diff --git a/package/network/config/firewall/Makefile b/package/network/config/firewall/Makefile
index d7bb91b6ad..57f0abd797 100644
--- a/package/network/config/firewall/Makefile
+++ b/package/network/config/firewall/Makefile
@@ -28,7 +28,9 @@ define Package/firewall
   SECTION:=net
   CATEGORY:=Base system
   TITLE:=OpenWrt C Firewall
-  DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libxtables +kmod-ipt-core +kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +kmod-ipt-nat +iptables-mod-fullconenat
+  DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libxtables \
+	+kmod-ipt-core +kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +kmod-ipt-nat \
+	+iptables-mod-fullconenat
 endef
 
 define Package/firewall/description
diff --git a/package/network/config/firewall/files/firewall.config b/package/network/config/firewall/files/firewall.config
index 8d9462f25b..994d71a21e 100644
--- a/package/network/config/firewall/files/firewall.config
+++ b/package/network/config/firewall/files/firewall.config
@@ -3,7 +3,7 @@ config defaults
 	option input		ACCEPT
 	option output		ACCEPT
 	option forward		REJECT
-	option fullcone	1
+	option fullcone		1
 # Uncomment this line to disable ipv6 rules
 #	option disable_ipv6	1
 
@@ -130,10 +130,10 @@ config rule
 	option proto		udp
 	option target		ACCEPT
 
-# allow interoperability with traceroute classic
-# note that traceroute uses a fixed port range, and depends on getting
-# back ICMP Unreachables.  if we're operating in DROP mode, it won't
-# work so we explicitly REJECT packets on these ports.
+# Allow interoperability with traceroute classic note that
+# traceroute uses a fixed port range, and depends on getting
+# back ICMP Unreachables. If we're operating in DROP mode, it
+# won't work so we explicitly REJECT packets on these ports.
 config rule
 	option name		Support-UDP-Traceroute
 	option src		wan
diff --git a/package/network/config/firewall/patches/fullconenat.patch b/package/network/config/firewall/patches/0100-fullconenat.patch
similarity index 76%
rename from package/network/config/firewall/patches/fullconenat.patch
rename to package/network/config/firewall/patches/0100-fullconenat.patch
index d69e7129ec..28f5925647 100644
--- a/package/network/config/firewall/patches/fullconenat.patch
+++ b/package/network/config/firewall/patches/0100-fullconenat.patch
@@ -1,34 +1,28 @@
-index 85a3750..9fac9b1 100644
 --- a/defaults.c
 +++ b/defaults.c
-@@ -46,7 +46,9 @@ const struct fw3_option fw3_flag_opts[] = {
+@@ -48,7 +48,9 @@ const struct fw3_option fw3_flag_opts[] = {
  	FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
  	FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
  	FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
--
-+	
-+	FW3_OPT("fullcone",           bool,     defaults, fullcone),
-+	
++
++	FW3_OPT("fullcone",            bool,     defaults, fullcone),
+ 
  	FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
  	FW3_OPT("tcp_ecn",             int,      defaults, tcp_ecn),
  	FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
-diff --git a/options.h b/options.h
-index 6edd174..c02eb97 100644
 --- a/options.h
 +++ b/options.h
-@@ -267,6 +267,7 @@ struct fw3_defaults
- 	bool drop_invalid;
+@@ -296,6 +296,7 @@ struct fw3_defaults
+ 	enum fw3_reject_code tcp_reject_code;
+ 	enum fw3_reject_code any_reject_code;
  
- 	bool syn_flood;
 +	bool fullcone;
+ 	bool syn_flood;
  	struct fw3_limit syn_flood_rate;
  
- 	bool tcp_syncookies;
-diff --git a/zones.c b/zones.c
-index 2aa7473..57eead0 100644
 --- a/zones.c
 +++ b/zones.c
-@@ -627,6 +627,7 @@ print_zone_rule(struct fw3_ipt_handle *h
+@@ -670,6 +670,7 @@ print_zone_rule(struct fw3_ipt_handle *h
  	struct fw3_address *msrc;
  	struct fw3_address *mdest;
  	struct fw3_ipt_rule *r;
@@ -36,7 +30,7 @@ index 2aa7473..57eead0 100644
  
  	if (!fw3_is_family(zone, handle->family))
  		return;
-@@ -712,8 +713,22 @@ print_zone_rule(struct fw3_ipt_handle *h
+@@ -755,8 +756,22 @@ print_zone_rule(struct fw3_ipt_handle *h
  				{
  					r = fw3_ipt_rule_new(handle);
  					fw3_ipt_rule_src_dest(r, msrc, mdest);