar/forum.openwrt.org/pavelgl/32/33073_2.png) [@pavelgl](https://forum.openwrt.org/u/pavelgl)\ **Post date:** [September 6, 2025, 4:14pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/3 "2025-09-06T16:14:41Z")
> [@reinerotto](#): > > Pls, update,if possible. Updated. > [@reinerotto](#): > > much better, re-implement it. [https://forum.openwrt.org/t/fw4-and-hotplug/150794/#6-by-jow](https://forum.openwrt.org/t/fw4-and-hotplug/150794/6) ---
**Author:** ![anon63541380](https://forum.openwrt.org/letter_avatar/anon63541380/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon63541380](https://forum.openwrt.org/u/anon63541380)\ **Post date:** [September 6, 2025, 4:59pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/4 "2025-09-06T16:59:28Z")
Paragraph for “firewall” hotplug. ```plaintext ## firewall firewall3 implements hotplug events when ruleset is partially re-loaded, while firewall4 (OpenWrt 22.03 and later) does not. Similar functionality can be achieved via includes // https://openwrt.org/docs/guide-user/firewall/firewall_configuration#includes_2203_and_later_with_fw4 ``` Linked documentation may need some refresh too… ---
**Author:** ![reinerotto](https://forum.openwrt.org/letter_avatar/reinerotto/32/5_5575768a8748004e209b776fc1b2916d.png) [@reinerotto](https://forum.openwrt.org/u/reinerotto)\ **Post date:** [September 6, 2025, 5:41pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/5 "2025-09-06T17:41:09Z")
Hm …. I used includes for nft-rules, but how do they work to re-establish custom routes after being wiped clean because of fw4-restart ? I thought, the includes have to be nft-cmd style only. ---
**Author:** ![dave14305](https://forum.openwrt.org/user_avatar/forum.openwrt.org/dave14305/32/26290_2.png) [@dave14305](https://forum.openwrt.org/u/dave14305)\ **Post date:** [September 6, 2025, 5:55pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/6 "2025-09-06T17:55:17Z")
You can create an include in the firewall config file that is a script type versus an nft command file. > **[\[OpenWrt Wiki\] Firewall configuration /etc/config/firewall](https://openwrt.org/docs/guide-user/firewall/firewall_configuration?s%5B%5D=more&s%5B%5D=host#config_include_section_with_shell_script)** ---
**Author:** ![anon63541380](https://forum.openwrt.org/letter_avatar/anon63541380/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon63541380](https://forum.openwrt.org/u/anon63541380)\ **Post date:** [September 6, 2025, 5:59pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/7 "2025-09-06T17:59:53Z")
firewall does not manipulate routes, it reloads on netdev hotplugs (fw4 in full fw3 per zone) ---
**Author:** ![reinerotto](https://forum.openwrt.org/letter_avatar/reinerotto/32/5_5575768a8748004e209b776fc1b2916d.png) [@reinerotto](https://forum.openwrt.org/u/reinerotto)\ **Post date:** [September 6, 2025, 6:43pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/8 "2025-09-06T18:43:31Z")
Yep. You got it. That solves the problem: config include #In /etc/config/firewall option enabled 1 option type 'script' option path '/etc/setup/myprivateroute' option fw4\_compatible 1 ---
**Author:** ![anon63541380](https://forum.openwrt.org/letter_avatar/anon63541380/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon63541380](https://forum.openwrt.org/u/anon63541380)\ **Post date:** [September 6, 2025, 7:51pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/9 "2025-09-06T19:51:51Z")
```plaintext echo /etc/setup/myprivateroute >> /etc/sysupgrade.conf ``` ---
**Author:** ![reinerotto](https://forum.openwrt.org/letter_avatar/reinerotto/32/5_5575768a8748004e209b776fc1b2916d.png) [@reinerotto](https://forum.openwrt.org/u/reinerotto)\ **Post date:** [September 14, 2025, 8:48am UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/10 "2025-09-14T08:48:27Z")
Unfortunately, using include in /etc/config/firewall, setting up custom routing table, does not always work for me. I suspect, from time to time it might interfere with routing mods, done behind the curtain, when network restarted. Which happens several times during startup in my case. One more neg. effect of the non-deterministic startup procedure. However, now my walk-around is to use /etc/hotplug.d/iface/myroutingscript.sh . More stable solution. Knock on wood. ---
**Author:** ![anon63541380](https://forum.openwrt.org/letter_avatar/anon63541380/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon63541380](https://forum.openwrt.org/u/anon63541380)\ **Post date:** [September 14, 2025, 9:11am UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/11 "2025-09-14T09:11:29Z")
You can set up routes via luci bringing up some interface, or use pbr for more control. ---
**Author:** ![reinerotto](https://forum.openwrt.org/letter_avatar/reinerotto/32/5_5575768a8748004e209b776fc1b2916d.png) [@reinerotto](https://forum.openwrt.org/u/reinerotto)\ **Post date:** [September 14, 2025, 9:34am UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/12 "2025-09-14T09:34:08Z")
1. Custom image. No LuCI. 2. My very first approach was simply to include the following 3 lines at end of rc.local: sleep 60 #Something smarter, in fact sh /etc/myroutingscript.sh hev-socks5-tproxy /etc/hev-socks5-tproxy/main.yml Worked. Until next restart of network, because my routing mods dropped. myroutingscript.sh only contains 2 lines: ip rule add fwmark 1088 table 100 ip route add local default dev lo table 100 I had a very first look at PBR. But seems rather complicated for this simple requirement. BTW, it might be good idea, on network restart to leave custom mods (i.e. in routing) still intact. ---
**Author:** ![anon63541380](https://forum.openwrt.org/letter_avatar/anon63541380/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon63541380](https://forum.openwrt.org/u/anon63541380)\ **Post date:** [September 14, 2025, 10:15am UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/13 "2025-09-14T10:15:36Z")
> [@reinerotto](#): > > Custom image. No LuCI. OK, type up routing table entries using uci network. ---
**Author:** ![pavelgl](https://forum.openwrt.org/user_avatar/forum.openwrt.org/pavelgl/32/33073_2.png) [@pavelgl](https://forum.openwrt.org/u/pavelgl)\ **Post date:** [September 14, 2025, 11:32am UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/14 "2025-09-14T11:32:20Z")
> [@reinerotto](#): > > ip rule add fwmark 1088 table 100 > ip route add local default dev lo table 100 ```plaintext #/etc/config/network config rule option lookup '100' option mark '1088' config route option interface 'loopback' option type 'local' option target '0.0.0.0/0' option table '100' ``` ---
**Author:** ![reinerotto](https://forum.openwrt.org/letter_avatar/reinerotto/32/5_5575768a8748004e209b776fc1b2916d.png) [@reinerotto](https://forum.openwrt.org/u/reinerotto)\ **Post date:** [September 14, 2025, 2:40pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/15 "2025-09-14T14:40:16Z")
Thanx from Burgas for the translation 🙂 ---
**Author:** ![pavelgl](https://forum.openwrt.org/user_avatar/forum.openwrt.org/pavelgl/32/33073_2.png) [@pavelgl](https://forum.openwrt.org/u/pavelgl)\ **Post date:** [September 14, 2025, 3:23pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/16 "2025-09-14T15:23:51Z")
I hope you enjoy the Black Sea 😎 ---
**Author:** ![reinerotto](https://forum.openwrt.org/letter_avatar/reinerotto/32/5_5575768a8748004e209b776fc1b2916d.png) [@reinerotto](https://forum.openwrt.org/u/reinerotto)\ **Post date:** [September 14, 2025, 5:26pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/17 "2025-09-14T17:26:33Z")
Yep. For 5 years already living in Lazur. 10minutes walk to my favourite beach bar, Caribe. Only during wintertime relocating to Asia. You are welcome for a beer 🙂 ---
**Author:** ![system](https://forum.openwrt.org/uploads/default/original/3X/7/4/740520c71f00039bbf001045c682f0ecb25e905a.png) [@system](https://forum.openwrt.org/u/system)\ **Post date:** [September 24, 2025, 5:27pm UTC](https://forum.openwrt.org/t/no-more-etc-hotplug-d-firewall/240296/18 "2025-09-24T17:27:04Z")
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.