diff --git a/feeds.conf.default b/feeds.conf.default
index 62cad877c7..6a1e674da6 100644
--- a/feeds.conf.default
+++ b/feeds.conf.default
@@ -1,6 +1,6 @@
-src-git packages https://git.openwrt.org/feed/packages.git
+src-git packages https://git.openwrt.org/feed/packages.git^1b73f267eae2dedc18969b70ed7c5d9b02288bac
 src-git luci https://git.openwrt.org/project/luci.git^7d55be315d758b2a40494e732d7bdc300ee15c00
-src-git routing https://git.openwrt.org/feed/routing.git
+src-git routing https://git.openwrt.org/feed/routing.git^ba5d2fc76e1cee2cb656d955514c8aa526875a6a
 src-git telephony https://git.openwrt.org/feed/telephony.git
 #src-git video https://github.com/openwrt/video.git
 #src-git targets https://github.com/openwrt/targets.git
diff --git a/include/target.mk b/include/target.mk
index f6c6acac76..efdcd7fc20 100644
--- a/include/target.mk
+++ b/include/target.mk
@@ -14,7 +14,7 @@ DEVICE_TYPE?=router
 
 # Default packages - the really basic set
 DEFAULT_PACKAGES:=base-files libc libgcc busybox dropbear mtd uci opkg netifd fstools uclient-fetch logd \
-iptables-mod-nat-extra kmod-nf-nathelper kmod-nf-nathelper-extra kmod-macvlan kmod-nft-offload block-mount automount \
+iptables-mod-nat-extra kmod-nf-nathelper kmod-nf-nathelper-extra kmod-ipt-raw kmod-macvlan kmod-nft-offload block-mount automount \
 default-settings ipset-lists luci luci-app-ddns luci-app-sqm luci-app-upnp luci-app-adbyby-plus luci-app-autoreboot \
 luci-app-filetransfer luci-app-shadowsocksr-pro luci-app-usb-printer luci-app-vsftpd ddns-scripts_aliyun luci-app-xlnetacc \
 luci-app-pptp-server luci-app-ipsec-vpnd luci-app-vlmcsd luci-app-wifischedule luci-app-wol luci-app-sfe luci-app-flowoffload luci-app-nlbwmon
diff --git a/package/lean/libidn2/Makefile b/package/lean/libidn2/Makefile
new file mode 100644
index 0000000000..c023b5298d
--- /dev/null
+++ b/package/lean/libidn2/Makefile
@@ -0,0 +1,93 @@
+#
+# Copyright (C) 2017-2018 Daniel Engberg <daniel.engberg.lists@pyret.net>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=libidn2
+PKG_VERSION:=2.0.4
+PKG_RELEASE:=1
+PKG_MAINTAINER:=Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+PKG_LICENSE:=GPL-2.0-or-later LGPL-3.0-or-later
+PKG_LICENSE_FILES:=COPYING COPYINGv2 COPYING.LESSERv3
+
+PKG_SOURCE_URL:=@GNU/libidn
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_HASH:=644b6b03b285fb0ace02d241d59483d98bc462729d8bb3608d5cad5532f3d2f0
+
+PKG_INSTALL:=1
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/nls.mk
+
+define Package/idn2/Default
+  SECTION:=net
+  CATEGORY:=Network
+  URL:=http://www.gnu.org/software/libidn/
+endef
+
+define Package/idn2/Default/description
+  Libidn2 is a free software implementation of IDNA2008,
+  Punycode and TR46 in library form. It contains
+  functionality to convert internationalized domain
+  names to and from ASCII Compatible Encoding (ACE),
+  following the IDNA2008 and TR46 standards.
+endef
+
+define Package/idn2
+  $(call Package/idn2/Default)
+  SUBMENU:=IP Addresses and Names
+  TITLE:=GNU IDN2 (Internationalized Domain Name) tool
+  DEPENDS:=+libidn2
+endef
+
+define Package/idn2/description
+$(call Package/idn2/Default/description)
+
+  Command line tool using libidn2
+
+endef
+
+define Package/libidn2
+  SECTION:=libs
+  CATEGORY:=Libraries
+  DEPENDS:=+libunistring $(ICONV_DEPENDS) $(INTL_DEPENDS)
+  TITLE:=International domain name library (IDNA2008, Punycode and TR46)
+  URL:=https://www.gnu.org/software/libidn/#libidn2
+endef
+
+define Package/libidn2/description
+$(call Package/idn2/Default/description)
+
+  Library only package
+
+endef
+
+CONFIGURE_ARGS += \
+	--disable-rpath \
+	--disable-doc
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/include/idn2.h $(1)/usr/include
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/*.{la,so}* $(1)/usr/lib/
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libidn2.pc $(1)/usr/lib/pkgconfig/
+endef
+
+define Package/idn2/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/* $(1)/usr/bin/
+endef
+
+define Package/libidn2/install
+	$(INSTALL_DIR) $(1)/usr/lib/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/*.so* $(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,idn2))
+$(eval $(call BuildPackage,libidn2))
diff --git a/package/lean/luci-app-dnspod/Makefile b/package/lean/luci-app-dnspod/Makefile
new file mode 100644
index 0000000000..6d55ff6c6a
--- /dev/null
+++ b/package/lean/luci-app-dnspod/Makefile
@@ -0,0 +1,51 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=luci-app-dnspod
+PKG_VERSION=1.0
+PKG_RELEASE:=1
+
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/host-build.mk
+
+define Package/luci-app-dnspod
+   SECTION:=luci
+   CATEGORY:=LuCI
+   SUBMENU:=3. Applications
+   TITLE:=Auto DNS for dnspod
+   PKGARCH:=all
+   DEPENDS:= +curl +libcurl
+endef
+
+define Package/luci-app-dnspod/description
+   auto get pub ip,dnspod ddns,must include curl with ssl
+endef
+
+define Build/Prepare
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+endef
+
+define Package/luci-app-dnspod/install
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_DIR) $(1)/usr/lib/lua/luci/model/cbi
+	$(INSTALL_DIR) $(1)/usr/lib/lua/luci/controller
+
+	$(INSTALL_CONF) ./files/root/etc/config/dnspod $(1)/etc/config/dnspod
+	$(INSTALL_BIN) ./files/root/etc/init.d/dnspod $(1)/etc/init.d/dnspod
+	$(INSTALL_DATA) ./files/root/usr/lib/lua/luci/model/cbi/dnspod.lua $(1)/usr/lib/lua/luci/model/cbi/dnspod.lua
+	$(INSTALL_DATA) ./files/root/usr/lib/lua/luci/controller/dnspod.lua $(1)/usr/lib/lua/luci/controller/dnspod.lua
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) ./files/dnspod.sh $(1)/usr/sbin
+endef
+
+$(eval $(call BuildPackage,luci-app-dnspod))
+
+
+
diff --git a/package/lean/luci-app-dnspod/files/dnspod.sh b/package/lean/luci-app-dnspod/files/dnspod.sh
new file mode 100755
index 0000000000..55366f4b4a
--- /dev/null
+++ b/package/lean/luci-app-dnspod/files/dnspod.sh
@@ -0,0 +1,193 @@
+#!/bin/sh
+#written by benson huang
+#admin@zhetenger.com
+#http://www.terryche.me/openwrt-dnspod-ddns.html
+
+#dnspod帐号名
+email=`uci get dnspod.base_arg.login_email`
+
+#dnspod密码
+password=`uci get dnspod.base_arg.login_password 2>/dev/null`
+
+#域名
+domainname=`uci get dnspod.base_arg.main_domain 2>/dev/null`
+
+#需要更新的子域名列表，多个的话，以空格分割。
+#例如：
+#  sub_domains='www home'
+sub_domains=`uci get dnspod.base_arg.sub_domain 2>/dev/null`
+
+#check for changed ip every 300 seconds
+wait=300
+
+#检查是否安装curl
+curl_status=`which curl 2>/dev/null`
+[ -n "$curl_status" ] || { echo "curl is not installed";exit 3; }
+
+os=$(uname -a | egrep -io 'openwrt' | tr [A-Z] [a-z])
+
+API_url="https://dnsapi.cn"
+format='json'
+lang='en'
+record_type='A'
+offset="2"
+length=""
+common_options="--data-urlencode \"login_email=${email}\"\
+				--data-urlencode \"login_password=${password}\"\
+				--data-urlencode \"format=${format}\"\
+				--data-urlencode \"lang=${lang}\""
+PROGRAM=$(basename $0)
+is_svc=0
+
+printMsg() {
+	local msg="$1"
+	if [ $is_svc -eq 1 ];then
+		logger -t ${PROGRAM} "${msg}"
+	else
+		echo $msg
+	fi
+}
+
+getIp() {
+#	curl -s http://checkip.dyndns.com | sed -n 's/.*: \([0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\).*/\1/p'
+	curl -s http://members.3322.org/dyndns/getip
+}
+
+getJsonValue(){
+	local params="$1"
+	echo $json_data | sed 's/\\\\\//\//g' | sed 's/[{}]//g;s/\(\[\|\]\)//g' |\
+		awk -F ',' '{ for (i=1;i<=NF;i++) { print $i }}' |\
+		sed 's/":/\|/g;s/"//g' |\
+		awk -v k="$params" -F'|' '{ if ($(NF - 1) == k )  print $NF }'
+}
+
+execAPI() {
+	local action="$1"
+	local extra_options="$2"
+	eval "curl -k -A 'xddns' ${API_url}/${action} ${common_options} ${extra_options}"
+}
+
+getDomainId() {
+	local extra_options="--data-urlencode \"domain=${domainname}\""
+	json_data=$(execAPI "Domain.info" "${extra_options}")
+	getJsonValue id
+}
+
+getRecordId() {
+	local extra_options
+	for sub_domain in $sub_domains;do
+		extra_options="--data-urlencode \"record_type=${record_type}\"\
+						--data-urlencode \"domain_id=${domain_id}\"\
+						--data-urlencode \"sub_domain=${sub_domain}\"\
+						--data-urlencode \"offset=${offset}\"\
+						--data-urlencode \"length=${length}\""
+
+		json_data=$(execAPI "Record.List" "${extra_options}")
+
+		#check if record type is NS
+		IS_NS=$(getJsonValue type | grep -o 'NS' | head -n1)
+
+		#if there are multi @ subdomains, get the first non-NS record id only
+		if [ "$IS_NS" = "NS" ];then
+			numofline=$(getJsonValue id | sed '/^[0-9]\{7\}$/d' | wc -l)
+			[ $numofline -eq 3 ] && tmp_result_id="$(getJsonValue id | sed '/^[0-9]\{7\}$/d' | head -n1 )" || continue
+		else
+			tmp_result_id="$(getJsonValue id | sed '/^[0-9]\{7\}$/d')"
+		fi	
+		#if result_id is not empty or unset, append a space to split record id
+		result_id="${result_id:+${result_id} }${tmp_result_id}"
+	done
+	echo $result_id
+	exit
+}
+
+updateRecord() {
+	local record_id_list
+	local extra_options
+	local tmp=${sub_domains}
+	local tmp_sub_domains
+	printMsg 'Start update records'
+	record_id_list=$(getRecordId)
+	printMsg "Records IDs: ${record_id_list}"
+	for record_id in $record_id_list;do
+		tmp_sub_domains=$(echo $tmp | awk '{ print $1 }')
+		tmp=${tmp#* }
+		extra_options="--data-urlencode \"domain_id=${domain_id}\"\
+						--data-urlencode \"record_id=${record_id}\"\
+						--data-urlencode \"sub_domain=${tmp_sub_domains}\"\
+						--data-urlencode \"record_type=${record_type}\"\
+						--data-urlencode \"record_line=默认\"\
+						--data-urlencode \"value=${pub_ip_addr}\"\
+						--data-urlencode \"mx=1\""
+		json_data=$(execAPI "Record.Modify" "${extra_options}")
+		printMsg "Update [${tmp_sub_domains}.${domainname}] ${record_type} record to [${pub_ip_addr}] : $(getJsonValue message)"
+	done
+	printMsg 'Update records finish'
+}
+
+checkip() {
+	local oldip=$pub_ip_addr
+	pub_ip_addr=$(getIp)
+	printMsg "old ip: [$oldip], new ip: [$pub_ip_addr]"
+	if [ "$pub_ip_addr" != "$oldip" ];then
+		return 8
+	else
+		return 3
+	fi
+}
+
+updateTunnelBroker() {
+	printMsg "Start Update Tunnel Broker"
+	printMsg "User Name: ***, Tunnel ID: ***"
+	result=$(curl -s --insecure https://ipv4.tunnelbroker.net/nic/update --data-urlencode "username=***" --data-urlencode "password=***" --data-urlencode "hostname=***")
+	printMsg "Update Tunnel Broker: ${result}"
+	printMsg "Update Tunnel Broker finish"
+}
+
+execSvc() {
+	local ip
+	#check that whether the network is ok
+	while [ 1 ];do
+		ip=$(getIp)
+		if [ -n "$ip" ];then
+			printMsg "WAN IP: ${ip}"
+			break;
+		else
+			printMsg "Can't get wan ip"
+			sleep 30
+		fi
+	done
+
+	domain_id=`getDomainId $domainname`
+	printMsg "domain_id: ${domain_id}"
+	while [ 1 ];do
+		checkip
+		if [ $? -eq 8 ];then
+			updateRecord
+			#updateTunnelBroker
+		fi
+		sleep $wait
+	done
+}
+
+execUpdate() {
+	domain_id=`getDomainId $domainname`
+	pub_ip_addr=$(getIp)
+	updateRecord
+}
+
+case $1 in
+	--svc)
+		is_svc=1;
+		printMsg 'Start in Service mode';
+		printMsg "domain: ${domainname}, sub_domains: ${sub_domains}";
+		execSvc;;
+	--ipv6)
+		is_svc=0;
+		printMsg "Start update HE Tunnel Broker";
+		updateTunnelBroker;;
+	*)
+		is_svc=0;
+		printMsg "Start update record, domain: ${domainname}, sub_domains: ${sub_domains}";
+		execUpdate;;
+esac
diff --git a/package/lean/luci-app-dnspod/files/root/etc/config/dnspod b/package/lean/luci-app-dnspod/files/root/etc/config/dnspod
new file mode 100644
index 0000000000..6cebd6d7a1
--- /dev/null
+++ b/package/lean/luci-app-dnspod/files/root/etc/config/dnspod
@@ -0,0 +1,6 @@
+config base_arg "base_arg"
+	option login_email  ''
+	option login_password ''
+	option main_domain ''
+	option sub_domain ''
+
diff --git a/package/lean/luci-app-dnspod/files/root/etc/init.d/dnspod b/package/lean/luci-app-dnspod/files/root/etc/init.d/dnspod
new file mode 100755
index 0000000000..70c2a12535
--- /dev/null
+++ b/package/lean/luci-app-dnspod/files/root/etc/init.d/dnspod
@@ -0,0 +1,18 @@
+#!/bin/sh /etc/rc.common
+START=80
+
+run_reboot()
+{                                                                                                       
+	killall dnspod.sh
+	/sbin/dnspod.sh --svc
+}
+
+start()
+{
+	/sbin/dnspod.sh --svc
+}
+
+stop()
+{
+	killall dnspod.sh
+}
diff --git a/package/lean/luci-app-dnspod/files/root/usr/lib/lua/luci/controller/dnspod.lua b/package/lean/luci-app-dnspod/files/root/usr/lib/lua/luci/controller/dnspod.lua
new file mode 100644
index 0000000000..56517f10f8
--- /dev/null
+++ b/package/lean/luci-app-dnspod/files/root/usr/lib/lua/luci/controller/dnspod.lua
@@ -0,0 +1,5 @@
+module("luci.controller.dnspod", package.seeall)
+
+function index()
+        entry({"admin", "network", "dnspod"}, cbi("dnspod"), _("动态DNSPOD"), 100)
+end
diff --git a/package/lean/luci-app-dnspod/files/root/usr/lib/lua/luci/model/cbi/dnspod.lua b/package/lean/luci-app-dnspod/files/root/usr/lib/lua/luci/model/cbi/dnspod.lua
new file mode 100644
index 0000000000..a366050379
--- /dev/null
+++ b/package/lean/luci-app-dnspod/files/root/usr/lib/lua/luci/model/cbi/dnspod.lua
@@ -0,0 +1,32 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2010 Jo-Philipp Wich <xm@subsignal.org>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+]]--
+
+require("luci.sys")
+
+m = Map("dnspod", translate("动态DNSPOD"), translate("配置动态DNSPOD"))
+
+s = m:section(TypedSection, "base_arg", "")
+s.addremove = false
+s.anonymous = true
+
+email = s:option(Value, "login_email", translate("登录邮箱"),"登录DNSPOD的用户名")
+pass = s:option(Value, "login_password", translate("登录密码"),"登录DNSPOD的密码")
+pass.password=true
+main = s:option(Value, "main_domain", translate("主域名"),"想要解析的主域名，例如:baidu.com")
+sub = s:option(Value, "sub_domain", translate("子域名"),"想要解析的子域名，多个以空格分开，例如:test hehe")
+
+local apply = luci.http.formvalue("cbi.apply")
+if apply then
+	io.popen("/etc/init.d/dnspod restart &")
+end
+
+return m
diff --git a/package/lean/luci-app-flowoffload/root/etc/config/flowoffload b/package/lean/luci-app-flowoffload/root/etc/config/flowoffload
index 10fbf33f8b..906977e309 100644
--- a/package/lean/luci-app-flowoffload/root/etc/config/flowoffload
+++ b/package/lean/luci-app-flowoffload/root/etc/config/flowoffload
@@ -1,4 +1,4 @@
 
 config flowoffload 'config'
-	option enabled '1'
+	option enabled '0'
 
diff --git a/package/lean/shellinabox/Makefile b/package/lean/shellinabox/Makefile
new file mode 100644
index 0000000000..bcea8c20d3
--- /dev/null
+++ b/package/lean/shellinabox/Makefile
@@ -0,0 +1,42 @@
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=shellinabox
+PKG_VERSION:=2.19
+PKG_RELEASE:=$(PKG_SOURCE_VERSION)
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/shellinabox/shellinabox.git
+PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
+PKG_SOURCE_VERSION:=1a8010f2c94a62e7398c4fa130dfe9e099dc55cd
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+
+PKG_FIXUP:=autoreconf
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/shellinabox 
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=a web based terminal emulator
+  URL:=https://github.com/shellinabox/shellinabox
+  DEPENDS:=+zlib +libopenssl +busybox +@BUSYBOX_CUSTOM +@BUSYBOX_CONFIG_LOGIN
+endef
+
+define Package/shellinabox/description
+	Shell In A Box implements a web server that 
+	can export arbitrary command line tools to 
+	a web based terminal emulator. This emulator 
+	is accessible to any JavaScript and CSS 
+	enabled web browser and does not require any additional browser plugins.
+endef
+
+define Package/shellinabox/install
+	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/init.d $(1)/etc/shellinabox
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/shellinaboxd $(1)/usr/sbin
+	$(INSTALL_BIN) ./files/shellinaboxd.init $(1)/etc/init.d/shellinaboxd
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/shellinabox/white-on-black.css $(1)/etc/shellinabox
+	$(PKG_BUILD_DIR)/make-chained-cert.sh > $(1)/etc/shellinabox/certificate.pem
+endef
+
+$(eval $(call BuildPackage,shellinabox))
diff --git a/package/lean/shellinabox/doc/readme b/package/lean/shellinabox/doc/readme
new file mode 100644
index 0000000000..55c487c299
--- /dev/null
+++ b/package/lean/shellinabox/doc/readme
@@ -0,0 +1 @@
+shellinabox运行需要busybox里面的login程序，Makefile中已经依赖，若是以ipk形式安装则需要重新安装busybox
diff --git a/package/lean/shellinabox/files/shellinaboxd.init b/package/lean/shellinabox/files/shellinaboxd.init
new file mode 100755
index 0000000000..e9b62c15e0
--- /dev/null
+++ b/package/lean/shellinabox/files/shellinaboxd.init
@@ -0,0 +1,24 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2015 snqu.com
+
+USE_PROCD=1
+START=99
+
+BIN=/usr/sbin/shellinaboxd
+
+start_service() {
+	libssl=$(find /lib /usr/lib -name "libssl.so*" -type f)
+	if [ -n "$libssl" ];then
+		dir=$(dirname $libssl)
+		libssl=$(basename $libssl)
+
+		cd $dir
+		[ ! -f libssl.so ] && ln -s $libssl libssl.so
+		cd - > /dev/null
+	fi
+
+	procd_open_instance
+	procd_set_param command $BIN -u root -c /etc/shellinabox --css=/etc/shellinabox/white-on-black.css
+	procd_close_instance
+}
+
diff --git a/package/lean/shellinabox/patches/001-fix-compile.patch b/package/lean/shellinabox/patches/001-fix-compile.patch
new file mode 100644
index 0000000000..8fab53a46c
--- /dev/null
+++ b/package/lean/shellinabox/patches/001-fix-compile.patch
@@ -0,0 +1,16 @@
+Index: shellinabox-2015-12-06/configure.ac
+===================================================================
+--- shellinabox-2015-12-06.orig/configure.ac	2016-04-27 15:24:07.000000000 +0800
++++ shellinabox-2015-12-06/configure.ac	2016-04-27 16:50:10.792530502 +0800
+@@ -75,11 +75,6 @@
+             [AC_DEFINE(HAVE_ISNAN, 1,
+                        Define to 1 if you have support for isnan)])
+ 
+-dnl Even if utmpx.h exists, not all systems have support for updwtmpx()
+-AC_TRY_LINK([#include <utmp.h>],
+-            [updwtmp(0, 0);],
+-            [AC_DEFINE(HAVE_UPDWTMP, 1,
+-                       Define to 1 if you have support for updwtmp)])
+ AC_TRY_LINK([#include <utmpx.h>],
+             [updwtmpx(0, 0);],
+             [AC_DEFINE(HAVE_UPDWTMPX, 1,