From be275fd42a33653acdb4bd4604f4a9ec6b463da0 Mon Sep 17 00:00:00 2001
From: INAGAKI Hiroshi <musashino.open@gmail.com>
Date: Sat, 27 Jul 2019 02:30:20 +0900
Subject: i18n: sync translations

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
---
 applications/luci-app-firewall/po/ca/firewall.po   | 472 +++++++++++---------
 applications/luci-app-firewall/po/cs/firewall.po   | 472 +++++++++++---------
 applications/luci-app-firewall/po/de/firewall.po   | 472 +++++++++++---------
 applications/luci-app-firewall/po/el/firewall.po   | 470 +++++++++++---------
 applications/luci-app-firewall/po/en/firewall.po   | 467 ++++++++++++--------
 applications/luci-app-firewall/po/es/firewall.po   | 475 ++++++++++++---------
 applications/luci-app-firewall/po/fr/firewall.po   | 470 +++++++++++---------
 applications/luci-app-firewall/po/he/firewall.po   | 467 ++++++++++++--------
 applications/luci-app-firewall/po/hu/firewall.po   | 472 +++++++++++---------
 applications/luci-app-firewall/po/it/firewall.po   | 469 ++++++++++++--------
 applications/luci-app-firewall/po/ja/firewall.po   | 472 ++++++++++++--------
 applications/luci-app-firewall/po/ko/firewall.po   | 469 ++++++++++++--------
 applications/luci-app-firewall/po/ms/firewall.po   | 467 ++++++++++++--------
 applications/luci-app-firewall/po/no/firewall.po   | 472 +++++++++++---------
 applications/luci-app-firewall/po/pl/firewall.po   | 472 +++++++++++---------
 .../luci-app-firewall/po/pt-br/firewall.po         | 475 ++++++++++++---------
 applications/luci-app-firewall/po/pt/firewall.po   | 472 +++++++++++---------
 applications/luci-app-firewall/po/ro/firewall.po   | 470 +++++++++++---------
 applications/luci-app-firewall/po/ru/firewall.po   | 472 ++++++++++++--------
 applications/luci-app-firewall/po/sk/firewall.po   | 467 ++++++++++++--------
 applications/luci-app-firewall/po/sv/firewall.po   | 470 +++++++++++---------
 .../luci-app-firewall/po/templates/firewall.pot    | 467 ++++++++++++--------
 applications/luci-app-firewall/po/tr/firewall.po   | 467 ++++++++++++--------
 applications/luci-app-firewall/po/uk/firewall.po   | 472 ++++++++++++--------
 applications/luci-app-firewall/po/vi/firewall.po   | 467 ++++++++++++--------
 .../luci-app-firewall/po/zh-cn/firewall.po         | 475 ++++++++++++---------
 .../luci-app-firewall/po/zh-tw/firewall.po         | 475 ++++++++++++---------
 27 files changed, 7570 insertions(+), 5137 deletions(-)

(limited to 'applications/luci-app-firewall/po')

diff --git a/applications/luci-app-firewall/po/ca/firewall.po b/applications/luci-app-firewall/po/ca/firewall.po
index e05ebf1f0f..abb27d8b07 100644
--- a/applications/luci-app-firewall/po/ca/firewall.po
+++ b/applications/luci-app-firewall/po/ca/firewall.po
@@ -15,50 +15,50 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 "X-Generator: Pootle 2.0.6\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s en %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s amb %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s en %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> paquets al <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> i limita a %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Acció"
 
@@ -74,33 +74,75 @@ msgstr "Afegeix"
 msgid "Add and edit..."
 msgstr "Afegeix i edita..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Ajusts avançats"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Permet el reenviament des dels <em>zones d'origen</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Permet el reenviament als <em>zones de destí</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Qualsevol"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Xarxes cobertes"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Regles personalitzades"
@@ -116,15 +158,15 @@ msgstr ""
 "ordres s'executen després de cada reinici de tallafocs, just després el "
 "conjunt de regles per defecte s'ha carregat."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Adreça de destí"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Port de destí"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -134,72 +176,82 @@ msgstr "Zona de destí"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "No reescriguis"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Descarta els paquets invàlids"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Habilita"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Habilita protecció contra la inundació SYN"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Habilita el registre d'aquesta zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Adreça IP extern"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -209,11 +261,23 @@ msgstr "Port extern"
 msgid "External zone"
 msgstr "Zona extern"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Paràmetres extres"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Tallafocs"
@@ -222,71 +286,71 @@ msgstr "Tallafocs"
 msgid "Firewall - Custom Rules"
 msgstr "Tallafocs - Regles personalitzades"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Tallafocs - Reenviaments de port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Tallafocs - Regles de tràfic"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Tallafocs - Ajusts de zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Força el rastreig de connexió"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Reenvia"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Reenvia a"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "Des de %s en %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "Des de %s en %s amb origen %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "Des de %s en %s amb orígens %s i %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Ajusts generals"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -305,47 +369,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 i IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "Només IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "Només IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Adreça IP interna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Port intern"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Zona interna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Limita els missatges de registre"
 
@@ -359,24 +427,24 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "Fixació MSS"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Mascarada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Coincideix"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Coincideix amb el tipus ICMP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -384,18 +452,18 @@ msgstr ""
 "Coincideix amb trànsit entrant dirigit al port o rang de ports de destí en "
 "aquest host donat"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -429,19 +497,19 @@ msgstr "Nou reenviament de port"
 msgid "New source NAT"
 msgstr "Nou origen NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "Només coincideix amb trànsit entrant dirigit a la adreça IP donada."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Només coincideix amb trànsit entrant des d'aquests MAC."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "Només coincideix amb trànsit entrant des d'aquest IP o rang."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -458,26 +526,31 @@ msgstr "Obre els ports en el encaminador"
 msgid "Other..."
 msgstr "Altre..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Sortida"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr ""
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr "Passa paràmetres addicionals al iptables. Utilitzeu-ho amb cura!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Reenviaments de port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -485,38 +558,44 @@ msgstr ""
 "El reenviament de ports permet que els ordinadors remots en el Internet "
 "connectin a un ordinador o servei específic dins del LAN privat."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protocol"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr "Redirigeix trànsit entrant coincidit al port donat en el host intern"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Redirigeix trànsit entrant coincidit al host intern especificat"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -524,20 +603,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "Restringeix la mascarada a les subxarxes de destí donades"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "Restringeix la mascarada a les subxarxes d'origen donades"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Restringeix a la família d'adreces"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -549,64 +628,64 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Adreça IP d'origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Adreça MAC d'origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Adreça d'origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Port d'origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Zona d'origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -614,8 +693,8 @@ msgstr ""
 "El tallafocs crea zones a les teves interfícies de xarxa per controlar el "
 "flux de tràfic de xarxa."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -631,7 +710,7 @@ msgstr ""
 "regla de reenviament es <em>unidirectional</em>, per exemple un reenviament "
 "de lan a wan <em>no</em> implica permís per reenviar de wan a lan també."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 #, fuzzy
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
@@ -647,31 +726,31 @@ msgstr ""
 "<em>Xarxes cobertes</em> especifica quines xarxes disponibles són membres "
 "d'aquesta zona."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "A %s a %s en <var>aquest dispositiu</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "A %s en %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "A %s en <var>aquest dispositiu</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "A %s, %s en %s"
 
@@ -683,12 +762,12 @@ msgstr "A l'IP d'origen"
 msgid "To source port"
 msgstr "Al port d'origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Regles de trànsit"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -698,109 +777,121 @@ msgstr ""
 "zones distintes, per exemple per a rebutjar trànsit entre certs hosts o "
 "obrir ports WAN en el encaminador."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "Via %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "Via %s a %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Zona ⇒ Reenviaments"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zones"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "accepta"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "qualsevol"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "qualsevol host"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "qualsevol IP d'encaminador"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "qualsevol zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "no rastregis"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "descarta"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -822,13 +913,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "rebutja"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
@@ -855,9 +946,6 @@ msgstr ""
 #~ msgid "Destination IP address"
 #~ msgstr "Adreça IP de destí"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "Reenviament interzonal"
 
diff --git a/applications/luci-app-firewall/po/cs/firewall.po b/applications/luci-app-firewall/po/cs/firewall.po
index b73fa704ca..dfe7c5bc94 100644
--- a/applications/luci-app-firewall/po/cs/firewall.po
+++ b/applications/luci-app-firewall/po/cs/firewall.po
@@ -11,50 +11,50 @@ msgstr ""
 "Plural-Forms: nplurals=3; plural=(n==1) ? 0 : (n>=2 && n<=4) ? 1 : 2;\n"
 "X-Generator: Pootle 2.0.6\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s v %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s s %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s v %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> paketů za <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr "<var>%d</var> paketů za <var>%s</var>, burst <var>%d</var> paketů."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> a omezit na %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Akce"
 
@@ -70,33 +70,75 @@ msgstr "Přidat"
 msgid "Add and edit..."
 msgstr "Přidat a upravit"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Pokročilé nastavení"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Povolit přesměrování ze <em>zdrojových oblastí</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Povolit přesměrování do <em>zdrojových oblastí</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Libovolné"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Pokryté sítě"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Vlastní pravidla"
@@ -111,15 +153,15 @@ msgstr ""
 "nejsou jinak pokryté frameworkem firewallu. Příkazy jsou spuštěny po každém "
 "restartu firewallu, právě po načtení výchozí sady pravidel."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Cílová adresa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Cílový port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -129,72 +171,82 @@ msgstr "Cílová oblast"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Nepřepisovat"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Zahazovat neplatné pakety"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Povolit"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "Povolit NAT Loopback"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Povolit ochranu proti SYN-flood"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Povolit logování v této oblasti"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Vnější IP adresa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -204,11 +256,23 @@ msgstr "Vnější port"
 msgid "External zone"
 msgstr "Vnější zóna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Dodatečné argumenty"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Firewall"
@@ -217,71 +281,71 @@ msgstr "Firewall"
 msgid "Firewall - Custom Rules"
 msgstr "Firewall - Vlastní pravidla"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Firewall - Přesměrování portů"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Firewall - Pravidla síťového provozu"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Firewall - Nastavení zón"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Vynutit sledování připojení"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Přesměrování"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Přesměrovat na"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "Z %s v %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "Z %s v %s se zdrojovou %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "Z %s v %s se zdrojovou %s a %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Obecné nastavení"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -300,47 +364,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 a IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "pouze IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "pouze IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Vstup"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Vnitřní IP adresa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Vnitřní port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Vnitřní zóna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Omezit logovací zprávy"
 
@@ -354,24 +422,24 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "MSS clamping"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Maškárádování"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Shoda"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Odpovídá ICMP typu"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -379,18 +447,18 @@ msgstr ""
 "Vybrat příchozí provoz, směrovaný na zadaný cílový port nebo rozsah portů "
 "tohoto hostitele"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -424,19 +492,19 @@ msgstr "Nové přesměrování portu"
 msgid "New source NAT"
 msgstr "Nový zdrojový NAT (SNAT)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "Vybrat pouze příchozí provoz, směrovaný na danou IP adresu."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Vybrat pouze příchozí provoz z těchto MAC adres."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "Vybrat pouze příchozí provoz z této IP nebo rozsahu IP adres."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -453,26 +521,31 @@ msgstr "Otevřené porty na routeru"
 msgid "Other..."
 msgstr "Ostatní ..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Výstup"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr ""
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr "Předává další argumenty iptables. Používat opatrně!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Přesměrování portů"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -481,39 +554,45 @@ msgstr ""
 "Internetu připojení k vybraným počítačům nebo službám uvnitř privátní sítě "
 "LAN."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protokol"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "Přesměrovat vybraný příchozí provoz na uvedený port vnitřního hostitele."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Přesměrovat vybraný příchozí provoz na uvedeného vnitřního hostitele."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -521,20 +600,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "Omezit maškarádování na uvedené cílové podsítě"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "Omezit maškarádování na uvedené zdrojové podsítě"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Omezit na rodinu adres"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -546,64 +625,64 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Zdrojová IP adresa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Zdrojová MAC adresa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Zdrojová adresa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Zdrojový port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Zdrojová zóna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -611,8 +690,8 @@ msgstr ""
 "Firewall vytváří zóny přes vaše síťová rozhraní za účelem řízení síťového "
 "provozu."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -628,7 +707,7 @@ msgstr ""
 "Přesměrovávací pravidlo je <em>jednosměrné</em>, například přesměrování z "
 "lan do wan <em>nepovoluje</em> přesměrování z wan do lan (a naopak)."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 #, fuzzy
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
@@ -643,31 +722,31 @@ msgstr ""
 "pro přesměrování provozu mezi rozdílnými sítěmi uvnitř jedné zóny.<em> "
 "Pokryté sítě</em> určuje, které z dostupných sítí jsou členy této zóny."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "Na %s v %s na <var>tomto zařízení</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "Na %s v %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "Na %s na <var>tomto zařízení</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "Na %s, %s v %s"
 
@@ -679,12 +758,12 @@ msgstr "Na zdrojovou IP"
 msgid "To source port"
 msgstr "Na zdrojový port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Pravidla síťového provozu"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -694,109 +773,121 @@ msgstr ""
 "různými zónami, například pro odmítnutí provozu mezi jistými hostiteli nebo "
 "pro otevření WAN portů na routeru."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "Prostřednictvím %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Zóna ⇒ Přesměrování"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zóny"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "přijmout"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "libovolný"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "libovolný hostitel"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "libovolná IP routeru"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "libovolná zóna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "nesledovat"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "zahodit"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -818,13 +909,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "odmítnout"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
@@ -851,9 +942,6 @@ msgstr ""
 #~ msgid "Destination IP address"
 #~ msgstr "Cílová IP adresa"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 # nebo mimo zóny?
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "Přesměrování mezi zónami"
diff --git a/applications/luci-app-firewall/po/de/firewall.po b/applications/luci-app-firewall/po/de/firewall.po
index 9885c321ed..ba09ba1966 100644
--- a/applications/luci-app-firewall/po/de/firewall.po
+++ b/applications/luci-app-firewall/po/de/firewall.po
@@ -13,50 +13,50 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 "X-Generator: Pootle 2.0.6\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s in %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s mit %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s in %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> Pkte. pro <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr "<var>%d</var> Pkte. pro <var>%s</var>, Häufung <var>%d</var> Pkte."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> und limitieren auf %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Aktion"
 
@@ -72,33 +72,75 @@ msgstr "Hinzufügen"
 msgid "Add and edit..."
 msgstr "Hinzufügen und bearbeiten..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Erweiterte Einstellungen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Erlaube Weiterleitung von <em>Quellzone</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Erlaube Weiterleitung zu <em>Zielzone</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "beliebig"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Abgedeckte Netzwerke"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Benutzerdefinierte Regeln"
@@ -114,15 +156,15 @@ msgstr ""
 "Befehle werden mit jedem Firewall-Neustart abgearbeitet, direkt nach dem "
 "Laden der Basisregeln."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Zieladresse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Zielport"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -132,72 +174,82 @@ msgstr "Ziel-Zone"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Nicht umschreiben"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Ungültige Pakete verwerfen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Aktivieren"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "NAT-Loopback aktivieren"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Schutz vor SYN-flood-Attacken"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Protokollierung innerhalb der Zone aktivieren"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr "Experimentelle Funktion. Nicht vollständig kompatibel mit QoS/SQM."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Externe IP-Adresse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -207,11 +259,23 @@ msgstr "Externer Port"
 msgid "External zone"
 msgstr "Externe Zone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Zusätzliche Argumente"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Firewall"
@@ -220,71 +284,71 @@ msgstr "Firewall"
 msgid "Firewall - Custom Rules"
 msgstr "Firewall - Benutzerdefinierte Regeln"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Firewall - Portweiterleitungen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Firewall - Verkehrsregeln"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Firewall - Zoneneinstellungen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Connectiontracking erzwingen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Weitergeleitet"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Weiterleiten an"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr "Freitag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "Von %s in %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "Von %s in %s mit Quell-%s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "Von %s in %s mit Quell-%s und %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Allgemein"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr "Hardwarebeschleunigte Flusskontrolle"
 
@@ -303,47 +367,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 und IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "nur IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "nur IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Eingang"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Interne IP-Adresse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Interner Port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Interne Zone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Protokollnachrichten limitieren"
 
@@ -357,24 +425,24 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "MSS Korrektur"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "NAT aktivieren"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Filter"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Nach ICMP-Typ filtern"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -382,18 +450,18 @@ msgstr ""
 "Eingehende Verbindungen filtern welche an den angegebenen Port oder "
 "Portbereich auf dem lokalen Gerät gerichtet sind"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr "Montag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr "Monatstage"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -427,19 +495,19 @@ msgstr "Neue Portweiterleitung"
 msgid "New source NAT"
 msgstr "Neues SNAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "Selektiere nur Verkehr der an die angegebene IP-Adresse gerichtet ist."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Selektiere nur Verkehr von den angegebenen MAC-Adressen."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "Selektiere nur Verkehr vom angebenem Quell-IP-Adressbereich."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -454,28 +522,33 @@ msgstr "Ports auf dem Router öffnen"
 msgid "Other..."
 msgstr "Anderes..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Ausgang"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr ""
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 "Gibt zusätzliche Kommandozeilenargumente an iptables weiter. Mit Vorsicht "
 "benutzen!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Portweiterleitungen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -483,40 +556,46 @@ msgstr ""
 "Portweiterleitungen ermöglichen es entfernten Rechnern im Internet auf "
 "bestimmte Computer oder Dienste im lokalen LAN zuzugreifen."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protokoll"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "Gefilterte Verbindungen an den angegeben Port auf dem internen Host "
 "weiterleiten"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Gefilterte Verbindungen an den angegeben internen Host weiterleiten"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 "Erfordert Hardware-NAT-Unterstützung. (Zumindest für mt7621 implementiert)"
@@ -525,20 +604,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "NAT auf die angegebenen Ziel-Subnetze beschränken"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "NAT auf die angegebenen Quell-Subnetze beschränken"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Beschränke auf Adressfamilie"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr "Routing/NAT-Beschleunigung"
 
@@ -550,64 +629,64 @@ msgstr "Regel ist deaktiviert"
 msgid "Rule is enabled"
 msgstr "Regel ist aktiviert"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr "Samstag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr "Softwarebasierte Auslagerung für Routing/NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr "Beschleunigte Flusskontrolle"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Quell-IP-Adresse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Quell-MAC-Adresse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Quelladresse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Quellport"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Quell-Zone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr "Startdatum (JJJJ-MM-TT)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr "Enddatum (JJJJ-MM-TT)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr "Sonntag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -615,8 +694,8 @@ msgstr ""
 "Die Firewall erstellt Netzwerkzonen über bestimmte Netzwerkschnittstellen um "
 "den Netzverkehr zu trennen."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -634,7 +713,7 @@ msgstr ""
 "<em>nicht</em> zusätzlich die Erlaubnis, auch von WAN nach LAN "
 "weiterzuleiten."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 #, fuzzy
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
@@ -650,31 +729,31 @@ msgstr ""
 "Schnittstellen innerhalb dieser Zone zu. <em>Abgedeckte Netzwerke</em> "
 "definieren die Zugehörigkeit von Schnittstellen zu dieser Zone."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr "Donnerstag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr "Zeit ist UTC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "Zu %s an %s auf <var>diesem Gerät</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "Zu %s in %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "Zu %s auf <var>diesem Gerät</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "Zu %s, %s in %s"
 
@@ -686,12 +765,12 @@ msgstr "Zu Quell-IP"
 msgid "To source port"
 msgstr "Zu Quell-Port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Verkehrsregeln"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -701,111 +780,123 @@ msgstr ""
 "zum Beispiel um Verkehr zwischen bestimmten Rechnern zu unterbinden oder um "
 "WAN-Ports auf dem Router zu öffnen."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr "Dienstag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr "Unbenannte Portweiterleitung"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr "Unbennante Regel"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "Über %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "Über %s an %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr "Mittwoch"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr "Wochentage"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Zone ⇒ Weiterleitungen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zonen"
 
 # Die richtige Übersetzung von ACCEPT im Firewallkontext ist nicht "Annehmen" sondern "Zulassen". Man kann ja keinen
 # ausgehenden Verkehr annehmen. 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "zulassen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "beliebig"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "beliebiger Rechner"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "beliebige Router-IP"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "beliebige Zone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "nicht verfolgen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "verwerfen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -827,13 +918,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "zurückweisen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
@@ -860,9 +951,6 @@ msgstr ""
 #~ msgid "Destination IP address"
 #~ msgstr "Ziel IP-Adresse"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "Weiterleitungen zwischen Zonen"
 
diff --git a/applications/luci-app-firewall/po/el/firewall.po b/applications/luci-app-firewall/po/el/firewall.po
index a8472430d2..36e2e3a368 100644
--- a/applications/luci-app-firewall/po/el/firewall.po
+++ b/applications/luci-app-firewall/po/el/firewall.po
@@ -13,50 +13,50 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 "X-Generator: Pootle 2.0.4\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s με %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> πκτ. ανά <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Ενέργεια"
 
@@ -72,33 +72,75 @@ msgstr "Προσθήκη"
 msgid "Add and edit..."
 msgstr "Προσθήκη και επεξεργασία..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Ρυθμίσεις για προχωρημένους"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Οποιοδήποτε"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Προσαρμοσμένοι Κανόνες"
@@ -110,15 +152,15 @@ msgid ""
 "each firewall restart, right after the default ruleset has been loaded."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Διεύθυνση προορισμού"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Θύρα προορισμού"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 #, fuzzy
@@ -129,73 +171,83 @@ msgstr "Ζώνη προορισμού"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Αγνόηση μη-έγκυρων πακετών"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Ενεργοποίηση"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 #, fuzzy
 msgid "Enable SYN-flood protection"
 msgstr "Προστασία SYN-flood"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Εξωτερική διεύθυνση IP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -205,11 +257,23 @@ msgstr "Εξωτερική θύρα"
 msgid "External zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Επιπλέον παράμετροι"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Τείχος προστασίας"
@@ -218,71 +282,71 @@ msgstr "Τείχος προστασίας"
 msgid "Firewall - Custom Rules"
 msgstr "Τείχος προστασίας - Προσαρμοσμένοι Κανόνες"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Τείχος προστασίας - Προώθηση Θυρών"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Τείχος προστασίας - Κανόνες Κίνησεις"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Τείχος προστασίας - Ρυθμίσεις Ζώνης"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Επιβολή παρακολούθησης σύνδεσης"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Προώθηση"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "Απο %s στο %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Γενικές Ρυθμίσεις"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -301,49 +365,53 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 και IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "Μόνο IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "Μόνο IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Είσοδος"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 #, fuzzy
 msgid "Internal IP address"
 msgstr "Εσωτερική διεύθυνση"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 #, fuzzy
 msgid "Internal port"
 msgstr "Εξωτερική θύρα"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Εσωτερική ζώνη"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Περιορισμός καταγραφών συστήματος"
 
@@ -357,42 +425,42 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 #, fuzzy
 msgid "MSS clamping"
 msgstr "Περιορισμός MSS"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -426,19 +494,19 @@ msgstr ""
 msgid "New source NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -453,63 +521,74 @@ msgstr ""
 msgid "Other..."
 msgstr "Άλλο..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Έξοδος"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
-msgid "Passes additional arguments to iptables. Use with care!"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Προώθηση Θυρών"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Πρωτόκολλο"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -517,20 +596,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -542,67 +621,67 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 #, fuzzy
 msgid "Source IP address"
 msgstr "Διεύθυνση MAC πηγής"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 #, fuzzy
 msgid "Source address"
 msgstr "Διεύθυνση MAC πηγής"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Θύρα πηγής"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 #, fuzzy
 msgid "Source zone"
 msgstr "Θύρα πηγής"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -610,8 +689,8 @@ msgstr ""
 "Το τείχος προστασίας δημιουργεί ζώνες πάνω στις διεπαφές δικτύου για να "
 "ελέγχει την δικτυακή κίνηση."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -621,7 +700,7 @@ msgid ""
 "<em>not</em> imply a permission to forward from wan to lan as well."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -630,31 +709,31 @@ msgid ""
 "networks</em> specifies which available networks are members of this zone."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr ""
 
@@ -666,121 +745,133 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
 "the router."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Ζώνες"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "αποδοχή"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "αγνόηση"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -802,13 +893,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "απόρριψη"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
@@ -825,6 +916,3 @@ msgstr ""
 
 #~ msgid "Destination IP address"
 #~ msgstr "Διεύθυνση IP προορισμού"
-
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
diff --git a/applications/luci-app-firewall/po/en/firewall.po b/applications/luci-app-firewall/po/en/firewall.po
index f7c91820b6..645560ca79 100644
--- a/applications/luci-app-firewall/po/en/firewall.po
+++ b/applications/luci-app-firewall/po/en/firewall.po
@@ -11,50 +11,50 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Action"
 
@@ -70,33 +70,75 @@ msgstr ""
 msgid "Add and edit..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr ""
@@ -108,15 +150,15 @@ msgid ""
 "each firewall restart, right after the default ruleset has been loaded."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Destination address"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Destination port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -126,72 +168,82 @@ msgstr "Destination zone"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Drop invalid packets"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Enable SYN-flood protection"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -201,11 +253,23 @@ msgstr "External port"
 msgid "External zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 # Generated from applications/luci-fw/luasrc/model/cbi/luci_fw/zones.lua      #
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
@@ -218,71 +282,71 @@ msgstr "Firewall"
 msgid "Firewall - Custom Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Forward"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -301,47 +365,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Input"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Internal IP address"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Internal port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr ""
 
@@ -355,24 +423,24 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "MSS clamping"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Masquerading"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -380,18 +448,18 @@ msgstr ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -425,19 +493,19 @@ msgstr ""
 msgid "New source NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -452,64 +520,75 @@ msgstr ""
 msgid "Other..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Output"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
-msgid "Passes additional arguments to iptables. Use with care!"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protocol"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "Redirect matched incoming traffic to the given port on the internal host"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Redirect matched incoming traffic to the specified internal host"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -517,20 +596,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -542,15 +621,15 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
@@ -584,52 +663,52 @@ msgstr ""
 # msgid "Protocol"
 # msgstr ""
 #
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Source IP address"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Source address"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Source port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Source zone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -637,8 +716,8 @@ msgstr ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -648,7 +727,7 @@ msgid ""
 "<em>not</em> imply a permission to forward from wan to lan as well."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -657,31 +736,31 @@ msgid ""
 "networks</em> specifies which available networks are members of this zone."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr ""
 
@@ -693,121 +772,133 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
 "the router."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zones"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "accept"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "any"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "drop"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -829,13 +920,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "reject"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
diff --git a/applications/luci-app-firewall/po/es/firewall.po b/applications/luci-app-firewall/po/es/firewall.po
index e79912f966..7db11e3860 100644
--- a/applications/luci-app-firewall/po/es/firewall.po
+++ b/applications/luci-app-firewall/po/es/firewall.po
@@ -13,51 +13,51 @@ msgstr ""
 "X-Generator: Poedit 2.2.3\n"
 "Language-Team: \n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s en %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s con %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s en %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> paquetes por <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 "<var>%d</var> paquetes por <var>%s</var>, máximo <var>%d</var> paquetes."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> y limitar a %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr "Aceptar reenvío"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr "Aceptar entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr "Aceptar salida"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Acción"
 
@@ -73,33 +73,75 @@ msgstr "Añadir"
 msgid "Add and edit..."
 msgstr "Añadir y editar..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Configuración avanzada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Permitir reenvío desde <em>zonas de origen</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Permitir reenvío a <em>zonas de destino</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Cualquiera"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr "Cualquier día"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Redes cubiertas"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Reglas personalizadas"
@@ -115,15 +157,15 @@ msgstr ""
 "cualquier reinicio del FIrewall, justo tras haber cargado el conjunto de "
 "reglas predeterminadas."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Dirección de destino"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Puerto de destino"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -133,72 +175,82 @@ msgstr "Zona de destino"
 msgid "Disable"
 msgstr "Deshabilitar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr "Descartar reenvío"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr "Descartar entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr "Descartar salida"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "No reescribir"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr "No seguir reenvío"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr "No seguir entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr "No seguir salida"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Descartar paquetes inválidos"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Habilitar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "Habilitar bucle NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Habilitar protección contra inundaciones SYN"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Habilitar registro en esta zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr "Característica experimental. No es totalmente compatible con QoS/SQM."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Dirección IP externa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -208,11 +260,23 @@ msgstr "Puerto externo"
 msgid "External zone"
 msgstr "Zona externa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Parámetros extra"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Firewall"
@@ -221,71 +285,71 @@ msgstr "Firewall"
 msgid "Firewall - Custom Rules"
 msgstr "Firewall - Reglas personalizadas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Firewall - Reenvíos de puertos"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Firewall - Reglas de tráfico"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Firewall - Configuración de la zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Forzar seguimiento de conexión"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Reenviar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Reenviar a"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr "Viernes"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "Desde %s en %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "Desde %s en %s con origen %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "Desde %s en %s con origen %s y %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr "Desde %s en <var>este dispositivo</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr "Desde %s en <var>este dispositivo</var> con la fuente %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr "De %s en <var>este dispositivo</var> con la fuente %s y %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Configuración general"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr "Flow Offloading por hardware"
 
@@ -304,47 +368,51 @@ msgstr "Rango de IP"
 msgid "IPs"
 msgstr "IPs"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 e IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "Sólo IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "Sólo IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Dirección IP interna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Puerto interno"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Zona interna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Limitar registro de mensajes"
 
@@ -358,24 +426,24 @@ msgstr "MAC"
 msgid "MACs"
 msgstr "MACs"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "Fijado de MSS"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Enmascaramiento"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Coincidir"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Coincidir con tipo ICMP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -383,18 +451,18 @@ msgstr ""
 "Coincidir con tráfico de entrada dirigido al puerto o rango de puertos "
 "destino en este host"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr "Lunes"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr "Días del mes"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -428,19 +496,19 @@ msgstr "Nuevo reenvío de puerto"
 msgid "New source NAT"
 msgstr "Nuevo origen NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "Coincidir sólo con tráfico de entrada a esta dirección IP."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Coincidir sólo con tráfico de entrada desde estas MACs."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "Coincidir sólo con tráfico de entrada desde esta IP o rango."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -457,26 +525,31 @@ msgstr "Abrir puertos en el router"
 msgid "Other..."
 msgstr "Otros..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Salida"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr "Zona de salida"
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr "Agrega más parámetros a iptables. ¡Utilice con cuidado!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Reenvíos de puertos"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -484,41 +557,47 @@ msgstr ""
 "El reenvío de puertos permite a ordenadores remotos en internet conectar a "
 "un ordenador o servicio específico en la LAN privada."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protocolo"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "Redirigir el tráfico de entrada que coincida al puerto dado en el host "
 "interno"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr ""
 "Redirigir el tráfico de entrada que coincida al host interno especificado"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr "Rechazar reenvío"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr "Rechazar entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr "Rechazar salida"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 "Requiere soporte de NAT por hardware. Implementado al menos para mt7621"
@@ -527,20 +606,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr "Reiniciar Firewall"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "Restringir enmascaramiento a las subredes destino"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "Restringir enmascaramiento a las subredes origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Restringir a la familia de direcciones"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr "Enrutamiento/NAT Offloading"
 
@@ -552,64 +631,64 @@ msgstr "Regla deshabilitada"
 msgid "Rule is enabled"
 msgstr "Regla habilitada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr "Sábado"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr "Offloading basado en software para enrutamiento/NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr "Flow Offloading por software"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Dirección IP origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Dirección MAC origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Dirección de origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Puerto de origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Zona de origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr "Fecha de inicio (aaaa-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr "Hora de inicio (hh.mm.ss)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr "Fecha de finalización (aaaa-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr "Hora de finalización (hh.mm.ss)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr "Domingo"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -617,8 +696,8 @@ msgstr ""
 "El Firewall crea zonas sobre sus interfaces de red para controlar el flujo "
 "del tráfico."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -635,7 +714,7 @@ msgstr ""
 "la LAN a la WAN <em>no</em> implica permiso para reenviar desde la WAN a la "
 "LAN también."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -650,31 +729,31 @@ msgstr ""
 "<em>Redes cubiertas</em> especifican qué redes disponibles son miembros de "
 "esta zona."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr "Jueves"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr "Restricciones de tiempo"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr "Tiempo en UTC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "A %s en %s por <var>este dispositivo</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "A %s en %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "A %s por <var>este dispositivo</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "A %s, %s en %s"
 
@@ -686,12 +765,12 @@ msgstr "A IP origen"
 msgid "To source port"
 msgstr "A puerto origen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Reglas de tráfico"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -701,109 +780,121 @@ msgstr ""
 "diferentes zonas, por ejemplo, para rechazar el tráfico entre ciertos hosts "
 "o para abrir puertos WAN en el enrutador."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr "Martes"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr "Reenvío sin nombre"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr "Regla sin nombre"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr "Zona sin nombre"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "Vía %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "Vía %s a %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr "Miércoles"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr "Días de la semana"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Zona ⇒ Reenvíos"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zonas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "Aceptar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "cualquiera"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "cualquier host"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "cualquier router IP"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "cualquier zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr "Día"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "No seguir"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "Descartar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr "Hora"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr "Minuto"
@@ -825,13 +916,13 @@ msgstr "Puerto"
 msgid "ports"
 msgstr "Puertos"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "Rechazar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr "segundo"
@@ -846,6 +937,9 @@ msgstr "Tipo"
 msgid "types"
 msgstr "Tipos"
 
+#~ msgid "Output zone"
+#~ msgstr "Zona de salida"
+
 #~ msgid "(Unnamed Entry)"
 #~ msgstr "(Entrada sin nombre)"
 
@@ -858,9 +952,6 @@ msgstr "Tipos"
 #~ msgid "Destination IP address"
 #~ msgstr "Dirección IP destino"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "Reenvío entre zonas"
 
diff --git a/applications/luci-app-firewall/po/fr/firewall.po b/applications/luci-app-firewall/po/fr/firewall.po
index 6aa9257597..74af378020 100644
--- a/applications/luci-app-firewall/po/fr/firewall.po
+++ b/applications/luci-app-firewall/po/fr/firewall.po
@@ -13,50 +13,50 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=(n > 1);\n"
 "X-Generator: Pootle 2.0.6\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Action"
 
@@ -72,33 +72,75 @@ msgstr ""
 msgid "Add and edit..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Paramètres avancés"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Permettre la transmission des <em>zones source</em> :"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Permettre la transmission vers les <em>zones destination</em> :"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "N'importe lequel"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Réseaux couverts"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Régles spécifiques"
@@ -110,15 +152,15 @@ msgid ""
 "each firewall restart, right after the default ruleset has been loaded."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Adresse de destination"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Port de destination"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -128,72 +170,82 @@ msgstr "Zone de destination"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Supprimer les paquets invalides"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Activer"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "Activer le NAT sur la boucle-locale"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Activer la protection contre le SYN-flood"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Activer les traces (logs) sur cette zone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Adresse IP externe"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -203,11 +255,23 @@ msgstr "Port externe"
 msgid "External zone"
 msgstr "Zone externe"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 #  applications/luci-fw/luasrc/model/cbi/luci_fw/zones.lua                    #
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
@@ -220,71 +284,71 @@ msgstr "Pare-feu"
 msgid "Firewall - Custom Rules"
 msgstr "Pare-feu -- Règles personnalisées"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Pare-feu -- Redirections de ports"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Pare-feu -- Règles de trafic"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Pare-feu - Configuration des zones"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Forcer le suivi des connexions"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Transfert"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Transférer à"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Paramètres généraux"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -303,47 +367,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 et IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "IPv4 seulement"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "IPv6 seulement"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Entrée"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Adresse IP interne"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Port interne"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Zone interne"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Limiter les messages de journalisation"
 
@@ -357,24 +425,24 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "Contrainte du MSS"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Masquage"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Type ICMP correspondant"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -382,18 +450,18 @@ msgstr ""
 "Prendre en compte le trafic dirigé vers le port de destination donné (ou la "
 "gamme de ports) sur cet hôte"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -427,19 +495,19 @@ msgstr "Nouvelle redirection de port"
 msgid "New source NAT"
 msgstr "Nouvelle source NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Montrer seulement le trafic entrant provenant de ces adresses MAC."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -454,26 +522,31 @@ msgstr "Ports ouverts sur le routeur"
 msgid "Other..."
 msgstr "Autre..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Sortie"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
-msgid "Passes additional arguments to iptables. Use with care!"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Redirections de port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -481,40 +554,46 @@ msgstr ""
 "La redirection de port permet aux ordinateurs distants sur Internet, de se "
 "connecter à un ordinateur ou service spécifié dans le réseau local privé."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protocole"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "Rediriger le trafic entrant correspondant vers le port donné sur l'hôte "
 "interne"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Rediriger le trafic entrant correspondant vers l'hôte interne spécifié"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -522,24 +601,24 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 "Restreindre la substitution d'adresses (Masquerade) à ces sous-réseaux "
 "destinataires"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 "Restreindre la substitution d'adresses (Masquerade) à ces sous-réseaux "
 "sources"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Restreindre à cette famille d'adresses"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -551,15 +630,15 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
@@ -593,52 +672,52 @@ msgstr ""
 # msgid "Protocol"
 # msgstr ""
 #
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Adresse IP source"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Adresse MAC source"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Adresse source"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Port source"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Zone source"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -646,8 +725,8 @@ msgstr ""
 "Le pare-feu crée des zones sur les interfaces réseau pour contrôler le flux "
 "du trafic réseau."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -664,7 +743,7 @@ msgstr ""
 "transmission du LAN au WAN n'implique <em>pas</em> également l'autorisation "
 "de transmission du WAN au LAN."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 #, fuzzy
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
@@ -680,31 +759,31 @@ msgstr ""
 "cette zone. Les <em>réseaux couverts</em> indiquent quels réseaux "
 "disponibles sont membre de cette zone."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr ""
 
@@ -716,122 +795,134 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Règles de trafic"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
 "the router."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Zone ⇒ Transmissions"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zones"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "accepter"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 #, fuzzy
 msgid "any"
 msgstr "tous"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "ignorer"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -853,13 +944,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "rejeter"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
@@ -877,9 +968,6 @@ msgstr ""
 #~ msgid "Destination IP address"
 #~ msgstr "Adresse IP de destination"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "Transmission entre zones"
 
diff --git a/applications/luci-app-firewall/po/he/firewall.po b/applications/luci-app-firewall/po/he/firewall.po
index ae224bccb5..cccedc020e 100644
--- a/applications/luci-app-firewall/po/he/firewall.po
+++ b/applications/luci-app-firewall/po/he/firewall.po
@@ -8,50 +8,50 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr ""
 
@@ -67,33 +67,75 @@ msgstr ""
 msgid "Add and edit..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr ""
@@ -105,15 +147,15 @@ msgid ""
 "each firewall restart, right after the default ruleset has been loaded."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -123,72 +165,82 @@ msgstr ""
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -198,11 +250,23 @@ msgstr ""
 msgid "External zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr ""
@@ -211,71 +275,71 @@ msgstr ""
 msgid "Firewall - Custom Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -294,47 +358,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr ""
 
@@ -348,41 +416,41 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -416,19 +484,19 @@ msgstr ""
 msgid "New source NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -443,63 +511,74 @@ msgstr ""
 msgid "Other..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
-msgid "Passes additional arguments to iptables. Use with care!"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -507,20 +586,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -532,71 +611,71 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -606,7 +685,7 @@ msgid ""
 "<em>not</em> imply a permission to forward from wan to lan as well."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -615,31 +694,31 @@ msgid ""
 "networks</em> specifies which available networks are members of this zone."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr ""
 
@@ -651,121 +730,133 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
 "the router."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -787,13 +878,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
diff --git a/applications/luci-app-firewall/po/hu/firewall.po b/applications/luci-app-firewall/po/hu/firewall.po
index db7551f852..5a235d7878 100644
--- a/applications/luci-app-firewall/po/hu/firewall.po
+++ b/applications/luci-app-firewall/po/hu/firewall.po
@@ -11,50 +11,50 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 "X-Generator: Pootle 2.0.6\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s %s-ban"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s %s-el"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s %s-ben"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> csomag/<var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr "<var>%d</var> csom. <var>%s</var>-enként, burst <var>%d</var> csom."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> és korlátozás %s-re"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Művelet"
 
@@ -70,33 +70,75 @@ msgstr "Hozzáadás"
 msgid "Add and edit..."
 msgstr "Hozzáadás és szerkesztés..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Haladó beállítások"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Továbbítás engedélyezése ezekből a <em>forrás zónákból</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Továbbítás engedélyezése ezekbe a <em>cél zónákba</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Bármelyik"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Lefedett hálózatok"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Egyéni szabályok"
@@ -112,15 +154,15 @@ msgstr ""
 "lehetőséget. A parancsok a tűzfal minden újraindításakor futtatásra "
 "kerülnek, közvetlenül az alapértelmezett szabálykészletek betöltése után."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Cél cím"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Cél port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -130,72 +172,82 @@ msgstr "Cél zóna"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Ne írja felül"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Érvénytelen csomagok eldobása"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Engedélyezés"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "NAT visszacsatolás engedélyezése"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "SYN-flood védelem engedélyezése"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Naplózás engeélyezése ezen a zónán"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Külső IP cím"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -205,11 +257,23 @@ msgstr "Külső port"
 msgid "External zone"
 msgstr "Külső zóna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "További argumentumok"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Tűzfal"
@@ -218,71 +282,71 @@ msgstr "Tűzfal"
 msgid "Firewall - Custom Rules"
 msgstr "Tűzfal - Egyéni szabályok"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Tűzfal - Port továbbítások"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Tűzfal - Forgalmi szabályok"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Tűzfal - Zóna beállítások"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Kapcsolat követés kényszerítése"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Továbbítás"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Továbbítás ennek"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "%s felől %s-ben"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "%s felől %s-ben %s forrással"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "%s felől %s-ben %s és %s forrással"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Általános beállítások"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -301,47 +365,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 és IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "csak IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "csak IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Bemenet"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Belső IP cím"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Belső port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Belső zóna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Napló üzenetek korlátozása"
 
@@ -355,24 +423,24 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "MSS clamping engegélyezése"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Álcázás"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Szűrés"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Szűrés ICMP típus alapján"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -380,18 +448,18 @@ msgstr ""
 "Adott portra vagy port tartományra irányított bejövő forgalom szűrése ezen a "
 "gépen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -425,21 +493,21 @@ msgstr "Új port továbbítás"
 msgid "New source NAT"
 msgstr "Új forrás NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "Csak a megadott IP címre irányított bejövő forgalmat egyeztesse."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Csak a megadott MAC címekről érkező bejövő forgalmat egyeztesse."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 "Csak a megadott IP címről illetve IP címtartományból érkező bejövő forgalmat "
 "egyeztesse."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -456,27 +524,32 @@ msgstr "Port megnyitása a routeren"
 msgid "Other..."
 msgstr "Egyéb..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Kimenet"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr ""
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 "További argumentumok küldése az iptables részére. Használja körültekintően!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Port továbbítás"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -485,38 +558,44 @@ msgstr ""
 "privát helyi hálózat bizonyos számítógépéhez vagy szolgáltatásához történő "
 "csatlakozását."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protokoll"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr "Átirányítja az egyező bejövő forgalmat a belső gép megadott portjához"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Átirányítja az egyező bejövő forgalmat a megadott belső géphez"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -524,20 +603,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "Álcázás korlátozása a megadott cél alhálózatokra"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "Álcázás korlátozása a megadott forrás alhálózatokra"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Korlátozás cím családra"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -549,64 +628,64 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Forrás IP cím"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Forrás MAC cím"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Forrás cím"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Forrás port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Forrás zóna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -614,8 +693,8 @@ msgstr ""
 "A tűzfal zónákat határoz meg a hálózati interfészek fölött a hálózati "
 "forgalom áramlásának szabályozására."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -632,7 +711,7 @@ msgstr ""
 "LAN-ból WAN-ba <em>nem</em> jelenti azt, hogy a továbbítás WAN-ból LAN-ba is "
 "engedélyezett."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 #, fuzzy
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
@@ -648,31 +727,31 @@ msgstr ""
 "<em>lefedett hálózatok</em> adják meg, hogy mely elérhető hálózatok tagjai "
 "ennek a zónának."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "%s-re %s-nél a <var>eszközön</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "%s-re %s-ben"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "%s-re a <var>eszközön</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "%s-re, %s %s-ben"
 
@@ -684,12 +763,12 @@ msgstr "Forrás IP-re"
 msgid "To source port"
 msgstr "Forrás portra"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Forgalmi szabályok"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -699,109 +778,121 @@ msgstr ""
 "házirendet határozzák meg, például bizonyos gépek közötti forgalom "
 "megakadályozához vagy WAN portok megnyitásához a routeren."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "%s-en át"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "%s-en át %s-nél"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Zóna ⇒ Továbbítások"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zónák"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "elfogadás"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "bármelyik"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "bármelyik gép"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "bármelyik router IP"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "bármelyik zóna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "ne kövesse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "eldobás"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -823,13 +914,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "visszautasítás"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
@@ -856,9 +947,6 @@ msgstr ""
 #~ msgid "Destination IP address"
 #~ msgstr "Cél IP-cím"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "Zónák-közötti továbbítás"
 
diff --git a/applications/luci-app-firewall/po/it/firewall.po b/applications/luci-app-firewall/po/it/firewall.po
index 731a806a5c..5247eea37b 100644
--- a/applications/luci-app-firewall/po/it/firewall.po
+++ b/applications/luci-app-firewall/po/it/firewall.po
@@ -13,50 +13,50 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 "X-Generator: Pootle 2.0.4\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s con %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> e limita a %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Azione"
 
@@ -72,33 +72,75 @@ msgstr "Aggiungi"
 msgid "Add and edit..."
 msgstr "Aggiungi e modifica..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Opzioni Avanzate"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Permetti routing da <em>zone di origine</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Permetti rounting a <em>zone di destinazione</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Qualsiasi"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Reti coperte"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Regole Personalizzate"
@@ -114,15 +156,15 @@ msgstr ""
 "comandi sono eseguiti dopo ogni riavvio del firewall, giusto dopo le altre "
 "regole che sono state caricate."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Indirizzo di destinazione"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Porta di destinazione"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -132,72 +174,82 @@ msgstr "Zona di destinazione"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Non riscrivere"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Scarta pacchetti invalidi"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Attiva"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "Attiva NAT Loopback"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Attiva protezione SYN-flood"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Attiva registro su questa zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Indirizzo IP Esterno"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -207,11 +259,23 @@ msgstr "Porta Esterna"
 msgid "External zone"
 msgstr "Zona Esterna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Comandi extra"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Firewall"
@@ -220,71 +284,71 @@ msgstr "Firewall"
 msgid "Firewall - Custom Rules"
 msgstr "Firewall - Regole Personalizzate"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Firewall - Inoltro Porte"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Firewall - Regole Traffico"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Firewall - Opzioni delle Zone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Forza tracciamento connessione"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Inoltra"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Inoltra a"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr "Venerdì"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "Da %s a %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "Da %s a %s con sorgente %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "Da %s a %s con sorgente %s e %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Opzioni Generali"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -303,47 +367,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 e IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "Solo IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "Solo IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Ingresso"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Indirizzo IP interno"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Porta interna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Zona Interna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Limita messaggi del registro"
 
@@ -357,24 +425,24 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Corrispondenza"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Corrispondenza tipo ICMP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -382,18 +450,18 @@ msgstr ""
 "Corrispondi traffico in entrata diretto alla porta o intervallo di porte "
 "dato su questo host"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr "Lunedì"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr "Giorni del Mese"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -427,19 +495,19 @@ msgstr "Nuova porta di inoltro"
 msgid "New source NAT"
 msgstr "Nuova sorgente NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "Corrispondi solo traffico in entrata diretto al dato indirizzo IP."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Corrispondi solo traffico in entrata da questi MAC."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "Corrispondi solo traffico in entrata da questo IP o intervallo."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -456,26 +524,31 @@ msgstr "Porte aperte sul router"
 msgid "Other..."
 msgstr "Altri..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr ""
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr "Passa comandi addizionali a iptables. Usare con cura!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Inoltri Porta"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -483,38 +556,44 @@ msgstr ""
 "L'inoltro delle porte permette ai computer in remoto su Internet di "
 "connettersi a uno specifico computer o servizio presente nella LAN privata"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protocollo"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr "Reindirizza il traffico in entrata alla porta data su host interno"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Reindirizza il traffico in entrata allo specifico host interno"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -522,20 +601,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr "Riavvia Firewall"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "Limita il Masquerading alle subnet di destinazione date"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "Limita il Masquerading alle subnet sorgente date"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Limita agli indirizzi famiglia"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -547,15 +626,15 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr "Sabato"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
@@ -580,52 +659,52 @@ msgstr ""
 # msgstr ""
 # msgid "Protocol"
 # msgstr ""
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Indirizzo IP di origine"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Indirizzo MAC di origine"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Indirizzo di origine"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Porta di origine"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Zona di origine"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr "Data di Inizio (yyyy-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr "Data di Stop (yyyy-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr "Domenica"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -633,8 +712,8 @@ msgstr ""
 "Il firewall crea delle zone nelle tue interfacce di rete per controllare il "
 "flusso del traffico."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -651,7 +730,7 @@ msgstr ""
 "alla wan <em>non</em> implica anche un permesso da inoltrare dalla wan alla "
 "lan."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -666,31 +745,31 @@ msgstr ""
 "differenti nella zona. Le <em>reti coperte</em> specificano quali reti "
 "disponibili sono membri di questa zona."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr "Giovedì"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr "Orario in UTC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "Verso %s a %s su <var>questo dispositivo</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "Verso %s in %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "Verso %s su <var>questo dispositivo</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "Verso %s, %s in %s"
 
@@ -702,12 +781,12 @@ msgstr "Verso IP sorgente"
 msgid "To source port"
 msgstr "Verso la porta sorgente"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Regole di Traffico"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -717,109 +796,121 @@ msgstr ""
 "tra zone differenti, per esempio per rifiutare il traffico tra certi host o "
 "per aprire porte WAN sul router."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr "Martedì"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "Via %s a %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr "Mercoledì"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr "Giorni della Settimana"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Zona ⇒ Inoltri"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "accetta"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "qualsiasi"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "qualsiasi host"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "qualsiasi router IP"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "qualsiasi zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "non tracciare"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "scarta"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -841,13 +932,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "rifiuta"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
diff --git a/applications/luci-app-firewall/po/ja/firewall.po b/applications/luci-app-firewall/po/ja/firewall.po
index d665dd0be9..aea3efde5e 100644
--- a/applications/luci-app-firewall/po/ja/firewall.po
+++ b/applications/luci-app-firewall/po/ja/firewall.po
@@ -13,51 +13,51 @@ msgstr ""
 "X-Generator: Poedit 2.2.3\n"
 "Language-Team: \n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s (%s)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s ,%s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s (%s)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> パケット / <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 "<var>%d</var> パケット / <var>%s</var>, バースト <var>%d</var> パケット"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var>, %s を上限に設定"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr "転送を許可"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr "入力を許可"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr "出力を許可"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "動作"
 
@@ -73,33 +73,75 @@ msgstr "追加"
 msgid "Add and edit..."
 msgstr "追加及び編集..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "詳細設定"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "<em>送信元ゾーン</em>からの転送を許可する:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "<em>宛先ゾーン</em>への転送を許可する:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "全て"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr "全日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "対象ネットワーク"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "手動設定ルール"
@@ -115,15 +157,15 @@ msgstr ""
 "ドは、ファイアウォール機能の起動ごとに、標準のルールが読み込まれた後に実行さ"
 "れます。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "宛先アドレス"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "宛先ポート"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -133,72 +175,82 @@ msgstr "宛先ゾーン"
 msgid "Disable"
 msgstr "無効"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr "転送を破棄"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr "入力を破棄"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr "出力を破棄"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "リライトしない"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr "転送を追跡しない"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr "入力を追跡しない"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr "出力を追跡しない"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "無効なパケットを遮断する"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "有効"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "NATループバックを有効にする"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "SYN-Floodプロテクションを有効にする"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "このゾーンのログ記録を有効にする"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr "実験的な機能です。 QoS/SQM との完全な互換性はありません。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "外部IPアドレス"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -208,11 +260,23 @@ msgstr "外部ポート"
 msgid "External zone"
 msgstr "外部ゾーン"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "追加設定"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "ファイアウォール"
@@ -221,71 +285,71 @@ msgstr "ファイアウォール"
 msgid "Firewall - Custom Rules"
 msgstr "ファイアウォール - 手動設定ルール"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "ファイアウォール - ポートフォワーディング"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "ファイアウォール - トラフィック・ルール"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "ファイアウォール - ゾーン設定"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "強制的にコネクション追跡を行う"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "転送"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "転送先"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr "金曜日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "送信元 %s (%s)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "送信元 %s (%s) , %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "送信元 %s (%s) , %s, %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr "送信元 %s (<var>デバイス</var>)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr "送信元 %s, %s (<var>デバイス</var>)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr "送信元 %s, %s, %s (<var>デバイス</var>)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "一般設定"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr "ハードウェア フローオフロード"
 
@@ -304,47 +368,51 @@ msgstr "IP の範囲"
 msgid "IPs"
 msgstr "IP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4及びIPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "IPv4のみ"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "IPv6のみ"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "受信"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "内部IPアドレス"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "内部ポート"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "内部ゾーン"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "ログメッセージを制限"
 
@@ -358,24 +426,24 @@ msgstr "MAC"
 msgid "MACs"
 msgstr "MAC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "MSSクランプ"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "マスカレード"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "対象"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "ICMPタイプの一致"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -383,18 +451,18 @@ msgstr ""
 "設定された宛先ポート(またはポート範囲)に一致した受信トラフィックが対象になり"
 "ます"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr "月曜日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr "月間"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -428,21 +496,21 @@ msgstr "転送設定の新規作成"
 msgid "New source NAT"
 msgstr "SNATルールの新規作成"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "設定された宛先IPアドレスと一致した受信トラフィックが対象になります。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "設定されたMACアドレスと一致した受信したトラフィックが対象になります。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 "設定されたIPアドレス (または範囲) と一致した受信したトラフィックが対象になり"
 "ます。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -459,28 +527,33 @@ msgstr "ポートの開放"
 msgid "Other..."
 msgstr "その他のプロトコル"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "送信"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr "出力ゾーン"
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 "iptablesにパススルーする追加の引数を設定してください。ただし、注意して設定し"
 "てください!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "ポートフォワーディング"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -489,39 +562,45 @@ msgstr ""
 "ベートなネットワーク上の、特定のコンピュータやサービスへのアクセスを可能にし"
 "ます。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "プロトコル"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "ルールに一致した受信トラフィックを、内部ホストの設定されたポートへ転送します"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "ルールに一致した受信トラフィックを、設定された内部ホストへ転送します"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr "転送を拒否"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr "入力を拒否"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr "出力を拒否"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 "ハードウェア NAT サポートが必要です。 mt7621 のみにおいて実装されています。"
@@ -530,20 +609,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr "ファイアウォールの再起動"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "設定された宛先サブネットへのマスカレードを制限する"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "設定された送信元サブネットへのマスカレードを制限する"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "アドレスファミリの制限"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr "ルーティング/NAT オフロード"
 
@@ -555,15 +634,15 @@ msgstr "ルールは無効です"
 msgid "Rule is enabled"
 msgstr "ルールは有効です"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr "土曜日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr "ルーティング/NAT のための、ソフトウェアベースのオフロードです。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr "ソフトウェア フローオフロード"
 
@@ -597,52 +676,52 @@ msgstr "ソフトウェア フローオフロード"
 # msgid "Protocol"
 # msgstr ""
 #
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "送信元IPアドレス"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "送信元MACアドレス"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "送信元アドレス"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "送信元ポート"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "送信元ゾーン"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr "開始日 (yyyy-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr "開始時刻 (hh.mm.ss)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr "停止日 (yyyy-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr "停止時刻 (hh.mm.ss)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr "日曜日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -650,8 +729,8 @@ msgstr ""
 "ファイアウォール機能は、各ネットワークインターフェース上にゾーンを作成してト"
 "ラフィックの制御を行います。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -667,7 +746,7 @@ msgstr ""
 "向</em>であり、例えばlanからwanへの転送設定は、wanからlanへの転送を<em>許可し"
 "ません。</em>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -681,31 +760,31 @@ msgstr ""
 "準のポリシーになります。<em>対象ネットワーク</em>は、どのネットワーク設定がこ"
 "のゾーンに属するかを設定します。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr "木曜日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr "時間制限"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr "UTC時刻を使用"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "宛先 %s, %s (<var>デバイス</var>)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "宛先 %s (%s)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "宛先 %s (<var>デバイス</var>)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "宛先 %s, %s (%s)"
 
@@ -717,12 +796,12 @@ msgstr "変換後送信元IP"
 msgid "To source port"
 msgstr "変換後送信元ポート"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "トラフィック・ルール"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -732,109 +811,121 @@ msgstr ""
 "します。例えば、特定のホスト間や、ルーターのWANポートへのトラフィックの拒否を"
 "設定することができます。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr "火曜日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr "名称未設定の転送"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr "名称未設定のルール"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr "名称未設定のゾーン"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "経由 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "経由 %s , %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr "水曜日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr "曜日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "ゾーン ⇒ 転送"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "ゾーン"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "許可"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "全て"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "全てのホスト"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "全てのルーターIP"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "全てのゾーン"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr "日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "コネクション追跡を行わない"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "破棄"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr "時間"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr "分"
@@ -856,13 +947,13 @@ msgstr "ポート"
 msgid "ports"
 msgstr "ポート"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "拒否"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr "秒"
@@ -876,3 +967,6 @@ msgstr "タイプ"
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:130
 msgid "types"
 msgstr "タイプ"
+
+#~ msgid "Output zone"
+#~ msgstr "出力ゾーン"
diff --git a/applications/luci-app-firewall/po/ko/firewall.po b/applications/luci-app-firewall/po/ko/firewall.po
index 757b50b50a..2346b95566 100644
--- a/applications/luci-app-firewall/po/ko/firewall.po
+++ b/applications/luci-app-firewall/po/ko/firewall.po
@@ -13,50 +13,50 @@ msgstr ""
 "Plural-Forms: nplurals=1; plural=0;\n"
 "X-Generator: Pootle 2.0.6\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s ,%s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr ""
 
@@ -72,33 +72,75 @@ msgstr ""
 msgid "Add and edit..."
 msgstr "추가 후 수정..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "<em>Source zone</em> 로부터의 forward 허용:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "<em>Destination zone</em> 으로 forward 허용:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Custom Rule"
@@ -113,15 +155,15 @@ msgstr ""
 "수 있도록 합니다.  입력된 명령어들은 매 방화벽 재시작시 실행되는데 default "
 "ruleset 이 load 된 후 시점입니다."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Destination 주소"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -131,72 +173,82 @@ msgstr ""
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "활성화"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "NAT Loopback 활성화"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "SYN-flood protection 활성화"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "zone 의 logging 활성화"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "외부 IP 주소"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -206,11 +258,23 @@ msgstr "외부 port"
 msgid "External zone"
 msgstr "외부 zone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "추가 argument"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "방화벽"
@@ -219,71 +283,71 @@ msgstr "방화벽"
 msgid "Firewall - Custom Rules"
 msgstr "방화벽 - Custom Rules"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "방화벽 - Port Forwards"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "방화벽 - Traffic Rules"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "방화벽 - Zone 설정"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr "금요일"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -302,47 +366,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "내부 IP 주소"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "내부 port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "내부 zone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr ""
 
@@ -356,41 +424,41 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr "월요일"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -424,19 +492,19 @@ msgstr "새로운 port forward"
 msgid "New source NAT"
 msgstr "새로운 source NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -451,26 +519,31 @@ msgstr ""
 msgid "Other..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr ""
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr "iptables 명령에 추가 인자들을 더합니다.  조심해 사용하세요!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Port Forward"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -478,38 +551,44 @@ msgstr ""
 "Port forwarding 기능은 인터넷 상의 원격 컴퓨터가 내부 LAN 에 속한 특정 컴퓨터"
 "나 서비스에 접속할 수 있도록 합니다."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -517,20 +596,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "주어진 destination subnet 으로 Masquerading 제한"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "주어진 source subnet 으로 Masquerading 제한"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Address family 제한"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -542,64 +621,64 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr "토요일"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Source IP 주소"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Source MAC 주소"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Source 주소"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr "시작 날짜 (yyyy-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr "종료 날짜 (yyyy-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr "일요일"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -607,8 +686,8 @@ msgstr ""
 "방화벽 기능을 이용하여 네트워크 인터페이스와 연결된 zone 을 생성할 수 있고 이"
 "를 이용하여 네트워크 traffic flow 를 제어할 수 있습니다."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -624,7 +703,7 @@ msgstr ""
 "<em>unidirectional</em> 인데, 예를 들어 LAN 에서 WAN 으로의 forward 규칙이 "
 "WAN 에서 LAN 으로의 forward 를 허락하는 것이 아닙니다."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 #, fuzzy
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
@@ -639,31 +718,31 @@ msgstr ""
 "를 오가는 forward traffic 에 대한 정책을 뜻합니다. <em>Covered networks</em> "
 "에서는 zone 의 영향을 받을 네트워크들을 지정할 수 있습니다."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr "목요일"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr "UTC 기준시"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr ""
 
@@ -675,12 +754,12 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Traffic Rule"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -690,109 +769,121 @@ msgstr ""
 "다. 예를 들어 특정 host 들 사이의 트래픽을 차단하거나 공유기의 WAN port 를 "
 "open 할때 사용됩니다."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr "화요일"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr "수요일"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr "주일"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zone 내역"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -814,13 +905,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
diff --git a/applications/luci-app-firewall/po/ms/firewall.po b/applications/luci-app-firewall/po/ms/firewall.po
index 69ed9fe8c4..cab21a0ffa 100644
--- a/applications/luci-app-firewall/po/ms/firewall.po
+++ b/applications/luci-app-firewall/po/ms/firewall.po
@@ -7,50 +7,50 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr ""
 
@@ -66,33 +66,75 @@ msgstr ""
 msgid "Add and edit..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr ""
@@ -104,15 +146,15 @@ msgid ""
 "each firewall restart, right after the default ruleset has been loaded."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -122,72 +164,82 @@ msgstr ""
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -197,11 +249,23 @@ msgstr ""
 msgid "External zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr ""
@@ -210,71 +274,71 @@ msgstr ""
 msgid "Firewall - Custom Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -293,47 +357,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr ""
 
@@ -347,41 +415,41 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -415,19 +483,19 @@ msgstr ""
 msgid "New source NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -442,63 +510,74 @@ msgstr ""
 msgid "Other..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
-msgid "Passes additional arguments to iptables. Use with care!"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -506,20 +585,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -531,71 +610,71 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -605,7 +684,7 @@ msgid ""
 "<em>not</em> imply a permission to forward from wan to lan as well."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -614,31 +693,31 @@ msgid ""
 "networks</em> specifies which available networks are members of this zone."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr ""
 
@@ -650,121 +729,133 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
 "the router."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -786,13 +877,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
diff --git a/applications/luci-app-firewall/po/no/firewall.po b/applications/luci-app-firewall/po/no/firewall.po
index ca2b80b768..91c01a4e92 100644
--- a/applications/luci-app-firewall/po/no/firewall.po
+++ b/applications/luci-app-firewall/po/no/firewall.po
@@ -8,50 +8,50 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 "X-Generator: Pootle 2.0.6\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s i %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s med %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s i %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> pakker per <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr "<var>%d</var> pakker per <var>%s</var>, burst <var>%d</var>pakker."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> og begrens til %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Handling"
 
@@ -67,33 +67,75 @@ msgstr "Legg til"
 msgid "Add and edit..."
 msgstr "Legg til og redigere..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Avanserte Innstillinger"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Tillat videresending fra <em>kilde soner</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Tillat videresending til <em>destinasjon soner</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Enhver"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Gjeldene nettverk"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Egendefinerte Regler"
@@ -108,15 +150,15 @@ msgstr ""
 "som ikke dekkes av brannmurens standardoppsett. Kommandoene utføres etter "
 "hver omstart av brannmuren, rett etter at standard regelsett er lastet."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Destinasjon adresse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Destinasjon port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -126,72 +168,82 @@ msgstr "Destinasjon sone"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Ikke omskriv"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Forkast ugyldige pakker"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Aktiver"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "Aktiver NAT <abbr title=\"Loopback\">Tilbakekobling</abbr>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Aktiver SYN-flood beskyttelse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Aktiver logging av denne sonen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Ekstern IP adressse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -201,11 +253,23 @@ msgstr "Ekstern port"
 msgid "External zone"
 msgstr "Ekstern sone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Ekstra argumenter"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Brannmur"
@@ -214,72 +278,72 @@ msgstr "Brannmur"
 msgid "Firewall - Custom Rules"
 msgstr "Brannmur - Egendefinerte Regler"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Brannmur - Port Videresending"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Brannmur - Trafikk Regler"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Brannmur - Sone Innstillinger"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr ""
 "Bruk <abbr title=\\\"connection tracking\\\">forbindelse sporing</abbr>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Videresend"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Videresend til"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "Fra %s i %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "Fra %s i %s med kilde %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "Fra %s i %s med kilde %s og %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Generelle Innstillinger"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -298,47 +362,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 og IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "Kun IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "Kun IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Inndata"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Intern IP adresse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Intern port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Intern sone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Begrens logging"
 
@@ -352,24 +420,24 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "MSS Kontroll (Clamping)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Masquerading"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Match"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Match ICMP type"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -377,18 +445,18 @@ msgstr ""
 "Match innkommende trafikk rettet mot den oppgitte destinasjonsport eller "
 "portområdet på denne verten"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -422,19 +490,19 @@ msgstr "Ny port videresending"
 msgid "New source NAT"
 msgstr "Ny kilde NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "Match kun innkommende trafikk rettet mot den oppgitt IP adresse."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Match kun innkommende trafikk fra disse MAC adresser."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "Match kun innkommende trafikk fra denne IP eller IP område."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -451,26 +519,31 @@ msgstr "Åpne porter på ruteren"
 msgid "Other..."
 msgstr "Andre..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Utdata"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr ""
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr "Sender flere argumenter til iptables. Bruk med forsiktighet!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Port Videresendinger"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -478,40 +551,46 @@ msgstr ""
 "Port videresending tillater at eksterne datamaskiner på Internett kan koble "
 "seg til en bestemt maskin eller tjeneste innenfor det private LAN."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protokoll"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "Viderekoble matchet innkommende trafikk til den oppgitte porten på intern "
 "vert"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Viderekoble matchet innkommende trafikk til den angitte interne vert"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -519,20 +598,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "Begrens Masquerading til oppgitt destinasjons subnett"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "Begrens Masqeuerading til oppgitt kilde subnett"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Begrens til adresse familie"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -544,64 +623,64 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Kilde IP adresse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Kilde MAC adresse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Kilde adresse"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Kilde port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Kilde sone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -609,8 +688,8 @@ msgstr ""
 "Brannmuren skaper soner over nettverkets grensesnitt for å styre "
 "nettverkstrafikken."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -626,7 +705,7 @@ msgstr ""
 "ved videresending er <em>enveis</em>, d.v.s at videresending fra LAN til WAN "
 "<em>ikke</em> automatisk også tillater videresending fra WAN til LAN."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 #, fuzzy
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
@@ -642,31 +721,31 @@ msgstr ""
 "spesifiserer hvilken av de tilgjengelige nettverk som er medlem av denne "
 "sone."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "Til %s på %s på <var>denne enheten</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "Til %s i %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "Til %s på <var>denne enheten</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "Til %s, %s i %s"
 
@@ -678,12 +757,12 @@ msgstr "Til kilde IP"
 msgid "To source port"
 msgstr "Til kilde port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Trafikk Regler"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -693,109 +772,121 @@ msgstr ""
 "for eksempel for å avvise trafikk mellom visse verter eller for å åpne WAN "
 "porter på ruteren."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "Via %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "Via %s på %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Sone = Videresendinger"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Soner"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "godta"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "enhver"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "enhver vert"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "enhver ruter IP"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "enhver sone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "ikke track"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "forkast"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -817,13 +908,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "avslå"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
@@ -850,9 +941,6 @@ msgstr ""
 #~ msgid "Destination IP address"
 #~ msgstr "Destinasjon IP adresse"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "Sone til Sone Videresending"
 
diff --git a/applications/luci-app-firewall/po/pl/firewall.po b/applications/luci-app-firewall/po/pl/firewall.po
index a1107393fa..94b6e924f8 100644
--- a/applications/luci-app-firewall/po/pl/firewall.po
+++ b/applications/luci-app-firewall/po/pl/firewall.po
@@ -14,51 +14,51 @@ msgstr ""
 "|| n%100>=20) ? 1 : 2);\n"
 "X-Generator: Pootle 2.0.6\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s w %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s z %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s w %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> pakiet. na <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 "<var>%d</var> pakiet. na <var>%s</var>, popsutych <var>%d</var> pakiet."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> i ograniczone do %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Działanie"
 
@@ -74,33 +74,75 @@ msgstr "Dodaj"
 msgid "Add and edit..."
 msgstr "Dodaj i edytuj..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Ustawienia zaawansowane"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Zezwól na przekazywanie z <em>source zones</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Zezwól na przekazywanie do <em>destination zones</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Każdy"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Objęte sieci"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Własne reguły"
@@ -115,15 +157,15 @@ msgstr ""
 "są objęte składnią zapory. Polecenia wykonywane są po każdym restarcie "
 "zapory, zaraz po załadowaniu zestawu reguł domyślnych."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Adres docelowy"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Port docelowy"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -133,72 +175,82 @@ msgstr "Strefa docelowa"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Nie przepisuj"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Porzuć wadliwe pakiety"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Włącz"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "Włącz NAT Loopback"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Włącz ochronę przed atakiem SYN-flood"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Włącz logowanie na tej strefy"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Zewnętrzne adresy IP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -208,11 +260,23 @@ msgstr "Port zewnętrzny"
 msgid "External zone"
 msgstr "Strefa zewnętrzna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Dodatkowe argumenty"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 # Generated from applications/luci-fw/luasrc/model/cbi/luci_fw/zones.lua      #
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
@@ -224,71 +288,71 @@ msgstr "Zapora"
 msgid "Firewall - Custom Rules"
 msgstr "Zapora - Reguły własne"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Zapora - Przekazywanie portów"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Zapora - Reguły ruchu"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Zapora - Ustawienia strefy"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Wymuś śledzenie połączeń"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Przekazuj"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Przekazuj do"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "Z %s w %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "Z %s w %s ze źródłem %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "Z %s w %s ze źródłem %s i %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Ustawienia ogólne"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -307,47 +371,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 i IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "Tylko IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "Tylko IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Ruch przychodzący"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Wewnętrzny adres IP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Wewnętrzny port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Strefa wewnętrzna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Ograniczenie logowania"
 
@@ -361,24 +429,24 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "Dostosuj MSS"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Maskarada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Dopasuj"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Dopasuj typ ICMP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -386,18 +454,18 @@ msgstr ""
 "Dopasuj ruch przychodzący do danego portu docelowego lub zakresu portów na "
 "tym hoście"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -431,19 +499,19 @@ msgstr "Nowe przekierowanie portu"
 msgid "New source NAT"
 msgstr "Nowy NAT źródłowy"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "Dopasuj tylko przychodzący ruch skierowany do danego adresu IP."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Dopasuj tylko ruch z tych adresów MAC."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "Dopasuj tylko ruch przychodzący z tego adresu IP lub zakresu adresów."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -460,27 +528,32 @@ msgstr "Otwarte porty na routerze"
 msgid "Other..."
 msgstr "Inne..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Wyjście (Output)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr ""
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 "Przekazuje dodatkowe argumenty do iptables. Zachowaj szczególną ostrożność!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Przekierowania portów"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -488,40 +561,46 @@ msgstr ""
 "Przekierowanie portów pozwala komputerom z internetu na połączenia z "
 "komputerami z sieci LAN."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protokół"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "Przekieruj ruch przychodzący na podany port do wskazanego hosta w sieci "
 "wewnętrznej"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Przekieruj ruch przychodzący do wskazanego hosta w sieci wewnętrznej"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -529,22 +608,22 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "Ogranicz maskaradę do wskazanych sieci docelowych"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "Ogranicz maskaradę do wskazanych sieci źródłowych"
 
 # Wstawiłem rodzinę gdyż gdzieś wcześniej było tak opisane ale klasa pasuje mi tu bardziej.
 # Obsy - niestety ale "rodzina". W gui dotyczy to wyboru IPv4/IPv6, więc "rodzina" a nie klasa.
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Ogranicz do rodziny adresów"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -556,64 +635,64 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Źródłowy adres IP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Źródłowy adres MAC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Adres źródłowy"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Port źródłowy"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Strefa źródłowa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -621,8 +700,8 @@ msgstr ""
 "Firewall tworzy strefy z Twoich interfejsów sieciowych, aby kontrolować ruch "
 "sieciowy."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -638,7 +717,7 @@ msgstr ""
 "przekazywania jest <em>jednokierunkowa</em>, np. przekazywanie z sieci LAN "
 "do WAN <em>nie</em> implikuje pozwolenia na przekazywanie z sieci WAN do LAN."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 #, fuzzy
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
@@ -653,31 +732,31 @@ msgstr ""
 "politykę ruchu przekazywanego pomiędzy różnymi sieciami wewnątrz strefy. "
 "<em>Objęte sieci</em> określają dostępne sieci będące członkami tej strefy."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "Do %s w %s na <var>tym urządzeniu</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "Do %s w %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "Do %s na <var>tym urządzeniu</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "Do %s, %s w %s"
 
@@ -689,12 +768,12 @@ msgstr "Do źródłowego IP"
 msgid "To source port"
 msgstr "Do źródłowego portu"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Reguły ruchu sieciowego"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -704,109 +783,121 @@ msgstr ""
 "między strefami, na przykład aby odrzucać ruch między konkretnymi hostami "
 "albo otworzyć porty WAN routera."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "Przez %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "Przez %s w %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Strefa ⇒ Przekazywanie"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Strefy"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "akceptuj"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "dowolny"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "dowolny host"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "dowolne IP routera"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "dowolna strefa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "nie śledź"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "porzucaj"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -828,13 +919,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "odrzucaj"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
@@ -861,9 +952,6 @@ msgstr ""
 #~ msgid "Destination IP address"
 #~ msgstr "Docelowy adres IP"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "Przekazywanie pomiędzy strefami"
 
diff --git a/applications/luci-app-firewall/po/pt-br/firewall.po b/applications/luci-app-firewall/po/pt-br/firewall.po
index 8778a6bbc5..4f415d7ab8 100644
--- a/applications/luci-app-firewall/po/pt-br/firewall.po
+++ b/applications/luci-app-firewall/po/pt-br/firewall.po
@@ -13,50 +13,50 @@ msgstr ""
 "X-Generator: Poedit 2.1.1\n"
 "Language-Team: \n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s in %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s com %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s em %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> pcts. por <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr "<var>%d</var> pcts. por <var>%s</var>, pico <var>%d</var> pcts."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> e limite a %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr "Aceitar o encaminhamento"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr "Aceitar a entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr "Aceitar a saída"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Ação"
 
@@ -72,33 +72,75 @@ msgstr "Adicionar"
 msgid "Add and edit..."
 msgstr "Adicionar e editar..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Configurações Avançadas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Permite o encaminhamento da <em>zona de origem</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Permite o encaminhamento para a <em>zona de destino</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Qualquer"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Redes cobertas"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Regras Personalizadas"
@@ -113,15 +155,15 @@ msgstr ""
 "cobertos por esta ferramenta. Os comandos serão executados após cada "
 "reinício do firewall, logo após a carga do conjunto de regras padrão."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Endereço de destino"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Porta de destino"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -131,73 +173,83 @@ msgstr "Zona de destino"
 msgid "Disable"
 msgstr "Desabilitar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr "Descartar o encaminhamento"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr "Descartar a entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr "Descartar a saída"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Não sobrescreva"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr "Não rastrear o encaminhamento"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr "Não rastrear a entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr "Não rastrear a saída"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Descartar pacotes inválidos"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Habilitar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "Habilite o Loopback do NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Habilite proteção contra SYN-flood"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Habilite o registro nesta zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 "Funcionalidade experimental. Ela não é totalmente compatível com QoS/SQM."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Endereço IP externo"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -207,11 +259,23 @@ msgstr "Porta Externa"
 msgid "External zone"
 msgstr "Zona externa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Argumentos extras"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Firewall"
@@ -220,71 +284,71 @@ msgstr "Firewall"
 msgid "Firewall - Custom Rules"
 msgstr "Firewall - Regras personalizadas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Firewall - Encaminhamento de Portas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Firewall - Regras de Tráfego"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Firewall - Configurações de Zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Force o rastreamento da conexão"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Encaminhar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Encaminhar para"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr "Sexta-feira"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "Vindo de %s em %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "Vindo de %s em %s com origem %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "Vindo de %s em %s com origem %s e %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr "De %s <var>neste dispositivo</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr "De %s <var>neste dispositivo</var> com origem %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr "De %s <var>neste dispositivo</var> com origem %s e %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Configurações Gerais"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr "Aceleração de fluxo de dados via Hardware"
 
@@ -303,47 +367,51 @@ msgstr "Faixa IP"
 msgid "IPs"
 msgstr "IPs"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 e IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "Somente IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "Somente IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Endereço IP interno"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Porta Interna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Zona interna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Limita as mensagens de registro"
 
@@ -357,24 +425,24 @@ msgstr "MAC"
 msgid "MACs"
 msgstr "MACs"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "Ajuste do MSS"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Mascaramento"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Casa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Casa com ICMP tipo"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -382,18 +450,18 @@ msgstr ""
 "Casa o tráfego entrante direcionado para uma porta ou faixa de portas de "
 "destino específica neste computador"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr "Segunda-Feira"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr "Dias do mês"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -427,20 +495,20 @@ msgstr "Novo encaminhamento de porta"
 msgid "New source NAT"
 msgstr "Nova origem NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 "Somente case o tráfego entrante direcionado para o endereço IP fornecido."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Somente case o tráfego entrante destes endereços MAC."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "Somente case o tráfego entrante desta faixa de endereços IP."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -457,26 +525,31 @@ msgstr "Abrir portas no roteador"
 msgid "Other..."
 msgstr "Outro..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Saída"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr "Zona de saída"
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr "Passa argumentos adicionais para o iptables. Use com cuidado!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Encaminhamentos de Porta"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -484,39 +557,45 @@ msgstr ""
 "O encaminhamento de portas permite que computadores remotos na Internet "
 "conectem a um computador ou serviço específico dentro da rede local privada."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protocolo"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "Redireciona tráfego entrante para a porta especificada no computador interno"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Redireciona tráfego entrante para o computador interno especificado"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr "Recusar encaminhamento"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr "Recusar entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr "Recusar saída"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr "Requer suporte de NAT em hardware. Implementado ao menos para mt7621"
 
@@ -524,20 +603,20 @@ msgstr "Requer suporte de NAT em hardware. Implementado ao menos para mt7621"
 msgid "Restart Firewall"
 msgstr "Reiniciar o Firewall"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "Restringe o mascaramento para uma subrede de destino específica"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "Restringe o mascaramento para uma subrede de origem específica"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Restringe para uma família de endereços"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr "Aceleração de Roteamento/NAT"
 
@@ -549,64 +628,64 @@ msgstr "A regra está desabilitada"
 msgid "Rule is enabled"
 msgstr "A regra está habilitada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr "Sábado"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr "Aceleração de roteamento/NAT baseada em Software"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr "Aceleração de fluxo de dados via Software"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Endereço IP de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Endereço MAC de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Endereço de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Porta de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Zona de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr "Dia inicial (aaaa-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr "Dia final (aaaa-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr "Domingo"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -614,8 +693,8 @@ msgstr ""
 "O firewall cria zonas sobre as interfaces de rede para controlar o fluxo do "
 "tráfego de rede."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -631,7 +710,7 @@ msgstr ""
 "encaminhamento é <em>unidirecional</em>, ex: um encaminhamento da LAN para "
 "WAN <em>não</em> implica na permissão de encaminhar da WAN para LAN."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -646,31 +725,31 @@ msgstr ""
 "<em>Redes Cobertas</em> especificam que redes disponíveis são membros desta "
 "zona."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr "Quita-feira"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr "Hora em UTC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "Para %s em %s <var>neste dispositivo</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "Para %s em %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "Para %s <var>neste dispositivo</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "Para %s, %s em %s"
 
@@ -682,12 +761,12 @@ msgstr "Para o endereço IP de origem"
 msgid "To source port"
 msgstr "Para a porta de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Regras de tráfego"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -697,109 +776,121 @@ msgstr ""
 "diferentes zonas. Por exemplo, rejeitar o tráfego entre certos equipamentos "
 "ou abrir portas WAN no roteador."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr "Terça-feira"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr "Encaminhamento sem nome"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr "Regra sem nome"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "Via %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "Via %s at %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr "Quarta-feira"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr "Dias da semana"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Zona ⇒ Encaminhamentos"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zonas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "aceitar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "qualquer"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "qualquer equipamento"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "qualquer endereço IP do roteador"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "qualquer zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr "dia"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "não rastrear"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "descartar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr "hora"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr "minuto"
@@ -821,13 +912,13 @@ msgstr "porta"
 msgid "ports"
 msgstr "portas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "rejeitar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr "segundo"
@@ -842,6 +933,9 @@ msgstr "tipo"
 msgid "types"
 msgstr "tipos"
 
+#~ msgid "Output zone"
+#~ msgstr "Zona de saída"
+
 #~ msgid "(Unnamed Entry)"
 #~ msgstr "(Entrada Sem Nome)"
 
@@ -854,9 +948,6 @@ msgstr "tipos"
 #~ msgid "Destination IP address"
 #~ msgstr "Endereço IP de destino"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "Encaminhamento entre Zonas"
 
diff --git a/applications/luci-app-firewall/po/pt/firewall.po b/applications/luci-app-firewall/po/pt/firewall.po
index 52205f66f3..8dde627c0a 100644
--- a/applications/luci-app-firewall/po/pt/firewall.po
+++ b/applications/luci-app-firewall/po/pt/firewall.po
@@ -13,50 +13,50 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 "X-Generator: Pootle 2.0.6\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s em %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s with %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s em %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> pkts. por <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Acção"
 
@@ -72,33 +72,75 @@ msgstr "Adicionar"
 msgid "Add and edit..."
 msgstr "Adicionar e editar..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Definições Avançadas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Permitir encaminhamento de <em>zonas de origem</em>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Permitir encaminhamento para <em>zonas de destino</em>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Qualquer"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Redes abrangidas"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Regras Personalizadas"
@@ -114,15 +156,15 @@ msgstr ""
 "comandos são executados a seguir ao reinicio da firewall, logo a seguir ao "
 "conjunto de regras predefinidas serem carregadas."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Endereço de destino"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Porta de destino"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -132,72 +174,82 @@ msgstr "Zona de destino"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Não re-escrever"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Cancelar pacotes inválidos"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Ativar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "Ativar NAT Loopback"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Ativar a Proteção SYN-flood"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Ativar registo nesta zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Endereço IP externo"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -207,11 +259,23 @@ msgstr "Porta externa"
 msgid "External zone"
 msgstr "Zona externa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Argumentos extra"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Firewall"
@@ -220,71 +284,71 @@ msgstr "Firewall"
 msgid "Firewall - Custom Rules"
 msgstr "Firewall - Regras Personalizadas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Firewall - Encaminhamento de Portas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Firewall - Regras de Tráfego"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Firewall - Definições de Zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Forçar rasto de ligação"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Encaminhar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Encaminhar para"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "De %s em %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "De %s em %s com origem %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "De %s em %s com origem %s e %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Definições Gerais"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -303,47 +367,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 e IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "Só IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "Só IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Entrada"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Endereço IP interno"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Porta interna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Zona Interna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Limitar registo de mensagens"
 
@@ -357,25 +425,25 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 #, fuzzy
 msgid "MSS clamping"
 msgstr "MSS-Correction"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Corresponder"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -383,18 +451,18 @@ msgstr ""
 "O tráfego de entrada corresponde a uma dada porta de destino ou intervalo de "
 "portas neste host"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -428,19 +496,19 @@ msgstr "Novo encaminhamento de porta"
 msgid "New source NAT"
 msgstr "Nova origem de NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "Só se tráfego de entrada corresponder ao endereço IP fornecido."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Só se o tráfego de entrada corresponder a um destes MACs."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "Só se o tráfego de entrada corresponder a este IP ou intervalo."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -457,26 +525,31 @@ msgstr "Abrir portas no router"
 msgid "Other..."
 msgstr "Outro..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Saída"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr ""
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr "Passa argumentos adicionais para o iptables. Usar com cuidado!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Encaminhamento de Portas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -484,40 +557,46 @@ msgstr ""
 "O Encaminhamento de Portas permite que computadores remotos na internet se "
 "liguem a um computador ou serviço especifico na rede privada (LAN)."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protocolo"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "Redirecionar a entrada de trafego correspondente à porta fornecida no host "
 "interno"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Redirecionar o tráfego de entrada correspondente para o host interno"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -525,20 +604,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Restringir a família de endereços"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -550,64 +629,64 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Endereço IP de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Endereço MAC de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Endereço de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Porta de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Zona de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -615,8 +694,8 @@ msgstr ""
 "A firewall cria zonas sobre as interfaces de rede para controlar o fluxo do "
 "tráfego."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -626,7 +705,7 @@ msgid ""
 "<em>not</em> imply a permission to forward from wan to lan as well."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -635,31 +714,31 @@ msgid ""
 "networks</em> specifies which available networks are members of this zone."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "Para %s no %s em <var>este dispositivo</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "Para %s em %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "Para %s em <var>este dispositivo</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "Para %s, %s em %s"
 
@@ -671,12 +750,12 @@ msgstr "Para o IP de origem"
 msgid "To source port"
 msgstr "Para a porta de origem"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Regras de Tráfego"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -686,109 +765,121 @@ msgstr ""
 "diferentes zonas, por exemplo, para rejeitar trafego entre certos hosts ou "
 "para abrir portas WAN no router."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "Via %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "Via %s no %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Zona ⇒ Encaminhamentos"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zonas"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "aceitar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "qualquer"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "qualquer host"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "qualquer IP do router"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "qualquer zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "não seguir"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "drop"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -810,13 +901,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "rejeitar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
@@ -843,9 +934,6 @@ msgstr ""
 #~ msgid "Destination IP address"
 #~ msgstr "Endereço IP de destino"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "Encaminhamento Inter-Zona"
 
diff --git a/applications/luci-app-firewall/po/ro/firewall.po b/applications/luci-app-firewall/po/ro/firewall.po
index b25628c7ce..92c8b8a9ac 100644
--- a/applications/luci-app-firewall/po/ro/firewall.po
+++ b/applications/luci-app-firewall/po/ro/firewall.po
@@ -12,50 +12,50 @@ msgstr ""
 "20)) ? 1 : 2);;\n"
 "X-Generator: Pootle 2.0.6\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s în %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s cu %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s în %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Acţiune"
 
@@ -71,33 +71,75 @@ msgstr "Adaugă"
 msgid "Add and edit..."
 msgstr "Adaugă şi editează..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Setări avansate"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Permite trecerea din <em>zonele sursa</em>."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Permite trecerea catre <em>zonele sursa</em>."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Oricare"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Retele acoperite"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Reguli suplimentare"
@@ -109,15 +151,15 @@ msgid ""
 "each firewall restart, right after the default ruleset has been loaded."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Destinaţie adresă"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Portul destinatie"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -127,72 +169,82 @@ msgstr "Zona destinatie"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Nu rescrie"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Descarcă pachetele invalide"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Activează"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "Activează loopback NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Activează protecţia SYN-flood"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Activeaza log in aceasta zona"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Adresă IP externă"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -202,11 +254,23 @@ msgstr "Port extern"
 msgid "External zone"
 msgstr "Zonă externă"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Firewall"
@@ -215,71 +279,71 @@ msgstr "Firewall"
 msgid "Firewall - Custom Rules"
 msgstr "Firewall - Reguli particularizate"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Setari zona la firewall"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Forteaza urmarirea conexiunilor"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Forward"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Setari generale"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -298,47 +362,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 şi IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "doar IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "doar IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Intrare"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Adresa IP interna"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Port intern"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Zonă internă"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Limitează mesaje în log"
 
@@ -352,41 +420,41 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "Ajustare MSS"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Translatare"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Potrivire"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Potriveste pe tipul de ICMP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -420,19 +488,19 @@ msgstr ""
 msgid "New source NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -447,63 +515,74 @@ msgstr ""
 msgid "Other..."
 msgstr "Altele..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Ieşire"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
-msgid "Passes additional arguments to iptables. Use with care!"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protocol"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -511,20 +590,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -536,71 +615,71 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "Sursă adresă IP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "Sursă adresă MAC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Adresa sursa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Port sursa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Zona sursa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -610,7 +689,7 @@ msgid ""
 "<em>not</em> imply a permission to forward from wan to lan as well."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -619,31 +698,31 @@ msgid ""
 "networks</em> specifies which available networks are members of this zone."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr ""
 
@@ -655,121 +734,133 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
 "the router."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zone"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "accept"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "oricare"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -791,13 +882,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
@@ -824,9 +915,6 @@ msgstr ""
 #~ msgid "Destination IP address"
 #~ msgstr "Destinaţie adresă IP"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "Forwardare intre-zone"
 
diff --git a/applications/luci-app-firewall/po/ru/firewall.po b/applications/luci-app-firewall/po/ru/firewall.po
index 63f2073049..9fd25a0158 100644
--- a/applications/luci-app-firewall/po/ru/firewall.po
+++ b/applications/luci-app-firewall/po/ru/firewall.po
@@ -15,50 +15,50 @@ msgstr ""
 "Project-Info: Это технический перевод, не дословный. Главное-удобный русский "
 "интерфейс, все проверялось в графическом режиме, совместим с другими apps\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s в %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s с %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s в %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> пакетов за <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr "<var>%d</var> пакетов за <var>%s</var>, подряд <var>%d</var> пакетов"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> с пределом в %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr "Принимать перенаправляемый трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr "Принимать входящий трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr "Принимать исходящий трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Действие"
 
@@ -74,33 +74,75 @@ msgstr "Добавить"
 msgid "Add and edit..."
 msgstr "Добавить и редактировать..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Дополнительные настройки"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Разрешить перенаправление из <em>'зон источников'</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Разрешить перенаправление в <em>'зоны назначения'</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Любой"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr "Любой день"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Использовать сети"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Пользовательские правила"
@@ -116,15 +158,15 @@ msgstr ""
 "каждой перезагрузки межсетевого экрана, сразу после загрузки набора правил "
 "по умолчанию."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Адрес назначения"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Порт назначения"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -134,72 +176,82 @@ msgstr "Зона назначения"
 msgid "Disable"
 msgstr "Отключить"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr "Отклонять перенаправляемый трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr "Отклонять входящий трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr "Отклонять исходящий трафик"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Не перезаписывать"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr "Не отслеживать перенаправляемый трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr "Не отслеживать входящий трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr "Не отслеживать исходящий трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Отбрасывать некорректные пакеты"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Включить"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "Включить NAT Loopback"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Включить защиту от SYN-flood атак"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Включить журналирование в этой зоне"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr "Экспериментальный функционал. Не полностью совместим с QoS/SQM."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Внешний IP-адрес"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -209,11 +261,23 @@ msgstr "Внешний порт"
 msgid "External zone"
 msgstr "Внешняя зона"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Дополнительные аргументы"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Межсетевой экран"
@@ -222,71 +286,71 @@ msgstr "Межсетевой экран"
 msgid "Firewall - Custom Rules"
 msgstr "Межсетевой экран - Пользовательские правила"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Межсетевой экран - Перенаправление портов"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Межсетевой экран - Правила для трафика"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Межсетевой экран - Настройка зон"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Включить отслеживание соединений"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Перенаправление"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Перенаправлять на"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr "Пятница"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "Из %s в %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "Из %s в %s с источником %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "Из %s в %s с источниками %s и %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr "Из %s в <var>это устройство</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr "Из %s в <var>это устройство</var> с источником %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr "Из %s в <var>это устройство</var> с источниками %s and %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Основные настройки"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr "Аппаратный flow offloading"
 
@@ -305,47 +369,51 @@ msgstr "Диапазон IP-адресов"
 msgid "IPs"
 msgstr "IP-адреса"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 и IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "Только IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "Только IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Входящий трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Внутренний IP-адрес"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Внутренний порт"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Внутренняя зона"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Ограничить журнал сообщений"
 
@@ -359,24 +427,24 @@ msgstr "MAC-адрес"
 msgid "MACs"
 msgstr "MAC-адреса"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "Ограничение MSS"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Маскарадинг"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Входящий трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Соответствовать ICMP типу"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -384,18 +452,18 @@ msgstr ""
 "Порт или диапазон портов, входящие подключения на который будут "
 "перенаправляться на внутренний порт внутреннего IP-адреса (см. ниже)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr "Понедельник"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr "Дни месяца"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -429,22 +497,22 @@ msgstr "Новое перенаправление порта"
 msgid "New source NAT"
 msgstr "Новый SNAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 "Применять правило только для входящих подключений на указанный IP-адрес"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Применять правило только для входящего трафика от этих MAC-адресов."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 "Применять правило только для входящего трафика от этого IP-адреса или "
 "диапазона адресов."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -461,28 +529,33 @@ msgstr "Открыть порты на маршрутизаторе"
 msgid "Other..."
 msgstr "Другое..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Исходящий трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr "Исходящая зона"
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 "Передаёт дополнительные аргументы таблице iptables. Используйте с "
 "осторожностью!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Перенаправление портов"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -490,40 +563,46 @@ msgstr ""
 "Перенаправленные портов позволяет удалённым компьютерам из Интернета "
 "соединяться с компьютером или службой внутри частной локальной сети."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Протокол"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "Перенаправлять трафик на указанный порт или диапазон портов внутреннего IP-"
 "адреса"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Перенаправлять трафик на указанный IP-адрес"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr "Сбрасывать перенаправляемый трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr "Сбрасывать входящий трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr "Сбрасывать исходящий трафик"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 "Требуется аппаратная поддержка NAT. Реализовано, по крайней мере, для mt7621"
@@ -532,20 +611,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr "Перезапустить межсетевой экран"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "Использовать маскарадинг только для указанных подсетей-получателей"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "Использовать маскарадинг только для указанных подсетей-отправителей"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Использовать протокол"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr "Маршрутизация/NAT offloading"
 
@@ -557,71 +636,71 @@ msgstr "Правило отключено"
 msgid "Rule is enabled"
 msgstr "Правило включено"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr "Суббота"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr "Программная реализация offloading для маршрутизации/NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr "Программный flow offloading"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "IP-адрес источника"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "MAC-адрес источника"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Адрес источника"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Порт источника"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Зона источника"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr "Дата начала (год-мес-день)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr "Время начала (чч.мм.сс)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr "Дата окончания (год-мес-день)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr "Время окончания (чч.мм.сс)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr "Воскресенье"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
 msgstr "Межсетевой экран создает зоны в вашей сети для контроля трафика."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -638,7 +717,7 @@ msgstr ""
 "перенаправление из lan в wan <em>'не'</em> допускает перенаправление трафика "
 "из wan в lan."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -653,31 +732,31 @@ msgstr ""
 "различными сетями внутри зоны. <em>'Использовать сети'</em> указывает, какие "
 "доступные сети являются членами этой зоны."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr "Четверг"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr "Временные ограничения"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr "Время UTC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "К %s, %s на <var>этом устройстве</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "К %s в %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "К %s на <var>этом устройстве</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "К %s, %s в %s"
 
@@ -689,12 +768,12 @@ msgstr "К IP-адресу источника"
 msgid "To source port"
 msgstr "К порту источника"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Правила для трафика"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -704,109 +783,121 @@ msgstr ""
 "зонами, например, запрет трафика между некоторыми хостами или открытие WAN-"
 "портов маршрутизатора."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr "Вторник"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr "Перенаправление без имени"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr "Правило без имени"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr "Зона без имени"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "Через %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "Через %s, %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr "Среда"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr "Дни недели"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Зона ⇒ Перенаправления"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Зоны"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "принимать"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "любой"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "любого хоста"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "любой IP-адрес маршрутизатора"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "любой зоны"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr "день"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "не отслеживать"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "не обрабатывать"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr "час"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr "минута"
@@ -828,13 +919,13 @@ msgstr "порт"
 msgid "ports"
 msgstr "порты"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "отвергать"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr "секунда"
@@ -848,3 +939,6 @@ msgstr "тип"
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:130
 msgid "types"
 msgstr "типы"
+
+#~ msgid "Output zone"
+#~ msgstr "Исходящая зона"
diff --git a/applications/luci-app-firewall/po/sk/firewall.po b/applications/luci-app-firewall/po/sk/firewall.po
index 613dbda102..9cc4807742 100644
--- a/applications/luci-app-firewall/po/sk/firewall.po
+++ b/applications/luci-app-firewall/po/sk/firewall.po
@@ -8,50 +8,50 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=3; plural=(n==1) ? 0 : (n>=2 && n<=4) ? 1 : 2;\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr ""
 
@@ -67,33 +67,75 @@ msgstr ""
 msgid "Add and edit..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr ""
@@ -105,15 +147,15 @@ msgid ""
 "each firewall restart, right after the default ruleset has been loaded."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -123,72 +165,82 @@ msgstr ""
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -198,11 +250,23 @@ msgstr ""
 msgid "External zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr ""
@@ -211,71 +275,71 @@ msgstr ""
 msgid "Firewall - Custom Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -294,47 +358,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr ""
 
@@ -348,41 +416,41 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -416,19 +484,19 @@ msgstr ""
 msgid "New source NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -443,63 +511,74 @@ msgstr ""
 msgid "Other..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
-msgid "Passes additional arguments to iptables. Use with care!"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -507,20 +586,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -532,71 +611,71 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -606,7 +685,7 @@ msgid ""
 "<em>not</em> imply a permission to forward from wan to lan as well."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -615,31 +694,31 @@ msgid ""
 "networks</em> specifies which available networks are members of this zone."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr ""
 
@@ -651,121 +730,133 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
 "the router."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -787,13 +878,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
diff --git a/applications/luci-app-firewall/po/sv/firewall.po b/applications/luci-app-firewall/po/sv/firewall.po
index 3d1dfdde08..b36b4cda1f 100644
--- a/applications/luci-app-firewall/po/sv/firewall.po
+++ b/applications/luci-app-firewall/po/sv/firewall.po
@@ -9,50 +9,50 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s i %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s med %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%2, %s i %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> pkt. per <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr "<var>%d</var> pkt. per <var>%s</var>, brustna <var>%d</var> pkt."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> och gränsen till %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Åtgärd"
 
@@ -68,33 +68,75 @@ msgstr "Lägg till"
 msgid "Add and edit..."
 msgstr "Lägg till och redigera..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Avancerade inställningar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Tillåt vidarebefordring från <em>källzonerna</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Till vidarebefordring till <em>destinationszonerna:</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Alla"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Nätverk som omfattas"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Anpassade regler"
@@ -106,15 +148,15 @@ msgid ""
 "each firewall restart, right after the default ruleset has been loaded."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Destinationens adress"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Destinationsport"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -124,72 +166,82 @@ msgstr "Destinationens zon"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Skriv inte om igen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Släpp ogiltiga paket"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Aktivera"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Aktivera loggning i den här zonen"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Extern IP-adress"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -199,11 +251,23 @@ msgstr "Extern port"
 msgid "External zone"
 msgstr "Extern zon"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Extra argument"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Brandvägg"
@@ -212,71 +276,71 @@ msgstr "Brandvägg"
 msgid "Firewall - Custom Rules"
 msgstr "Brandvägg - Anpassade regler"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Brandvägg - Vidarebefordring av port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Brandvägg - Trafikregler"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Brandvägg - Zoninställningar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Vidarebefordra"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "Vidarebefordra till"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr "Fredag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "Från %s i %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "Från %s i %s med källa %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "Från %s i %s med källa %s och %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Generella inställningar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -295,47 +359,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 och IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "Endast IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "Endast IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Inmatning"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Intern IP-adress"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Intern port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Intern zon"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Begränsa loggmeddelanden"
 
@@ -349,24 +417,24 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Maskering"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Matcha"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Matchar ICMP-typ"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -374,18 +442,18 @@ msgstr ""
 "Matcha inkommande trafik dirigerad till den angivna destinationsporten eller "
 "portens räckvidd på den här värden"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr "Måndag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr "Dagar i månaden"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -419,20 +487,20 @@ msgstr "Ny vidarebefordring av port"
 msgid "New source NAT"
 msgstr "Ny käll-NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 "Matcha endast inkommande trafik från den här IP-adressen eller räckvidden."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -447,63 +515,74 @@ msgstr "Öppna portar i router"
 msgid "Other..."
 msgstr "Andra..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Utmatning"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
-msgid "Passes additional arguments to iptables. Use with care!"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Vidarebefordringar av port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Protokoll"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -511,20 +590,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr "Starta om brandvägg"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Begränsa till adressfamilj"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -536,71 +615,71 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr "Lördag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "IP-adress för källa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "MAC-adress för källa"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr "Startdatum (åååå-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr "Stopptid (åååå-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr "Söndag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -610,7 +689,7 @@ msgid ""
 "<em>not</em> imply a permission to forward from wan to lan as well."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -619,31 +698,31 @@ msgid ""
 "networks</em> specifies which available networks are members of this zone."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr "Torsdag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr "Tid enligt UTC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "Till %s vid %s på <var>den här enheten</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "Till %s i %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "Till %s på <var>den här enheten</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "Till %s, %s i %s"
 
@@ -655,121 +734,133 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Trafikregler"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
 "the router."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr "Tisdag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "Via %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr "Onsdag"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr "Veckodagar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zoner"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "acceptera"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "alla"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "alla värdar"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "alla zoner"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "spåra inte"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "släpp"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -791,13 +882,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "neka"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
@@ -824,9 +915,6 @@ msgstr ""
 #~ msgid "Destination IP address"
 #~ msgstr "Destinationens IP-adress"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Match forwarded traffic to the given destination port or port range."
 #~ msgstr ""
 #~ "Matcha vidarebefordrad trafik till den angivna destinationsporten eller "
diff --git a/applications/luci-app-firewall/po/templates/firewall.pot b/applications/luci-app-firewall/po/templates/firewall.pot
index 27b2015474..d645720a70 100644
--- a/applications/luci-app-firewall/po/templates/firewall.pot
+++ b/applications/luci-app-firewall/po/templates/firewall.pot
@@ -1,50 +1,50 @@
 msgid ""
 msgstr "Content-Type: text/plain; charset=UTF-8"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr ""
 
@@ -60,33 +60,75 @@ msgstr ""
 msgid "Add and edit..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr ""
@@ -98,15 +140,15 @@ msgid ""
 "each firewall restart, right after the default ruleset has been loaded."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -116,72 +158,82 @@ msgstr ""
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -191,11 +243,23 @@ msgstr ""
 msgid "External zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr ""
@@ -204,71 +268,71 @@ msgstr ""
 msgid "Firewall - Custom Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -287,47 +351,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr ""
 
@@ -341,41 +409,41 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -409,19 +477,19 @@ msgstr ""
 msgid "New source NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -436,63 +504,74 @@ msgstr ""
 msgid "Other..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
-msgid "Passes additional arguments to iptables. Use with care!"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -500,20 +579,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -525,71 +604,71 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -599,7 +678,7 @@ msgid ""
 "<em>not</em> imply a permission to forward from wan to lan as well."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -608,31 +687,31 @@ msgid ""
 "networks</em> specifies which available networks are members of this zone."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr ""
 
@@ -644,121 +723,133 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
 "the router."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -780,13 +871,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
diff --git a/applications/luci-app-firewall/po/tr/firewall.po b/applications/luci-app-firewall/po/tr/firewall.po
index 4c740491f3..5dc20d7acd 100644
--- a/applications/luci-app-firewall/po/tr/firewall.po
+++ b/applications/luci-app-firewall/po/tr/firewall.po
@@ -8,50 +8,50 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=1; plural=0;\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr ""
 
@@ -67,33 +67,75 @@ msgstr ""
 msgid "Add and edit..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr ""
@@ -105,15 +147,15 @@ msgid ""
 "each firewall restart, right after the default ruleset has been loaded."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -123,72 +165,82 @@ msgstr ""
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -198,11 +250,23 @@ msgstr ""
 msgid "External zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr ""
@@ -211,71 +275,71 @@ msgstr ""
 msgid "Firewall - Custom Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -294,47 +358,51 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr ""
 
@@ -348,41 +416,41 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -416,19 +484,19 @@ msgstr ""
 msgid "New source NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -443,63 +511,74 @@ msgstr ""
 msgid "Other..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
-msgid "Passes additional arguments to iptables. Use with care!"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -507,20 +586,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -532,71 +611,71 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -606,7 +685,7 @@ msgid ""
 "<em>not</em> imply a permission to forward from wan to lan as well."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -615,31 +694,31 @@ msgid ""
 "networks</em> specifies which available networks are members of this zone."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr ""
 
@@ -651,121 +730,133 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
 "the router."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -787,13 +878,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
diff --git a/applications/luci-app-firewall/po/uk/firewall.po b/applications/luci-app-firewall/po/uk/firewall.po
index c256a03b9b..a3e925ffef 100644
--- a/applications/luci-app-firewall/po/uk/firewall.po
+++ b/applications/luci-app-firewall/po/uk/firewall.po
@@ -9,50 +9,50 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s у %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s із %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s у %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> пакетів за <var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr "<var>%d</var> пакетів за <var>%s</var>, підряд <var>%d</var> пакетів"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> з лімітом %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr "Приймати переспрямовування"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr "Приймати вхідний"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr "Приймати вихідний"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Дія"
 
@@ -68,33 +68,75 @@ msgstr "Додати"
 msgid "Add and edit..."
 msgstr "Додати та редагувати..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "Розширені настройки"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "Дозволити переспрямовування від <em>зон джерела</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "Дозволити переспрямовування до <em>зон призначення</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "Будь-який"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr "Будь-який день"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "Покриті мережі"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "Настроювані правила"
@@ -110,15 +152,15 @@ msgstr ""
 "виконуються після кожного перезавантаження брандмауера, відразу після "
 "завантаження типового набору правил."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Адреса призначення"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Порт призначення"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -128,72 +170,82 @@ msgstr "Зона призначення"
 msgid "Disable"
 msgstr "Вимкнути"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr "Відкидати переспрямовування"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr "Відкидати вхідний"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr "Відкидати вихідний"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "Не перезаписувати"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr "Не відслідковувати переспрямовування"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr "Не відслідковувати вхідний"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr "Не відслідковувати вихідний"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Відкидати помилкові пакети"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "Увімкнути"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "Увімкнути NAT Loopback"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "Увімкнути захист від SYN-flood"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "Увімкнути реєстрування у цій зоні"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr "Експериментальна функція. Не повністю сумісно з QoS / SQM."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "Зовнішня IP-адреса"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -203,11 +255,23 @@ msgstr "Зовнішній порт"
 msgid "External zone"
 msgstr "Зовнішня зона"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "Додаткові аргументи"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Брандмауер"
@@ -216,71 +280,71 @@ msgstr "Брандмауер"
 msgid "Firewall - Custom Rules"
 msgstr "Брандмауер — Настроювані правила"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "Брандмауер — Переспрямовування портів"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "Брандмауер — Правила трафіка"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "Брандмауер — Параметри зон"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "Увімкнути відстеження з'єднань"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "Переспрямовування"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "переспрямовування до"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr "П'ятниця"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "%s у %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "%s у %s з джерелом %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "%s у %s з джерелом %s та %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr "Від %s на <var>цьому пристрої</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr "Від %s на <var>цьому пристрої</var> з джерелом %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr "Від %s на <var>цьому пристрої</var> з джерелом %s та %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "Загальні параметри"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr "Апаратні засоби розвантаження потоку"
 
@@ -299,47 +363,51 @@ msgstr "Діапазон IP"
 msgid "IPs"
 msgstr "IP-адреси"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 та IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "Лише IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "Лише IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Вхідний"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "Внутрішня IP-адреса"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "Внутрішній порт"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "Внутрішня зона"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "Обмеження повідомлень журналу"
 
@@ -353,24 +421,24 @@ msgstr "MAC-адреса"
 msgid "MACs"
 msgstr "MAC-адреси"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "Затискання MSS"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "Підміна"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "Зіставляти"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "Зіставляти ICMP типу"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
@@ -378,18 +446,18 @@ msgstr ""
 "Зіставляти вхідний трафік, спрямований на заданий порт призначення або "
 "діапазон портів цього вузла."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr "Понеділок"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr "Дні місяця"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -423,19 +491,19 @@ msgstr "Нове переспрямовування порту"
 msgid "New source NAT"
 msgstr "Новий NAT джерела"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "Зіставляти тільки вхідний трафік, спрямований на задану IP-адресу."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "Зіставляти тільки вхідний трафік від цих MAC-адрес."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "Зіставляти тільки вхідний трафік від цього IP чи діапазону."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -452,27 +520,32 @@ msgstr "Відкрити порти на роутері"
 msgid "Other..."
 msgstr "Інше..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Вихідний"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr "Вихідна зона"
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 "Передача додаткових аргументів для IPTables. Використовуйте з обережністю!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "Переспрямовування портів"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
@@ -480,39 +553,45 @@ msgstr ""
 "Переспрямовування портів дозволяє віддаленим комп'ютерам з Інтернету "
 "підключатися до певного комп'ютера або служби у приватній мережі."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "Протокол"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 "Переспрямувати відповідний вхідний трафік на заданий порт внутрішнього вузла"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "Переспрямувати відповідний вхідний трафік на заданий внутрішній вузол"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr "Відхиляти переспрямовування"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr "Відхиляти вхідний"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr "Відхиляти вихідний"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr "Необхідна апаратна підтримка NAT. Упроваджено принаймні для mt7621"
 
@@ -520,20 +599,20 @@ msgstr "Необхідна апаратна підтримка NAT. Упрова
 msgid "Restart Firewall"
 msgstr "Перезавантажити брандмауер"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "Обмежити підміну заданими підмережами призначення"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "Обмежити підміну заданими підмережами джерела"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "Обмежити сімейство протоколів"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr "Розвантаження маршрутизації/NAT"
 
@@ -545,64 +624,64 @@ msgstr "Правило вимкнено"
 msgid "Rule is enabled"
 msgstr "Правило ввімкнено"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr "Субота"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr "Програмне розвантаження для маршрутизації/NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr "Програмне розвантаження потоку"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "IP-адреса джерела"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "MAC-адреса джерела"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "Адреса джерела"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Порт джерела"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "Зона джерела"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr "Дата початку (рррр-мм-дд)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr "Час початку (гг:хх:сс)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr "Дата зупинки (рррр-мм-дд)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr "Час зупинки (гг:хх:сс)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr "Неділя"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -610,8 +689,8 @@ msgstr ""
 "Брандмауер створює зони поверх ваших мережевих інтерфейсів для управління "
 "потоком мережевого трафіку."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -628,7 +707,7 @@ msgstr ""
 "від LAN до WAN <em>не</em> означає, що є також дозвіл спрямовувати від WAN "
 "до LAN."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -642,31 +721,31 @@ msgstr ""
 "трафіку між різними мережами в межах зони. Пункт <em>Покриті мережі</em> "
 "визначає, які доступні мережі є членами цієї зони."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr "Четвер"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr "Часові обмеження"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr "Час в UTC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "%s на %s <var>цього пристрою</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "%s у %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "%s на <var>цього пристрою</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "%s, %s у %s"
 
@@ -678,12 +757,12 @@ msgstr "До IP джерела"
 msgid "To source port"
 msgstr "До порту джерела"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "Правила трафіка"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -693,109 +772,121 @@ msgstr ""
 "різними зонами, наприклад, відхиляти трафік між певними вузлами або відкрити "
 "порти WAN на маршрутизаторі."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr "Вівторок"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr "Переспрямовування без назви"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr "Правило без назви"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr "Зона без назви"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "Через %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "Через %s на %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr "Середа"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr "Дні тижня"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "Зона ⇒ Переспрямовування"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Зони"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "приймати"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "будь-який"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "будь-який вузол"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "будь-який IP роутера"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "будь-якій зоні"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr "день"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "не відстеж."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "опускати"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr "година"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr "хвилина"
@@ -817,13 +908,13 @@ msgstr "порт"
 msgid "ports"
 msgstr "порти"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "відкидати"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr "секунду"
@@ -837,3 +928,6 @@ msgstr "типом"
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:130
 msgid "types"
 msgstr "типами"
+
+#~ msgid "Output zone"
+#~ msgstr "Вихідна зона"
diff --git a/applications/luci-app-firewall/po/vi/firewall.po b/applications/luci-app-firewall/po/vi/firewall.po
index a445b0e907..7e0d12639d 100644
--- a/applications/luci-app-firewall/po/vi/firewall.po
+++ b/applications/luci-app-firewall/po/vi/firewall.po
@@ -13,50 +13,50 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "X-Generator: Pootle 1.1.0\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "Action"
 
@@ -72,33 +72,75 @@ msgstr ""
 msgid "Add and edit..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr ""
@@ -110,15 +152,15 @@ msgid ""
 "each firewall restart, right after the default ruleset has been loaded."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "Địa chỉ điểm đến"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "Cổng điểm đến"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 #, fuzzy
@@ -129,73 +171,83 @@ msgstr "Điểm đến"
 msgid "Disable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "Bỏ qua nhưng gói không hợp lý"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 #, fuzzy
 msgid "Enable SYN-flood protection"
 msgstr "SYN-flood bảo vệ "
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -205,11 +257,23 @@ msgstr "External port"
 msgid "External zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "Firewall"
@@ -218,71 +282,71 @@ msgstr "Firewall"
 msgid "Firewall - Custom Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr ""
 
@@ -301,49 +365,53 @@ msgstr ""
 msgid "IPs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "Input"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 #, fuzzy
 msgid "Internal IP address"
 msgstr "Internal address"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 #, fuzzy
 msgid "Internal port"
 msgstr "External port"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr ""
 
@@ -357,42 +425,42 @@ msgstr ""
 msgid "MACs"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 #, fuzzy
 msgid "MSS clamping"
 msgstr "MSS Clamping"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -426,19 +494,19 @@ msgstr ""
 msgid "New source NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -453,63 +521,74 @@ msgstr ""
 msgid "Other..."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "Output"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+msgid "Passes additional arguments to iptables. Use with care!"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
-msgid "Passes additional arguments to iptables. Use with care!"
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr ""
 
@@ -517,20 +596,20 @@ msgstr ""
 msgid "Restart Firewall"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr ""
 
@@ -542,67 +621,67 @@ msgstr ""
 msgid "Rule is enabled"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 #, fuzzy
 msgid "Source IP address"
 msgstr "Đỉa chỉ MAC nguồn"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 #, fuzzy
 msgid "Source address"
 msgstr "Đỉa chỉ MAC nguồn"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "Cổng nguồn"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 #, fuzzy
 msgid "Source zone"
 msgstr "Cổng nguồn"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
@@ -610,8 +689,8 @@ msgstr ""
 "The firewall tạo zones trên giao diện mạng lưới để điều triển sự dòng lưu "
 "thông của mạng."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -621,7 +700,7 @@ msgid ""
 "<em>not</em> imply a permission to forward from wan to lan as well."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -630,31 +709,31 @@ msgid ""
 "networks</em> specifies which available networks are members of this zone."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr ""
 
@@ -666,121 +745,133 @@ msgstr ""
 msgid "To source port"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
 "the router."
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "Zones"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "chấp nhận"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr ""
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "drop"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr ""
@@ -802,13 +893,13 @@ msgstr ""
 msgid "ports"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "Không chấp nhận"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr ""
diff --git a/applications/luci-app-firewall/po/zh-cn/firewall.po b/applications/luci-app-firewall/po/zh-cn/firewall.po
index 4c7ee906f4..13e4f0aeee 100644
--- a/applications/luci-app-firewall/po/zh-cn/firewall.po
+++ b/applications/luci-app-firewall/po/zh-cn/firewall.po
@@ -11,50 +11,50 @@ msgstr ""
 "PO-Revision-Date: 2018-08-08 08:28+0800\n"
 "X-Generator: Gtranslator 2.91.7\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s 位于 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s 和 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s 位于 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> 数据包/<var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr "<var>%d</var> 数据包/<var>%s</var>,突发 <var>%d</var> 数据包。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> 并限制到 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr "接受转发"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr "接受入站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr "接受出站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "动作"
 
@@ -70,33 +70,75 @@ msgstr "添加"
 msgid "Add and edit..."
 msgstr "添加并编辑…"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "高级设置"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "允许从<em>源区域</em>转发:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "允许转发到<em>目标区域</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "任何"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "覆盖网络"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "自定义规则"
@@ -110,15 +152,15 @@ msgstr ""
 "自定义规则允许您执行不属于防火墙框架的任意 iptables 命令。每次重启防火墙时,"
 "在默认的规则运行后这些命令将立即执行。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "目标地址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "目标端口"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -128,72 +170,82 @@ msgstr "目标区域"
 msgid "Disable"
 msgstr "禁用"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr "丢弃转发"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr "丢弃入站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr "丢弃出站"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "不重写"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr "不跟踪转发"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr "不跟踪入站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr "不跟踪出站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "丢弃无效数据包"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "启用"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "启用 NAT 环回"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "启用 SYN-flood 防御"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "启用此区域的日志记录"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr "实验特性。与 QoS/SQM 不完全兼容。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "外部 IP 地址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -203,11 +255,23 @@ msgstr "外部端口"
 msgid "External zone"
 msgstr "外部区域"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "附加参数"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "防火墙"
@@ -216,71 +280,71 @@ msgstr "防火墙"
 msgid "Firewall - Custom Rules"
 msgstr "防火墙 - 自定义规则"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "防火墙 - 端口转发"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "防火墙 - 通信规则"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "防火墙 - 区域设置"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "强制连接追踪"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "转发"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "转发到"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr "星期五"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "来自 %s 位于 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "来自 %s 位于 %s 源于 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "来自 %s 位于 %s 源端口 %s 源 MAC %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr "来自 %s 位于<var>本设备</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr "来自 %s 位于<var>本设备</var>源于 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr "来自 %s 位于<var>本设备</var>源端口 %s 源 MAC %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "基本设置"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr "硬件流量分载"
 
@@ -299,47 +363,51 @@ msgstr "IP 范围"
 msgid "IPs"
 msgstr "IP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 和 IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "仅 IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "仅 IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "入站数据"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "内部 IP 地址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "内部端口"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "内部区域"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "限制日志信息"
 
@@ -353,41 +421,41 @@ msgstr "MAC"
 msgid "MACs"
 msgstr "MAC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "MSS 钳制"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "IP 动态伪装"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "匹配规则"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "匹配 ICMP 类型"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 msgstr "匹配指向此主机上指定目标端口或目标端口范围的入站流量。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr "星期一"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr "日期"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -421,19 +489,19 @@ msgstr "新建端口转发"
 msgid "New source NAT"
 msgstr "新建 Source NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "仅匹配指定目的 IP 地址的入站流量。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "仅匹配来自这些 MAC 的入站流量。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "仅匹配来自此 IP 或 IP 范围的入站流量。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -448,64 +516,75 @@ msgstr "打开路由器端口"
 msgid "Other..."
 msgstr "其它..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "出站数据"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr "出站区域"
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr "传递到 iptables 的额外参数。小心使用!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "端口转发"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr ""
 "端口转发允许 Internet 上的远程计算机连接到内部网络中的特定计算机或服务。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "协议"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr "重定向匹配的入站流量到内部主机的端口"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "重定向匹配的入站流量到指定的内部主机"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr "拒绝转发"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr "拒绝入站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr "拒绝出站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr "需要硬件 NAT 支持。目前 mt7621 已实现"
 
@@ -513,20 +592,20 @@ msgstr "需要硬件 NAT 支持。目前 mt7621 已实现"
 msgid "Restart Firewall"
 msgstr "重启防火墙"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "要限制 IP 动态伪装的目标子网"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "要限制 IP 动态伪装的源子网"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "限制地址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr "Routing/NAT 分载"
 
@@ -538,71 +617,71 @@ msgstr "规则已禁用"
 msgid "Rule is enabled"
 msgstr "规则已启用"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr "星期六"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr "基于软件的 Routing/NAT 分载"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr "软件流量分载"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "源 IP 地址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "源 MAC 地址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "源地址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "源端口"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "源区域"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr "开始日期(yyyy-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr "停止日期(yyyy-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr "星期日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
 msgstr "防火墙通过在网络接口上创建区域来控制网络流量。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -616,7 +695,7 @@ msgstr ""
 "strong> 的区域的需转发流量。转发规则的作用是<em>单向</em>的,例如:一条允许"
 "从 lan 到 wan 的转发规则并不隐含有允许相反方向从 wan 到 lan 的流量转发。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -628,31 +707,31 @@ msgstr ""
 "域入站和出站流量的默认策略,<em>转发</em>选项描述该区域内不同网络之间的流量转"
 "发策略。<em>覆盖网络</em>指定从属于这个区域的网络。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr "星期四"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr "UTC 时间"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "到 %s 在 %s 位于<var>本设备</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "到 %s 位于 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "到 %s 位于<var>本设备</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "到 %s, %s 位于 %s"
 
@@ -664,12 +743,12 @@ msgstr "到源 IP"
 msgid "To source port"
 msgstr "到源端口"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "通信规则"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -678,109 +757,121 @@ msgstr ""
 "通信规则定义了不同区域间的数据包传输策略,例如:拒绝一些主机之间的通信,开放"
 "路由器 WAN 上的端口。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr "星期二"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr "未命名转发"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr "未命名规则"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "通过 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "通过 %s 在 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr "星期三"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr "星期"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "区域 ⇒ 转发"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "区域"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "接受"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "所有"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "所有主机"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "所有路由 IP"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "所有区域"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr "日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "不跟踪"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "丢弃"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr "小时"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr "分钟"
@@ -802,13 +893,13 @@ msgstr "端口"
 msgid "ports"
 msgstr "端口"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "拒绝"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr "秒"
@@ -823,6 +914,9 @@ msgstr "类型"
 msgid "types"
 msgstr "类型"
 
+#~ msgid "Output zone"
+#~ msgstr "出站区域"
+
 #~ msgid "(Unnamed Entry)"
 #~ msgstr "(未命名条目)"
 
@@ -835,9 +929,6 @@ msgstr "类型"
 #~ msgid "Destination IP address"
 #~ msgstr "目标 IP 地址"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "端口触发"
 
diff --git a/applications/luci-app-firewall/po/zh-tw/firewall.po b/applications/luci-app-firewall/po/zh-tw/firewall.po
index cde66073c9..1e236c78a7 100644
--- a/applications/luci-app-firewall/po/zh-tw/firewall.po
+++ b/applications/luci-app-firewall/po/zh-tw/firewall.po
@@ -11,50 +11,50 @@ msgstr ""
 "PO-Revision-Date: 2018-08-08 08:28+0800\n"
 "X-Generator: Gtranslator 2.91.7\n"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:145
 msgid "%s in %s"
 msgstr "%s 位於 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:233
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:242
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:154
 msgid "%s%s with %s"
 msgstr "%s%s 和 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:132
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:143
 msgid "%s, %s in %s"
 msgstr "%s, %s 位於 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:275
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:195
 msgid "<var>%d</var> pkts. per <var>%s</var>"
 msgstr "<var>%d</var> 資料包/<var>%s</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:262
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:271
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:192
 msgid "<var>%d</var> pkts. per <var>%s</var>, burst <var>%d</var> pkts."
 msgstr "<var>%d</var> 資料包/<var>%s</var>,突發 <var>%d</var> 資料包。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:107
 msgid "<var>%s</var> and limit to %s"
 msgstr "<var>%s</var> 並限制到 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:284
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:293
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:214
 msgid "Accept forward"
 msgstr "接受轉發"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:294
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:303
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:224
 msgid "Accept input"
 msgstr "接受入站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:274
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:283
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:204
 msgid "Accept output"
 msgstr "接受出站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:160
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:315
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:325
 msgid "Action"
 msgstr "動作"
 
@@ -70,33 +70,75 @@ msgstr "新增"
 msgid "Add and edit..."
 msgstr "新增並編輯…"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:73
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone destination "
+"traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
+"traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid ""
+"Additional raw <em>iptables</em> arguments to classify zone source traffic, "
+"e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:84
 msgid "Advanced Settings"
 msgstr "高階設定"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid "Allow \"invalid\" traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
 msgstr "允許從<em>源區域</em>轉發:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:263
 msgid "Allow forward to <em>destination zones</em>:"
 msgstr "允許轉發到<em>目標區域</em>:"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:207
 msgid "Any"
 msgstr "任何"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:341
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:354
 msgid "Any day"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:122
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid "Automatic helper assignment"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
+msgid ""
+"Automatically assign conntrack helpers based on traffic protocol and port"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+msgid "Conntrack Settings"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Conntrack helpers"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid "Covered devices"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
 msgstr "覆蓋網路"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid "Covered subnets"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
 msgstr "自訂規則"
@@ -110,15 +152,15 @@ msgstr ""
 "自訂規則允許您執行不屬於防火牆框架的任意 iptables 指令。每次重啟防火牆時,在"
 "預設的規則執行後這些指令將立即執行。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:295
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:305
 msgid "Destination address"
 msgstr "目標位址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:306
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:316
 msgid "Destination port"
 msgstr "目標埠"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:299
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:42
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:21
 msgid "Destination zone"
@@ -128,72 +170,82 @@ msgstr "目標區域"
 msgid "Disable"
 msgstr "禁用"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:290
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:299
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:220
 msgid "Discard forward"
 msgstr "丟棄轉發"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:300
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:309
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:230
 msgid "Discard input"
 msgstr "丟棄入站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:280
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:289
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:210
 msgid "Discard output"
 msgstr "丟棄出站"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
+msgid ""
+"Do not install extra rules to reject forwarded traffic with conntrack state "
+"<em>invalid</em>. This may be required for complex asymmetric route setups."
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
 msgid "Do not rewrite"
 msgstr "不重寫"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:288
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:297
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:218
 msgid "Do not track forward"
 msgstr "不跟蹤轉發"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:298
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:307
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:228
 msgid "Do not track input"
 msgstr "不跟蹤入站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:278
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:287
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:208
 msgid "Do not track output"
 msgstr "不跟蹤出站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:31
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
 msgid "Drop invalid packets"
 msgstr "丟棄無效資料包"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:148
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:188
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:246
 msgid "Enable"
 msgstr "啟用"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:261
 msgid "Enable NAT Loopback"
 msgstr "啟用 NAT 環回"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:30
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
 msgid "Enable SYN-flood protection"
 msgstr "啟用 SYN-flood 防禦"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:220
 msgid "Enable logging on this zone"
 msgstr "啟用此區域的日誌記錄"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
 msgid "Experimental feature. Not fully compatible with QoS/SQM."
 msgstr "實驗特性。與 QoS/SQM 不完全相容。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
+msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
 msgstr "外部 IP 位址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:211
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:222
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:28
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:12
 msgid "External port"
@@ -203,11 +255,23 @@ msgstr "外部埠"
 msgid "External zone"
 msgstr "外部區域"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:255
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:323
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
 msgstr "附加引數"
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
+msgid "Extra destination arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+msgid "Extra iptables arguments"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
+msgid "Extra source arguments"
+msgstr ""
+
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
 msgstr "防火牆"
@@ -216,71 +280,71 @@ msgstr "防火牆"
 msgid "Firewall - Custom Rules"
 msgstr "防火牆 - 自訂規則"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:90
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
 msgid "Firewall - Port Forwards"
 msgstr "防火牆 - 埠轉發"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
 msgid "Firewall - Traffic Rules"
 msgstr "防火牆 - 通訊規則"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:23
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
 msgid "Firewall - Zone Settings"
 msgstr "防火牆 - 區域設定"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
 msgid "Force connection tracking"
 msgstr "強制連線追蹤"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:36
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:106
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:47
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
 msgid "Forward"
 msgstr "轉發"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:123
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:134
 msgid "Forward to"
 msgstr "轉發到"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:347
 msgid "Friday"
 msgstr "星期五"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:61
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:63
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:62
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:64
 msgid "From %s in %s"
 msgstr "來自 %s 位於 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:59
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:62
 msgid "From %s in %s with source %s"
 msgstr "來自 %s 位於 %s 源於 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:59
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:60
 msgid "From %s in %s with source %s and %s"
 msgstr "來自 %s 位於 %s 源埠 %s 源 MAC %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:74
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:75
 msgid "From %s on <var>this device</var>"
 msgstr "來自 %s 位於<var>本裝置</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:73
 msgid "From %s on <var>this device</var> with source %s"
 msgstr "來自 %s 位於<var>本裝置</var>源於 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:70
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:71
 msgid "From %s on <var>this device</var> with source %s and %s"
 msgstr "來自 %s 位於<var>本裝置</var>源埠 %s 源 MAC %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:98
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:134
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:26
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:99
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:135
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:37
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:83
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:9
 msgid "General Settings"
 msgstr "基本設定"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:60
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:71
 msgid "Hardware flow offloading"
 msgstr "硬體流量分載"
 
@@ -299,47 +363,51 @@ msgstr "IP 範圍"
 msgid "IPs"
 msgstr "IP"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:45
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:216
 msgid "IPv4"
 msgstr "IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:178
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:160
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:220
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
 msgid "IPv4 and IPv6"
 msgstr "IPv4 和 IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:161
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:201
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:186
 msgid "IPv4 only"
 msgstr "僅 IPv4"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:180
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
+msgid "IPv6"
+msgstr "IPv6"
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
 msgid "IPv6 only"
 msgstr "僅 IPv6"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:34
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:104
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:45
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:117
 msgid "Input"
 msgstr "入站資料"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:227
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:238
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:30
 msgid "Internal IP address"
 msgstr "內部 IP 位址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:250
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:31
 msgid "Internal port"
 msgstr "內部埠"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:221
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:232
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:29
 msgid "Internal zone"
 msgstr "內部區域"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:185
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:223
 msgid "Limit log messages"
 msgstr "限制日誌資訊"
 
@@ -353,41 +421,41 @@ msgstr "MAC"
 msgid "MACs"
 msgstr "MAC"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:119
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:132
 msgid "MSS clamping"
 msgstr "MSS 鉗制"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:116
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:129
 msgid "Masquerading"
 msgstr "IP 動態偽裝"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:113
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:150
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:124
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
 msgid "Match"
 msgstr "匹配規則"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:195
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:217
 msgid "Match ICMP type"
 msgstr "匹配 ICMP 型別"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:212
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:223
 msgid ""
 "Match incoming traffic directed at the given destination port or port range "
 "on this host"
 msgstr "匹配指向此主機上指定目標埠或目標埠範圍的入站流量。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:343
 msgid "Monday"
 msgstr "星期一"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:340
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:350
 msgid "Month Days"
 msgstr "日期"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:109
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:146
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:172
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:120
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:168
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:98
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:25
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:10
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:40
@@ -421,19 +489,19 @@ msgstr "新建埠轉發"
 msgid "New source NAT"
 msgstr "新建 Source NAT"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:210
 msgid "Only match incoming traffic directed at the given IP address."
 msgstr "僅匹配指定目的 IP 位址的入站流量。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:162
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:173
 msgid "Only match incoming traffic from these MACs."
 msgstr "僅匹配來自這些 MAC 的入站流量。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:175
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:186
 msgid "Only match incoming traffic from this IP or range."
 msgstr "僅匹配來自此 IP 或 IP 範圍的入站流量。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:188
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:199
 msgid ""
 "Only match incoming traffic originating from the given source port or port "
 "range on the client host"
@@ -448,63 +516,74 @@ msgstr "開啟路由器埠"
 msgid "Other..."
 msgstr "其它..."
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:105
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:46
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:118
 msgid "Output"
 msgstr "出站資料"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:278
-msgid "Output zone"
-msgstr "出站區域"
-
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:256
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:324
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:267
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
 msgid "Passes additional arguments to iptables. Use with care!"
 msgstr "傳遞到 iptables 的額外引數。小心使用!"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:232
+msgid ""
+"Passing raw iptables arguments to source and destination traffic "
+"classification rules allows to match packets based on other criteria than "
+"interfaces or subnets. These options should be used with extreme care as "
+"invalid values could render the firewall ruleset broken, completely exposing "
+"all services."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
 msgid "Port Forwards"
 msgstr "埠轉發"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:91
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:92
 msgid ""
 "Port forwarding allows remote computers on the Internet to connect to a "
 "specific computer or service within the private LAN."
 msgstr "埠轉發允許 Internet 上的遠端計算機連線到內部網路中的特定計算機或服務。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:142
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:182
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:204
+msgid ""
+"Prevent the installation of <em>NOTRACK</em> rules which would bypass "
+"connection tracking."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm:26
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:11
 msgid "Protocol"
 msgstr "協議"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:251
 msgid ""
 "Redirect matched incoming traffic to the given port on the internal host"
 msgstr "重定向匹配的入站流量到內部主機的埠"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:228
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:239
 msgid "Redirect matched incoming traffic to the specified internal host"
 msgstr "重定向匹配的入站流量到指定的內部主機"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:286
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:295
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:216
 msgid "Refuse forward"
 msgstr "拒絕轉發"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:296
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:305
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:226
 msgid "Refuse input"
 msgstr "拒絕入站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:276
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:285
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:206
 msgid "Refuse output"
 msgstr "拒絕出站"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:61
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:72
 msgid "Requires hardware NAT support. Implemented at least for mt7621"
 msgstr "需要硬體 NAT 支援。目前 mt7621 已實現"
 
@@ -512,20 +591,20 @@ msgstr "需要硬體 NAT 支援。目前 mt7621 已實現"
 msgid "Restart Firewall"
 msgstr "重啟防火牆"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:197
 msgid "Restrict Masquerading to given destination subnets"
 msgstr "要限制 IP 動態偽裝的目標子網"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:165
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:190
 msgid "Restrict Masquerading to given source subnets"
 msgstr "要限制 IP 動態偽裝的源子網"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:175
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:159
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:197
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:184
 msgid "Restrict to address family"
 msgstr "限制位址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:59
 msgid "Routing/NAT Offloading"
 msgstr "Routing/NAT 分載"
 
@@ -537,71 +616,71 @@ msgstr "規則已禁用"
 msgid "Rule is enabled"
 msgstr "規則已啟用"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:338
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
 msgid "Saturday"
 msgstr "星期六"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
 msgid "Software based offloading for routing/NAT"
 msgstr "基於軟體的 Routing/NAT 分載"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:55
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:66
 msgid "Software flow offloading"
 msgstr "軟體流量分載"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:174
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "源 IP 位址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:161
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:247
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:172
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:268
 msgid "Source MAC address"
 msgstr "源 MAC 位址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:279
 msgid "Source address"
 msgstr "源位址"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:187
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:269
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:198
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:290
 msgid "Source port"
 msgstr "源埠"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:240
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:262
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm:41
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:20
 msgid "Source zone"
 msgstr "源區域"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:356
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:366
 msgid "Start Date (yyyy-mm-dd)"
 msgstr "開始日期(yyyy-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:348
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:358
 msgid "Start Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:360
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:370
 msgid "Stop Date (yyyy-mm-dd)"
 msgstr "停止日期(yyyy-mm-dd)"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:352
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:362
 msgid "Stop Time (hh.mm.ss)"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:332
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:342
 msgid "Sunday"
 msgstr "星期日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:24
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:35
 msgid ""
 "The firewall creates zones over your network interfaces to control network "
 "traffic flow."
 msgstr "防火牆通過在網路介面上建立區域來控制網路流量。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:155
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:194
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:171
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:259
 msgid ""
 "The options below control the forwarding policies between this zone (%s) and "
 "other zones. <em>Destination zones</em> cover forwarded traffic "
@@ -615,7 +694,7 @@ msgstr ""
 "strong> 的區域的需轉發流量。轉發規則的作用是<em>單向</em>的,例如:一條允許"
 "從 lan 到 wan 的轉發規則並不隱含有允許相反方向從 wan 到 lan 的流量轉發。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:81
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:94
 msgid ""
 "This section defines common properties of %q. The <em>input</em> and "
 "<em>output</em> options set the default policies for traffic entering and "
@@ -627,31 +706,31 @@ msgstr ""
 "域入站和出站流量的預設策略,<em>轉發</em>選項描述該區域內不同網路之間的流量轉"
 "發策略。<em>覆蓋網路</em>指定從屬於這個區域的網路。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:336
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:346
 msgid "Thursday"
 msgstr "星期四"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:137
 msgid "Time Restrictions"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:364
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:374
 msgid "Time in UTC"
 msgstr "UTC 時間"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:95
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:96
 msgid "To %s at %s on <var>this device</var>"
 msgstr "到 %s 在 %s 位於<var>本裝置</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:88
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:89
 msgid "To %s in %s"
 msgstr "到 %s 位於 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:97
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:98
 msgid "To %s on <var>this device</var>"
 msgstr "到 %s 位於<var>本裝置</var>"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:87
 msgid "To %s, %s in %s"
 msgstr "到 %s, %s 位於 %s"
 
@@ -663,12 +742,12 @@ msgstr "到源 IP"
 msgid "To source port"
 msgstr "到源埠"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:129
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:130
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:15
 msgid "Traffic Rules"
 msgstr "通訊規則"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:127
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:128
 msgid ""
 "Traffic rules define policies for packets traveling between different zones, "
 "for example to reject traffic between certain hosts or to open WAN ports on "
@@ -677,109 +756,121 @@ msgstr ""
 "通訊規則定義了不同區域間的資料包傳輸策略,例如:拒絕一些主機之間的通訊,開放"
 "路由器 WAN 上的埠。"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:334
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:344
 msgid "Tuesday"
 msgstr "星期二"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:106
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:107
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:121
 msgid "Unnamed forward"
 msgstr "未命名轉發"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:143
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:147
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:144
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:169
 msgid "Unnamed rule"
 msgstr "未命名規則"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:99
 msgid "Unnamed zone"
 msgstr ""
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:71
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
+msgid ""
+"Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
+"network devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
+msgid ""
+"Use this option to classify zone traffic by source or destination subnet "
+"instead of networks or devices."
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
 msgstr "通過 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:70
 msgid "Via %s at %s"
 msgstr "通過 %s 在 %s"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:335
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:345
 msgid "Wednesday"
 msgstr "星期三"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:327
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:337
 msgid "Week Days"
 msgstr "星期"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:96
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:109
 msgid "Zone ⇒ Forwardings"
 msgstr "區域 ⇒ 轉發"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:67
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:78
 msgid "Zones"
 msgstr "區域"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:42
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:112
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:329
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:125
 msgid "accept"
 msgstr "接受"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:166
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:179
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:192
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:177
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:190
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:203
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:243
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:200
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:250
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:261
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:272
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:298
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:309
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:214
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:222
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:271
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:282
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:293
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:308
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:319
 msgid "any"
 msgstr "所有"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:127
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:57
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:84
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:53
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:138
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:58
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:85
 msgid "any host"
 msgstr "所有主機"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:65
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:68
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:93
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:66
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:69
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:94
 msgid "any router IP"
 msgstr "所有路由 IP"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:182
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:51
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:126
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:137
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:110
 msgid "any zone"
 msgstr "所有區域"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:258
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:267
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:189
 msgid "day"
 msgstr "日"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:321
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:331
 msgid "don't track"
 msgstr "不跟蹤"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:318
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:41
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:111
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:328
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:52
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:124
 msgid "drop"
 msgstr "丟棄"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:256
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:265
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:187
 msgid "hour"
 msgstr "小時"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:254
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:263
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:185
 msgid "minute"
 msgstr "分鐘"
@@ -801,13 +892,13 @@ msgstr "埠"
 msgid "ports"
 msgstr "埠"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:320
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:40
-#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:110
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:330
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:51
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:123
 msgid "reject"
 msgstr "拒絕"
 
-#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:252
+#: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:261
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:183
 msgid "second"
 msgstr "秒"
@@ -822,6 +913,9 @@ msgstr "型別"
 msgid "types"
 msgstr "型別"
 
+#~ msgid "Output zone"
+#~ msgstr "出站區域"
+
 #~ msgid "(Unnamed Entry)"
 #~ msgstr "(未命名條目)"
 
@@ -834,9 +928,6 @@ msgstr "型別"
 #~ msgid "Destination IP address"
 #~ msgstr "目標 IP 位址"
 
-#~ msgid "IPv6"
-#~ msgstr "IPv6"
-
 #~ msgid "Inter-Zone Forwarding"
 #~ msgstr "埠觸發"
 
-- 
cgit v1.2.3


From f9a05f37432ab3fdea0a6d8f26b793f89843b230 Mon Sep 17 00:00:00 2001
From: INAGAKI Hiroshi <musashino.open@gmail.com>
Date: Sat, 27 Jul 2019 22:35:19 +0900
Subject: luci-app-firewall: update Japanese translation

Updated Japanese translations and remove unused msgid/msgstr sets.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
---
 applications/luci-app-firewall/po/ja/firewall.po | 81 ++++++++++--------------
 1 file changed, 35 insertions(+), 46 deletions(-)

(limited to 'applications/luci-app-firewall/po')

diff --git a/applications/luci-app-firewall/po/ja/firewall.po b/applications/luci-app-firewall/po/ja/firewall.po
index aea3efde5e..85870605da 100644
--- a/applications/luci-app-firewall/po/ja/firewall.po
+++ b/applications/luci-app-firewall/po/ja/firewall.po
@@ -3,7 +3,7 @@ msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2010-03-30 17:00+0200\n"
-"PO-Revision-Date: 2019-07-16 13:20+0900\n"
+"PO-Revision-Date: 2019-07-27 22:29+0900\n"
 "Last-Translator: INAGAKI Hiroshi <musashino.open@gmail.com>\n"
 "Language: ja\n"
 "MIME-Version: 1.0\n"
@@ -79,12 +79,18 @@ msgid ""
 "traffic, e.g. <code>-p tcp --dport 443</code> to only match outbound HTTPS "
 "traffic."
 msgstr ""
+"ゾーンの送信先へのトラフィックを区分するために付加する、生の <em>iptables</"
+"em> 引数です。(例: HTTPS 送信トラフィックのみにマッチさせる <code>-p tcp --"
+"dport 443</code>)"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
 msgid ""
 "Additional raw <em>iptables</em> arguments to classify zone source traffic, "
 "e.g. <code>-p tcp --sport 443</code> to only match inbound HTTPS traffic."
 msgstr ""
+"ゾーンを送信元とするトラフィックを区分するために付加する、生の <em>iptables</"
+"em> 引数です。(例: HTTPS 受信トラフィックのみにマッチさせる <code>-p tcp --"
+"sport 443</code>)"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:100
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:136
@@ -94,7 +100,7 @@ msgstr "詳細設定"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:207
 msgid "Allow \"invalid\" traffic"
-msgstr ""
+msgstr "\"invalid\" トラフィックの許可"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:304
 msgid "Allow forward from <em>source zones</em>:"
@@ -115,24 +121,26 @@ msgstr "全日"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
 msgid "Automatic helper assignment"
-msgstr ""
+msgstr "自動ヘルパー割り当て"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:210
 msgid ""
 "Automatically assign conntrack helpers based on traffic protocol and port"
 msgstr ""
+"トラフィックのプロトコルとポートに基づいて、 conntrack ヘルパーを自動的に割り"
+"当てます。"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:85
 msgid "Conntrack Settings"
-msgstr ""
+msgstr "Conntrack 設定"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
 msgid "Conntrack helpers"
-msgstr ""
+msgstr "Conntrack ヘルパー"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:175
 msgid "Covered devices"
-msgstr ""
+msgstr "カバーされるデバイス"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:135
 msgid "Covered networks"
@@ -140,7 +148,7 @@ msgstr "対象ネットワーク"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
 msgid "Covered subnets"
-msgstr ""
+msgstr "カバーされるサブネット"
 
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:19
 msgid "Custom Rules"
@@ -195,6 +203,9 @@ msgid ""
 "Do not install extra rules to reject forwarded traffic with conntrack state "
 "<em>invalid</em>. This may be required for complex asymmetric route setups."
 msgstr ""
+"conntrack ステートが <em>invalid</em> である転送されたトラフィックを拒否する"
+"追加ルールをインストールしません。これは、複雑で非対称なルートのセットアップ"
+"に必要となることがあります。"
 
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:45
 #: applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm:50
@@ -244,7 +255,7 @@ msgstr "実験的な機能です。 QoS/SQM との完全な互換性はありま
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:214
 msgid "Explicitly choses allowed connection tracking helpers for zone traffic"
-msgstr ""
+msgstr "ゾーン トラフィックのコネクション追跡ヘルパーを明示的に選択します。"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:209
 msgid "External IP address"
@@ -263,19 +274,19 @@ msgstr "外部ゾーン"
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:266
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:333
 msgid "Extra arguments"
-msgstr "追加設定"
+msgstr "追加の引数"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:245
 msgid "Extra destination arguments"
-msgstr ""
+msgstr "追加の送信先引数"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:86
 msgid "Extra iptables arguments"
-msgstr ""
+msgstr "追加の iptables 引数"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:235
 msgid "Extra source arguments"
-msgstr ""
+msgstr "追加の送信元引数"
 
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:6
 msgid "Firewall"
@@ -385,7 +396,7 @@ msgstr "IPv4のみ"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js:218
 msgid "IPv6"
-msgstr ""
+msgstr "IPv6"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:202
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:187
@@ -547,6 +558,11 @@ msgid ""
 "invalid values could render the firewall ruleset broken, completely exposing "
 "all services."
 msgstr ""
+"送信元と送信先のトラフィックの区分ルールを、インターフェースやサブネット以外"
+"の基準に基づいてマッチすることができるように、生の iptables 引数を渡します。"
+"これらのオプションは、無効な値がファイアウォール ルールセットの破壊を引き起こ"
+"し、全サービスを外部に晒す恐れがあることに、特段の注意を払い使用されなければ"
+"なりません。"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:94
 #: applications/luci-app-firewall/luasrc/controller/firewall.lua:12
@@ -567,6 +583,8 @@ msgid ""
 "Prevent the installation of <em>NOTRACK</em> rules which would bypass "
 "connection tracking."
 msgstr ""
+"コネクション追跡をバイパスさせる <em>NOTRACK</em> ルールのインストールを防ぎ"
+"ます。"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:153
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:204
@@ -646,36 +664,6 @@ msgstr "ルーティング/NAT のための、ソフトウェアベースのオ
 msgid "Software flow offloading"
 msgstr "ソフトウェア フローオフロード"
 
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-# Generated from applications/luci-fw/luasrc/model/cbi/luci_fw/rrule.lua      #
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-#
-# msgid "Traffic Redirection"
-# msgstr ""
-#
-# msgid ""
-# "Traffic redirection allows you to change the destination address of "
-# "forwarded packets."
-# msgstr ""
-#
-# msgid "Overview"
-# msgstr ""
-#
-# msgid "Name"
-# msgstr ""
-#
-# msgid "Source zone"
-# msgstr ""
-#
-# msgid "Source MAC-address"
-# msgstr ""
-#
-# msgid "Source port"
-# msgstr ""
-#
-# msgid "Protocol"
-# msgstr ""
-#
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:185
 msgid "Source IP address"
 msgstr "送信元IPアドレス"
@@ -834,12 +822,16 @@ msgid ""
 "Use this option to classify zone traffic by raw, non-<em>uci</em> managed "
 "network devices."
 msgstr ""
+"生の、または非 <em>uci</em> 管理下にあるデバイスによるゾーン トラフィックの区"
+"分にこのオプションを使用します。"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:179
 msgid ""
 "Use this option to classify zone traffic by source or destination subnet "
 "instead of networks or devices."
 msgstr ""
+"ネットワークまたはデバイスに代わり、アクセス元またはアクセス先サブネットによ"
+"るゾーン トラフィックの区分にこのオプションを使用します。"
 
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:72
 msgid "Via %s"
@@ -967,6 +959,3 @@ msgstr "タイプ"
 #: applications/luci-app-firewall/luasrc/tools/firewall.lua:130
 msgid "types"
 msgstr "タイプ"
-
-#~ msgid "Output zone"
-#~ msgstr "出力ゾーン"
-- 
cgit v1.2.3