diff --git a/include/netfilter.mk b/include/netfilter.mk
index 6df3148d52..9e8c1d0e2f 100644
--- a/include/netfilter.mk
+++ b/include/netfilter.mk
@@ -159,9 +159,6 @@ $(eval $(call nf_add,IPT_IPSEC,CONFIG_NETFILTER_XT_MATCH_POLICY, $(P_XT)xt_polic
 # flow offload support
 $(eval $(call nf_add,IPT_FLOW,CONFIG_NETFILTER_XT_TARGET_FLOWOFFLOAD, $(P_XT)xt_FLOWOFFLOAD))
 
-# cgroup
-$(eval $(call nf_add,IPT_CGROUP,CONFIG_NETFILTER_XT_MATCH_CGROUP, $(P_XT)xt_cgroup))
-
 # IPv6
 
 # kernel only
diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk
index 6bbce437d0..946b410a27 100644
--- a/package/kernel/linux/modules/netfilter.mk
+++ b/package/kernel/linux/modules/netfilter.mk
@@ -458,24 +458,6 @@ endef
 $(eval $(call KernelPackage,ipt-nat))
 
 
-define KernelPackage/ipt-cgroup
-  SUBMENU:=$(NF_MENU)
-  TITLE:=cgroup netfilter module
-  KCONFIG:=$(KCONFIG_IPT_CGROUP)
-  FILES:=$(LINUX_DIR)/net/netfilter/*cgroup*.$(LINUX_KMOD_SUFFIX)
-  AUTOLOAD:=$(call AutoLoad,$(notdir $(IPT_CGROUP-m)))
-  DEPENDS:= kmod-ipt-core
-endef
-
-define KernelPackage/ipt-cgroup/description
- Kernel support for cgroup netfilter module
- Include:
- - cgroup
-endef
-
-$(eval $(call KernelPackage,ipt-cgroup))
-
-
 define KernelPackage/ipt-raw
   TITLE:=Netfilter IPv4 raw table support
   KCONFIG:=CONFIG_IP_NF_RAW
diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile
index 0d86e2770b..f98f3b18aa 100644
--- a/package/network/utils/iptables/Makefile
+++ b/package/network/utils/iptables/Makefile
@@ -170,7 +170,7 @@ Includes support for:
 endef
 
 define Package/iptables-mod-cgroup
-$(call Package/iptables/Module, +kmod-ipt-cgroup)
+$(call Package/iptables/Module, +kmod-ipt-extra)
   TITLE:=cgroup extension
   endef
 
@@ -714,7 +714,7 @@ $(eval $(call BuildPlugin,iptables-mod-conntrack-label,$(IPT_CONNTRACK_LABEL-m))
 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
 $(eval $(call BuildPlugin,iptables-mod-physdev,$(IPT_PHYSDEV-m)))
 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m)))
-$(eval $(call BuildPlugin,iptables-mod-cgroup,$(IPT_CGROUP-m)))
+$(eval $(call BuildPlugin,iptables-mod-cgroup,$(IPT_EXTRA-m)))
 $(eval $(call BuildPlugin,iptables-mod-imq,$(IPT_IMQ-m)))
 $(eval $(call BuildPlugin,iptables-mod-bandwidth,$(IPT_BANDWIDTH-m)))
 $(eval $(call BuildPlugin,iptables-mod-timerange,$(IPT_TIMERANGE-m)))