16 files changed, 471 insertions, 26 deletions
diff --git a/net-firewall/Manifest.gz b/net-firewall/Manifest.gz
index bc2ac5e70325..2109a13a1de1 100644
--- a/net-firewall/Manifest.gz
+++ b/net-firewall/Manifest.gz
diff --git a/net-firewall/conntrack-tools/Manifest b/net-firewall/conntrack-tools/Manifest
index a6e2527e8cab..5b292cae2eeb 100644
--- a/net-firewall/conntrack-tools/Manifest
+++ b/net-firewall/conntrack-tools/Manifest
@@ -8,7 +8,7 @@ DIST conntrack-tools-1.4.4.tar.bz2 1010504 BLAKE2B 4190672f017f434b6b4a1841022d6
 DIST conntrack-tools-1.4.5.tar.bz2 479562 BLAKE2B 229531d1c6c237e539df5b83525dca5ce0b009a76a2a5f873282eabc73cc00095c15c686bc68f9364e81efc846bfa8eac8b08f7fd476199d10d0c25190ca2456 SHA512 480fe2cc4420bc8477a2ba67b3d052bcb39c6b3ec000cff27fc12db70b42ec94fa3b5fe12ee35d439e88d9a631a33cd12ae470b69dde6d371d4e53af62a2eed1
 EBUILD conntrack-tools-1.4.2.ebuild 1938 BLAKE2B 8d5f16ddce1d4e49e61f0715d0948869878b424838fb6039cd37729d9cf51cbec51ee743a3d81fa71c4711234a563b83f46a3bae83f87cece59033c0cbee8a3f SHA512 b7bc4438561d199cba668ebc1ef691ea0a7d737cee8beeeed1c703d479d9161da68f6b2125b9555decda6dd9271955f4c146ff002a3c53a5263db9f7a5a95695
 EBUILD conntrack-tools-1.4.3.ebuild 1935 BLAKE2B fa4fd76d7c3ba12748c215971c146c36eaae42e564f2185b99f67181f9cef7da3f5c604a694105987c7ff6e613dced5c26a185c41855e378e93dc670077301f5 SHA512 80fa97972a0dce17a5c08bae77123ac0931115cc3d36414c3cb959fbe9edba6ee33a659fdf5c83a6f4c8dfeef94584059adce56955040c56ae958c00a31ef448
-EBUILD conntrack-tools-1.4.4-r1.ebuild 2081 BLAKE2B daab1b74e21d33ec5565806c6fabf16c9700bfc9a954913fbea9b1757380439094731a82fd045acac01ca9b1f0887d037123ad27a716e1120992273805080b9f SHA512 2988510e7032a74d0372e3ed48ce2e502ba59872fec72d07bfdb530406640402dd6d37d34014e21726ffff1b3d0555c835ab9af7e654f70ba2e087557487824e
+EBUILD conntrack-tools-1.4.4-r1.ebuild 2088 BLAKE2B 002971c3e5a47fa50f84f7d034074ff0a358b64892a592fe6b8692397d1579e595dffc3ce772e1490301ebbfa0d72d8b93870a359ad5fd95f64277786da78d51 SHA512 67ece91406e0137d78119c95bac4a938c546a7e84d47a310d72e0ea3d690540e7c5754566820fa58779773868d682cac1357fa3c620c10dd037b771a04e91671
 EBUILD conntrack-tools-1.4.4.ebuild 1900 BLAKE2B dac0ee63aa964380b8c7866509a8f456abf92593ebe8742fb449199f91a1c02a927a3b027604a7bc1d0ab2977556d57f7184337ad444c451159cb102f7a2751b SHA512 1b009478cd4a93a1aedaab452c947c6c76e0d18cbdbdccef72e995bc7217066883c98c7232fe76a9946b87f8dbb595eef33aba5e21230d22a1c9268171896d83
-EBUILD conntrack-tools-1.4.5.ebuild 2188 BLAKE2B dc49b0649746dc99e4228031e520335d59bea7bbe0c7a54514f52dec53d701f8cbb517afa50a92329a2d916d82cc91feded82a1757dc9718c943f29a93c02b0e SHA512 026fa39a1dce19b428ed7cac3a15a0a56e01828c288a03291a882e2e2f640ec22abdb91463704c226e37dc42a9f8bdc83a56b2001e1a065d98506c11baf6678e
+EBUILD conntrack-tools-1.4.5.ebuild 2195 BLAKE2B 2e3e6340ef8e79f0a5335c1b88e6e95f1cda785ed72c934dae2e36ec88090ebde4b9d01218969f2bb1e96fdeec7b7f653e9c4be4eee5c11c2f6349982b70dbe8 SHA512 ff4197793e82372c6e16546390a26c970be22eb5b889eb26fa8f9a8cc04d5961e9614fc677ef677a011fe0f8ac0e95d5a27201fe3880f0467e789217f6fa3e74
 MISC metadata.xml 958 BLAKE2B 61cf89e7c192b663fd573ba7be767cd359786ba0fff20e72212fbc24e07c0c69e3bc2ee2226d39ac1744620cb1f5c63a480fc073860af665064853f5b780332d SHA512 19c68ca3bc373de0b9d533c7a36cdbe1da52871fb985641fa725c6208ffc09536696b02cce37e836300a2809bab117be2f0046ef329d2a739de5827cf0ee189a
diff --git a/net-firewall/conntrack-tools/conntrack-tools-1.4.4-r1.ebuild b/net-firewall/conntrack-tools/conntrack-tools-1.4.4-r1.ebuild
index af558ac2dce9..457aa7d56063 100644
--- a/net-firewall/conntrack-tools/conntrack-tools-1.4.4-r1.ebuild
+++ b/net-firewall/conntrack-tools/conntrack-tools-1.4.4-r1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="http://www.netfilter.org/projects/conntrack-tools/files/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="amd64 ~arm64 hppa x86"
+KEYWORDS="~alpha amd64 ~arm64 hppa x86"
 IUSE="doc +libtirpc"
 
 RDEPEND="
diff --git a/net-firewall/conntrack-tools/conntrack-tools-1.4.5.ebuild b/net-firewall/conntrack-tools/conntrack-tools-1.4.5.ebuild
index 2ba9b596f3b5..859d974d0023 100644
--- a/net-firewall/conntrack-tools/conntrack-tools-1.4.5.ebuild
+++ b/net-firewall/conntrack-tools/conntrack-tools-1.4.5.ebuild
@@ -10,7 +10,7 @@ SRC_URI="http://www.netfilter.org/projects/conntrack-tools/files/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~arm64 ~hppa ~x86"
+KEYWORDS="~alpha ~amd64 ~arm64 ~hppa ~x86"
 IUSE="doc +cthelper +cttimeout +libtirpc"
 
 RDEPEND="
diff --git a/net-firewall/firehol/Manifest b/net-firewall/firehol/Manifest
index 4eb7c8b42481..579a40c7e1de 100644
--- a/net-firewall/firehol/Manifest
+++ b/net-firewall/firehol/Manifest
@@ -7,6 +7,6 @@ DIST firehol-3.1.4.tar.xz 1481320 BLAKE2B 0fabef4a853aece966a8f273cc82947a6e63ac
 DIST firehol-3.1.6.tar.xz 1484424 BLAKE2B aea45aa424b7b43ed0576916f52a785601a21489263c1b5c6abbf3b2b97db80bf2a2420ae8176cd55e335ab93c18a8209a47f467dba80a63cf2c319b3e3e27d8 SHA512 5ffa7e59d3f10a6c7d3f5b5ef9d93f1b2138063374a10cb0c1ac4e75578d6cf7755e154b51febf546563ba003f100af13f89bca3843b66a8d22b8fc2da3fadfe
 EBUILD firehol-3.1.3-r1.ebuild 1381 BLAKE2B 2fc08f6aff1de75c28548131a5ade1208997ab7d03ed16e6956d536ce25a0aa61dd2f12e607952395f23e7fd8e7a7418b2d74fcfbeed5b2913a5576bd06ae708 SHA512 e0fea503715dd17f301ed856ae2ad42035dc65ed6712896e884a6d9a8207925f5c30182333c887f64127cb34c38346d8a428e2c4ded7a97617f0de2c75b9df7d
 EBUILD firehol-3.1.3.ebuild 1328 BLAKE2B 13e1a54e2ba65475fe68c9c8930d80171d612d45501efec8fb1adc382787e4b5318b30d2c7b499c48ffcf794648aae39da988391ce10be1086ce9ae0bcd84e8a SHA512 3431ba2d4ef30125f45b4873795fb6e29d273a006857399f90d648d2d7a139dd07179e4cc3893139707340b92f4377d8d5004467bf0b6d7b67afe4eadf31df0b
-EBUILD firehol-3.1.4.ebuild 1380 BLAKE2B 39fe7d2ffd96488f407affce7762ba9a3c7a06c2b09988d0e9402c7a955b9db5f825cf1616f60e0b467b82bd32ccecbdd10f3bb5ccb695b7d7616c53577aaaf9 SHA512 9bd5e05c7f45a8be6ee2e93f46f5a78f49abdef24d61d3a4fa6b3f22249d7584b8f4c0f59af9117239e531d85fbed38c8c7d2fec2cbd0981ea9ad1cd6092da54
+EBUILD firehol-3.1.4.ebuild 1376 BLAKE2B 4e162cb7c2d545a2748cba591ea7479dceffaa36eb586700d8d3676fa5672fedf073da5948e80995a3a282a745e887267411c3ba0d8c0683646dc8365eb67020 SHA512 510a6bf0144c47e4ec3c43c9dc8b2f6dd9c9b3da5e8cc52977f7ce2c6c4c344aa906126e0bbc44db56d0eddc6377b81608877e3be8048e1c9252ff1fbcccd24d
 EBUILD firehol-3.1.6.ebuild 1382 BLAKE2B 63e7c43b7503052b9ab8f0573798639f529c3d0d00e41cc71d5b26b923a599c63c2733c930c74dafeab6e18100e5d349879f707081a9da521266b786e8ef82ac SHA512 b1e219c72f288475ba731dc2931fa9d511ae8d0b4efda40f3f0a72af67d0c75cc4bd0a23d8d5411e478daa025b3310467a8a86dc6c01e3c5e2883adc0c966dd5
 MISC metadata.xml 434 BLAKE2B 43111da215ea3d6d6af807ee1b629a3ff72dfefe15fa429a6ea5b112cbfb881d1bf848b50a266c32b820a7aec3e14e419c64657cc0a205c1e759c77b64a17b52 SHA512 9ab3275ada67cf2da92f07d9a332f098330caa81b0a7f5d17a321a03cf6b441e029efab9a8f3eaaff7d7181eb503721aa954c14e0a7982e4f35e16c8eaa57898
diff --git a/net-firewall/firehol/firehol-3.1.4.ebuild b/net-firewall/firehol/firehol-3.1.4.ebuild
index 9857dba9a494..45bbcc4441dc 100644
--- a/net-firewall/firehol/firehol-3.1.4.ebuild
+++ b/net-firewall/firehol/firehol-3.1.4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=6
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/firehol/firehol/releases/download/v${PV}/${P}.tar.xz
 LICENSE="GPL-2"
 SLOT="0"
 IUSE="doc ipv6 ipset"
-KEYWORDS="amd64 ~arm ~ppc ~x86"
+KEYWORDS="amd64 arm ~ppc ~x86"
 
 RDEPEND="net-firewall/iptables
 	sys-apps/iproute2[-minimal,ipv6?]
diff --git a/net-firewall/iptables/Manifest b/net-firewall/iptables/Manifest
index dda5ffdb9cf4..145e8b4dac6b 100644
--- a/net-firewall/iptables/Manifest
+++ b/net-firewall/iptables/Manifest
@@ -1,9 +1,12 @@
 AUX ip6tables-1.4.13.confd 690 BLAKE2B 457beb9caaef166b8d98bddfd3e9f2799439bdfef4dd4acf4e5b7d619ac23b0d2c9f7ad62ab8fe70cb0970b378fbc4b179336c399a078babb2647cb127631b2e SHA512 8de9a5de4061bef217fbc07577688a8110f1116af7f3b936dfd18100a6a7a47ec6e70c456b24cf3432fb4f2034b741a487fe6af8d9740f174d51c6eb16945c6e
+AUX ip6tables-r1.confd 899 BLAKE2B d8c72df359a35798d7a92958ba9a620ab580427a06765850928181d7b4cc25455c586daaad88bd20e61a9c9218dbc0895de38b006526bb04f4f2e998d8062fbe SHA512 553ddf83558edaccf891a366175e47aad950853be0de556581cfa08f614afa1f4139c94b8d8d2884ed69018513edeb966331d4d6a615829ada65fac2066840e5
 AUX iptables-1.4.13-r1.init 2766 BLAKE2B 1941ba5383055bfedd57b8eb6a390cab5fc3438bcf9f2b03a31f7a417ac7c2abaa590d23a8ae4500595c9bbb83da852e27d71f672a2758fe0be45691a461105c SHA512 9b74344043f48ce2a4691f09199cfa752bd7ee360d912d412fe1cf51de54821b0d082c9585a11b84020454f9759af78ff097d7dfc8f5148ef9e987e6d990edde
 AUX iptables-1.4.13.confd 687 BLAKE2B 78b2242454b5f3228661f1e41b790aaa458c1225162a222da5a309a15eca56a531c756a5ceb49e506095461998305189efe136fde0bfe5916cc2d00661de1789 SHA512 bd67d53e997ea65755148ba071fe6e3856d6e604b9167c666900721bc3dc24f63d395bc33a1a34ae50f95e72760da630db1a8d35afc81ec5973e60ba5343dc70
 AUX iptables-1.4.21-configure.patch 1066 BLAKE2B 59bf725aeaae131b57e04b556957dd3316f2282ea5a1d9e931f63865dd48484831c9f7674085b7134e2ef4c2dcddbc3b06c8f8e85a45840746a25e386c390f86 SHA512 45445d1460072ed19ba617be983be82094fdd0535a25de4f6159173de4a08be9bee9da13c7aeea419291beb92402ca25efba3a0e269510e221f7eacc8bcd5176
 AUX iptables-1.4.21-static-connlabel-config.patch 2195 BLAKE2B 237c59c2fd3312efa26181f363c2ad4dfe19b0cb494f90048e50ff464ed8abbb8ec46d406df51b9f3ba75f717a045ebb4fa38cc0ca5741f5efbfc3322171e04f SHA512 d838773bf2db9f97548d2f7eaab0ce3205265a7ec8b274df479fcecb474ba09ed061abae50534c0379a1290479c2e94927595eca0f4570b27744ec165348b6b1
 AUX iptables-1.8.1-build_limit_without_libnftnl_fix.patch 1499 BLAKE2B 01b8f257577b37749da8c7449e5a830373fc7556885be0e1fd8233b2105cde52e95e6393eaee3f2c7b0e335286b89d0b7b638a23921998375b333d8ccf8223df SHA512 a900d1544098f58326537684bd5de20df114402abacf1971c625431a0c03e988382a9b9f4860c761923c9bd54600424ae1a3769e16518a6c6e7ba1f61caf5ddd
+AUX iptables-r1.confd 890 BLAKE2B 0aaca870e3c03f19a71cf1b210377dfda320faf118359e298bef419eaf280fd11c9726d200ae89602e863c9b48de0bb51ac05424b50c064afe948a980e300153 SHA512 10002da01ded6be0e9bca6041798ad0859fa2212fde077a048443e4f3012c95d86e4580ae426e87af5891368062af9af6f9fd35ed617d24cdd3c51702b816b13
+AUX iptables-r2.init 4384 BLAKE2B d11be1725e25d234e01af86c82d3745fd630b15b3ae2228845c5555db5c2ffdcd920fd565480f76ab91ef2d5b26f9ae96432efc288a1b9aa2abfb5b9bb01d7bf SHA512 8897ab985424c895e261e0fe521921f0da8e09e38394655b0f91c65c0e8f603731faf70489f7a6610c83d6c2fde75f92f309405d72277643165a847e62238df7
 AUX iptables.init 2787 BLAKE2B 79c17ba2970d63791dd4d137536b3ccf0f9b6a637d0445049a6fac338ca4e2d1fad927038dfa7ad42a1eb321feac1dc834af09ce0baec554fc9767f199e10b6b SHA512 317c71bee98f5b1bbfd17ea961e5e268532c2320fc865b7876f7cc4e02a66b6a012fc336f8880045a83e101f161197c0a1d106220af6240407cebafbf38022db
 AUX systemd/ip6tables-restore.service 404 BLAKE2B 35cdf804e787aa5cc382cc638de523735ab47b878168c41d8eef85eb592e5bebd9319e75a10db28f0eba6618efae355c90f03ac0798239edeb80d01108e98a47 SHA512 34730df7464354bce11ca5bdceb5cf305e8ab7e2ded2c2689448379e74ff93252e7a83cfe05c2f3238f59a2ade69cd9c328291c28c43b6612bfb7b29fcb0feee
 AUX systemd/ip6tables-store.service 243 BLAKE2B 30a0d955998a2a664c6a95b8e559898a1a48c681b77b6e3e1b2fa6f2ada7204f23df0f0894218599e95c2ccea71024e86cda7c82b6ff5a55d016d04d71cb1487 SHA512 7cee224f91d4c8348606ba176d0d689749a59229958cfdf4e75451d77271363e7cff71dbb7e30dbc4a5a837363a72d70d6960d2dfb218f3ad16456ae109cba10
@@ -18,8 +21,9 @@ DIST iptables-1.8.1.tar.bz2 678706 BLAKE2B 671e7329cc07dae0fbc54c1f6061bc148c482
 DIST iptables-1.8.2.tar.bz2 679858 BLAKE2B 2004d85c89ecbc37ef0d571ac8ece680fd2e11a51b074f6387d6e9c4892da524c785d6bf3f30e26af4e7c2cb1f401d51bf8bcb21a91e380e24945374553139cb SHA512 8cf0f515764e1dc6e03284581d682d1949b33e8f25fea29c27ae856f1089fe8ca7b1814524b85f4378fd1fc7c7c7d002f06557b257ae2bbc945f8555bad0dc76
 EBUILD iptables-1.4.21-r1.ebuild 2442 BLAKE2B caa1b23d35ccb9a8e5631f932fe4a6816358782ea620d71ad1d64498df64b18015b3610f48b345a13caafaca51bb504d364ed4167804383c03d70439ca4154c2 SHA512 b0d5b1de2c24dbe4aa3eec29e3adefac12f72529fa850fbe5b956d1835fc5ea25ceed8172d8b5bc2d5c1bff63a609cae04c3da923c783ccdfeed126ef2bde831
 EBUILD iptables-1.4.21-r5.ebuild 2975 BLAKE2B f9fdeaf8c242b1553b59586346e81735dae31100a435a9cf2d0817c69a8fb6a0652b76944f5261eca8b5c5be60f38db50fb22a3940573e493c3326ec068396e0 SHA512 dab27d6601b69dae4c0be6b48f0cbc7daf7b93066ad398d962f81ec625628d6d2ce9e0188810941364e1cbc7d9c6b4511f3ab832ee736d69d8b977f80d52657d
-EBUILD iptables-1.6.1-r3.ebuild 3252 BLAKE2B f563c16417790e7f44eae5f0492e39b76cbcf88173e29d4e7321aa9cedce927d8c0fd96a342e6c654ba99cae50a92373b935e68c8b057a3f3d01bf4a1f59dda4 SHA512 5d338acc6ac76f184086d244d23a7634af7b7001c4e9520125a284329636275aca456cb3a36f6801e94ef840d4625d5d4eb27aed57172bf2f49dd948e8801861
+EBUILD iptables-1.6.1-r3.ebuild 3251 BLAKE2B a9c05bf1263b59ef1a1005bc87705ec68d951e4462f9ee1f04a54396cd729cd74c0318837a8199530be4ccb2ee2bcc22dae9012670e6a920bf7bee52c7c56b77 SHA512 464f18812e42886f7eebb636bd56f91c668cb9ce22037fb824ac9ade50813cb105cb08bc82566628d63ba8bc97b5dc64ec3b59efb0451e4bf9856a4e592e1a00
 EBUILD iptables-1.6.2-r2.ebuild 3327 BLAKE2B c4d683d81f4d3be5efb9d043d63b8ee7b20f4b735cce0d7e31c85e159d2693568b83b28fe1e517ba658ee240dfd063b7810590cbf94029975992b0e5aeab479e SHA512 dc12b299d205f5404bd6486b36a933b611d567be45e00f8f02dd010036c701510824184a3d3d0d52798c89e5b57bfbe402e79bbfbeb50e4f0d26de1627b387d3
 EBUILD iptables-1.8.1-r1.ebuild 3543 BLAKE2B 9b18e81d1994868695bc098229f612997cedadf8b2970e84650893f4ed6281216121ea56f982ad7621f5da766850189c5e4011039659bc6fd488cb3e9a2afaf5 SHA512 f4d64da35788ffac7391c9b4a7e111bfff519e5d3757c1050ff74eac9da136c8f7f0a05fd32cba63f8e19b42c6f40299e75a13992c10d965643d280bc8b3ac85
+EBUILD iptables-1.8.2-r2.ebuild 3453 BLAKE2B 4fdf1c4c7073a9bdb7fea28a47d99c80dcc0c94f8492603c1038e1bf2919d8df671fbc4660e0178499e29602851f12970467da238e7778741597d176ac711f30 SHA512 97e6edfd93cfc1844e11442eea36654825a591799f89e3cc9088bcc8d57fa4dca77ebbcb1ef948fb08c4126d877794246ad0dd171ae5704d316517662d18a5eb
 EBUILD iptables-1.8.2.ebuild 3468 BLAKE2B 40dd2a8b377d6354604cef6f68f86feb86050f2aa3f3d185cb7019b4ba8aa0ed4c5e198eb3f51590431421fdb715851aff9194c682fd4a11079a75385c525d61 SHA512 13cdd43b8f3c1f9d1a60730275f565bc45499382af4d5a71155e3bccbe5cc750b6b65434c0c642eb3fc40d9cc00f950aaf911f0fd07be3fbfdb773d14d818eda
 MISC metadata.xml 1465 BLAKE2B c60f98672fb6153499b700a436b26b63c0f271c8f8519a3391e486b761ba673c362a7dc5e23b86e3af887270596a1682ea993e643a08215f670f7e3804f095bd SHA512 26bf7e3008dfd705995b15eccaaaa8c79fd488be191570a874b76571a2f9d4648a7c19eb576399ca7bbe849336d7d193f5b6b58a3ff83f87f3c157c53333e987
diff --git a/net-firewall/iptables/files/ip6tables-r1.confd b/net-firewall/iptables/files/ip6tables-r1.confd
new file mode 100644
index 000000000000..e608f41d1ea7
--- /dev/null
+++ b/net-firewall/iptables/files/ip6tables-r1.confd
@@ -0,0 +1,27 @@
+# /etc/conf.d/ip6tables
+
+# Set wait option for xtables lock in seconds
+# DEFAULT: 60
+#IPTABLES_LOCK_WAIT_TIME="60"
+
+# Set wait interval option for xtables lock in microseconds
+# DEFAULT: 1000
+#IPTABLES_LOCK_WAIT_INTERVAL="1000"
+
+# Location in which ip6tables initscript will save set rules on
+# service shutdown
+IP6TABLES_SAVE="/var/lib/ip6tables/rules-save"
+
+# Options to pass to ip6tables-save and ip6tables-restore 
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping ip6tables
+SAVE_ON_STOP="yes"
+
+# If you need to log ip6tables messages as soon as ip6tables starts,
+# AND your logger does NOT depend on the network, then you may wish
+# to uncomment the next line.
+# If your logger depends on the network, and you uncomment this line
+# you will create an unresolvable circular dependency during startup.
+# After commenting or uncommenting this line, you must run 'rc-update -u'.
+#rc_use="logger"
diff --git a/net-firewall/iptables/files/iptables-r1.confd b/net-firewall/iptables/files/iptables-r1.confd
new file mode 100644
index 000000000000..d5055e0a5d23
--- /dev/null
+++ b/net-firewall/iptables/files/iptables-r1.confd
@@ -0,0 +1,27 @@
+# /etc/conf.d/iptables
+
+# Set wait option for xtables lock in seconds
+# DEFAULT: 60
+#IPTABLES_LOCK_WAIT_TIME="60"
+
+# Set wait interval option for xtables lock in microseconds
+# DEFAULT: 1000
+#IPTABLES_LOCK_WAIT_INTERVAL="1000"
+
+# Location in which iptables initscript will save set rules on
+# service shutdown
+IPTABLES_SAVE="/var/lib/iptables/rules-save"
+
+# Options to pass to iptables-save and iptables-restore 
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"
+
+# If you need to log iptables messages as soon as iptables starts,
+# AND your logger does NOT depend on the network, then you may wish
+# to uncomment the next line.
+# If your logger depends on the network, and you uncomment this line
+# you will create an unresolvable circular dependency during startup.
+# After commenting or uncommenting this line, you must run 'rc-update -u'.
+#rc_use="logger"
diff --git a/net-firewall/iptables/files/iptables-r2.init b/net-firewall/iptables/files/iptables-r2.init
new file mode 100755
index 000000000000..3dcabb0dfb41
--- /dev/null
+++ b/net-firewall/iptables/files/iptables-r2.init
@@ -0,0 +1,165 @@
+#!/sbin/openrc-run
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="check save panic"
+extra_started_commands="reload"
+
+iptables_lock_wait_time=${IPTABLES_LOCK_WAIT_TIME:-"60"}
+iptables_lock_wait_interval=${IPTABLES_LOCK_WAIT_INTERVAL:-"1000"}
+
+iptables_name=${SVCNAME}
+case ${iptables_name} in
+	iptables|ip6tables) ;;
+	*) iptables_name="iptables" ;;
+esac
+
+iptables_bin="/sbin/${iptables_name}"
+case ${iptables_name} in
+	iptables)  iptables_proc="/proc/net/ip_tables_names"
+	           iptables_save=${IPTABLES_SAVE};;
+	ip6tables) iptables_proc="/proc/net/ip6_tables_names"
+	           iptables_save=${IP6TABLES_SAVE};;
+esac
+
+depend() {
+	need localmount #434774
+	before net
+}
+
+set_table_policy() {
+	local has_errors=0 chains table=$1 policy=$2
+	case ${table} in
+		nat)    chains="PREROUTING POSTROUTING OUTPUT";;
+		mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
+		filter) chains="INPUT FORWARD OUTPUT";;
+		*)      chains="";;
+	esac
+
+	local chain
+	for chain in ${chains} ; do
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -t ${table} -P ${chain} ${policy}
+		[ $? -ne 0 ] && has_errors=1
+	done
+
+	return ${has_errors}
+}
+
+checkkernel() {
+	if [ ! -e ${iptables_proc} ] ; then
+		eerror "Your kernel lacks ${iptables_name} support, please load"
+		eerror "appropriate modules and try again."
+		return 1
+	fi
+	return 0
+}
+
+checkconfig() {
+	if [ -z "${iptables_save}" -o ! -f "${iptables_save}" ] ; then
+		eerror "Not starting ${iptables_name}.  First create some rules then run:"
+		eerror "/etc/init.d/${iptables_name} save"
+		return 1
+	fi
+	return 0
+}
+
+start_pre() {
+	checkconfig || return 1
+}
+
+start() {
+	ebegin "Loading ${iptables_name} state and starting firewall"
+	${iptables_bin}-restore --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
+	eend $?
+}
+
+stop_pre() {
+	checkkernel || return 1
+}
+
+stop() {
+	if [ "${SAVE_ON_STOP}" = "yes" ] ; then
+		save || return 1
+	fi
+
+	ebegin "Stopping firewall"
+	local has_errors=0 a
+	for a in $(cat ${iptables_proc}) ; do
+		set_table_policy $a ACCEPT
+		[ $? -ne 0 ] && has_errors=1
+
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
+		[ $? -ne 0 ] && has_errors=1
+
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
+		[ $? -ne 0 ] && has_errors=1
+	done
+	eend ${has_errors}
+}
+
+reload() {
+	checkkernel || return 1
+	checkrules || return 1
+	ebegin "Flushing firewall"
+	local has_errors=0 a
+	for a in $(cat ${iptables_proc}) ; do
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
+		[ $? -ne 0 ] && has_errors=1
+
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
+		[ $? -ne 0 ] && has_errors=1
+	done
+	eend ${has_errors}
+
+	start
+}
+
+checkrules() {
+	ebegin "Checking rules"
+	${iptables_bin}-restore --test ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
+	eend $?
+}
+
+check() {
+	# Short name for users of init.d script.
+	checkrules
+}
+
+save() {
+	ebegin "Saving ${iptables_name} state"
+	checkpath -q -d "$(dirname "${iptables_save}")"
+	checkpath -q -m 0600 -f "${iptables_save}"
+	${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${iptables_save}"
+	eend $?
+}
+
+panic() {
+	# use iptables autoload capability to load at least all required
+	# modules and filter table
+	${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -S >/dev/null
+	if [ $? -ne 0 ] ; then
+		eerror "${iptables_bin} failed to load"
+		return 1
+	fi
+
+	if service_started ${iptables_name}; then
+		rc-service ${iptables_name} stop
+	fi
+
+	local has_errors=0 a
+	ebegin "Dropping all packets"
+	for a in $(cat ${iptables_proc}) ; do
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
+		[ $? -ne 0 ] && has_errors=1
+
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
+		[ $? -ne 0 ] && has_errors=1
+
+		if [ "${a}" != "nat" ]; then
+			# The "nat" table is not intended for filtering, the use of DROP is therefore inhibited.
+			set_table_policy $a DROP
+			[ $? -ne 0 ] && has_errors=1
+		fi
+	done
+	eend ${has_errors}
+}
diff --git a/net-firewall/iptables/iptables-1.6.1-r3.ebuild b/net-firewall/iptables/iptables-1.6.1-r3.ebuild
index e919344e870b..1a3c753e2820 100644
--- a/net-firewall/iptables/iptables-1.6.1-r3.ebuild
+++ b/net-firewall/iptables/iptables-1.6.1-r3.ebuild
@@ -16,7 +16,7 @@ LICENSE="GPL-2"
 # Subslot tracks libxtables as that's the one other packages generally link
 # against and iptables changes.  Will have to revisit if other sonames change.
 SLOT="0/12"
-KEYWORDS="~alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86"
 IUSE="conntrack ipv6 netlink nftables pcap static-libs"
 
 COMMON_DEPEND="
diff --git a/net-firewall/iptables/iptables-1.8.2-r2.ebuild b/net-firewall/iptables/iptables-1.8.2-r2.ebuild
new file mode 100644
index 000000000000..3a922d3ad650
--- /dev/null
+++ b/net-firewall/iptables/iptables-1.8.2-r2.ebuild
@@ -0,0 +1,129 @@
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+# Force users doing their own patches to install their own tools
+AUTOTOOLS_AUTO_DEPEND=no
+
+inherit multilib systemd toolchain-funcs autotools flag-o-matic
+
+DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
+HOMEPAGE="https://www.netfilter.org/projects/iptables/"
+SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+# Subslot tracks libxtables as that's the one other packages generally link
+# against and iptables changes.  Will have to revisit if other sonames change.
+SLOT="0/12"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+IUSE="conntrack ipv6 netlink nftables pcap static-libs"
+
+COMMON_DEPEND="
+	conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
+	netlink? ( net-libs/libnfnetlink )
+	nftables? (
+		>=net-libs/libmnl-1.0:0=
+		>=net-libs/libnftnl-1.1.1:0=
+	)
+	pcap? ( net-libs/libpcap )
+"
+DEPEND="${COMMON_DEPEND}
+	virtual/os-headers
+	>=sys-kernel/linux-headers-4.4:0
+	virtual/pkgconfig
+	nftables? (
+		sys-devel/flex
+		virtual/yacc
+	)
+"
+RDEPEND="${COMMON_DEPEND}
+	nftables? ( net-misc/ethertypes )
+"
+
+src_prepare() {
+	# use the saner headers from the kernel
+	rm -f include/linux/{kernel,types}.h
+
+	# Only run autotools if user patched something
+	eapply_user && eautoreconf || elibtoolize
+}
+
+src_configure() {
+	# Some libs use $(AR) rather than libtool to build #444282
+	tc-export AR
+
+	# Hack around struct mismatches between userland & kernel for some ABIs. #472388
+	use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
+
+	sed -i \
+		-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
+		-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
+		configure || die
+
+	local myeconfargs=(
+		--sbindir="${EPREFIX}/sbin"
+		--libexecdir="${EPREFIX}/$(get_libdir)"
+		--enable-devel
+		--enable-shared
+		$(use_enable nftables)
+		$(use_enable pcap bpf-compiler)
+		$(use_enable pcap nfsynproxy)
+		$(use_enable static-libs static)
+		$(use_enable ipv6)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	# Deal with parallel build errors.
+	use nftables && emake -C iptables xtables-config-parser.h
+	emake V=1
+}
+
+src_install() {
+	default
+	dodoc INCOMPATIBILITIES iptables/iptables.xslt
+
+	# all the iptables binaries are in /sbin, so might as well
+	# put these small files in with them
+	into /
+	dosbin iptables/iptables-apply
+	dosym iptables-apply /sbin/ip6tables-apply
+	doman iptables/iptables-apply.8
+
+	insinto /usr/include
+	doins include/iptables.h $(use ipv6 && echo include/ip6tables.h)
+	insinto /usr/include/iptables
+	doins include/iptables/internal.h
+
+	keepdir /var/lib/iptables
+	newinitd "${FILESDIR}"/${PN}-r2.init iptables
+	newconfd "${FILESDIR}"/${PN}-r1.confd iptables
+	if use ipv6 ; then
+		keepdir /var/lib/ip6tables
+		dosym iptables /etc/init.d/ip6tables
+		newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
+	fi
+
+	if use nftables; then
+		# Bug 647458
+		rm "${ED%/}"/etc/ethertypes || die
+
+		# Bug 660886
+		rm "${ED%/}"/sbin/{arptables,ebtables} || die
+
+		# Bug 669894
+		rm "${ED%/}"/sbin/ebtables-{save,restore} || die
+	fi
+
+	systemd_dounit "${FILESDIR}"/systemd/iptables-{re,}store.service
+	if use ipv6 ; then
+		systemd_dounit "${FILESDIR}"/systemd/ip6tables-{re,}store.service
+	fi
+
+	# Move important libs to /lib #332175
+	gen_usr_ldscript -a ip{4,6}tc iptc xtables
+
+	find "${ED}" -name "*.la" -delete || die
+}
diff --git a/net-firewall/nftables/Manifest b/net-firewall/nftables/Manifest
index 70e0cd29edf1..1957586692d9 100644
--- a/net-firewall/nftables/Manifest
+++ b/net-firewall/nftables/Manifest
@@ -7,5 +7,6 @@ DIST nftables-0.8.tar.gz 327629 BLAKE2B a484c22ac010f68fc7458c12cabd0c35e474a0bf
 DIST nftables-0.9.0.tar.gz 417981 BLAKE2B 4dfba4d71928f1694ffeb4871353fc373d88e23c5ba716e726e1e6aba0efb2703233528f7a408bfefe47bfe54aa3612cccab9742c2a2208ec8c7a4bcda0e1823 SHA512 78e383bad5440c9414202cf0e4b6749fc5c01071d2fa547208e61cea6e7e179933990e7e538a60696eb0a7cf510d2c4b273a91d50287bb51507d244cd2875aed
 EBUILD nftables-0.8-r3.ebuild 1959 BLAKE2B a029fd4444f5aeddedfbdcb3659f879c4a8f6246c25042449cb5ffa7809401a7ef512275dc1f45c50b51bc2807b3679d1c386bcb2470522ba1a338dc728bdb15 SHA512 6bd510183e9d1cec3fa05970adccf28ac21c7ad839f3a6236ee584d1308c48988ee2b006630ecd558954cb80a7a8faf6e78ab9b06b29df4b2a69161a9e848c71
 EBUILD nftables-0.8.5.ebuild 1937 BLAKE2B b24ea2b8978dc0294c2d27a90aa205916ddeb04c2b66f0adc7e870705a6ffac8ac0e3bf5a95e3c79c27965f780c0ca94ba21bcb5abad49ce49b50ff00c2046fd SHA512 f5f461225c68ed17450380d467f79d87302f0d1c1d69ddb15f90b6a938ea79906e165e6564db8135f07eafc35fb89acfab7659a97d62c7c71ac0376953ff6954
+EBUILD nftables-0.9.0-r1.ebuild 2079 BLAKE2B 303d82b14d13f49c7ed5222d69025eaf0d73e3ec617655b33224b8a1f14e4a16a9d9e71a60270cb3e015bb009efb43ccb419a722a4780cdba50cc2ea341a3eda SHA512 68386a156baa050c83f6233516f8e37f871a2be203d71c751eeefbfbbfe52f114201c2a6eced8bfa194ca8e87c9ad62d6370096c0ceab6e60927cf236c12dfe6
 EBUILD nftables-0.9.0.ebuild 1989 BLAKE2B 3c1e318030d8287b0db2b2ebda3e528703ac73bdf146c147c5c7f8929e9339f9c4c6df08fc829a0ad55f4634b0910e8acfeeb9a31577ba6e61663839c6978a5f SHA512 627c70f4bb60fdbea3f57e676acfb84ed0a4779b6b98b352be766463ca2c564ebcd1a540719e2085b59b8b87fd8dfe7bb1cc6b6d91ec5fe4aac79f53c3c1c496
 MISC metadata.xml 466 BLAKE2B 535df1fe78a4cc4da0375e8db9b3d641ed19736f1992d361203f2e2088aaad7d86a0d547cc9b9139f36837cf6edf6dadea3c17f54b562e6061db52579659f806 SHA512 59494d7efc5f49a417c623410bbda4f891a47a4e1a8a43c8b7357978618401e80595c52113d7aaf8a6171ccacca50fe101c9b5bdbe070f0e993829b72693c931
diff --git a/net-firewall/nftables/nftables-0.9.0-r1.ebuild b/net-firewall/nftables/nftables-0.9.0-r1.ebuild
new file mode 100644
index 000000000000..09ccb7d40011
--- /dev/null
+++ b/net-firewall/nftables/nftables-0.9.0-r1.ebuild
@@ -0,0 +1,89 @@
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit autotools linux-info systemd
+
+DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
+HOMEPAGE="https://netfilter.org/projects/nftables/"
+SRC_URI="https://git.netfilter.org/nftables/snapshot/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ia64 ~x86"
+IUSE="debug doc +gmp json +readline"
+
+RDEPEND=">=net-libs/libmnl-1.0.3:0=
+	gmp? ( dev-libs/gmp:0= )
+	json? ( dev-libs/jansson )
+	readline? ( sys-libs/readline:0= )
+	>=net-libs/libnftnl-1.1.1:0="
+
+DEPEND="${RDEPEND}
+	>=app-text/docbook2X-0.8.8-r4
+	doc? ( >=app-text/dblatex-0.3.7 )
+	sys-devel/bison
+	sys-devel/flex
+	virtual/pkgconfig"
+
+S="${WORKDIR}/v${PV}"
+
+pkg_setup() {
+	if kernel_is ge 3 13; then
+		CONFIG_CHECK="~NF_TABLES"
+		linux-info_pkg_setup
+	else
+		eerror "This package requires kernel version 3.13 or newer to work properly."
+	fi
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--sbindir="${EPREFIX}"/sbin
+		$(use_enable debug)
+		$(use_enable doc pdf-doc)
+		$(use_with !gmp mini_gmp)
+		$(use_with json)
+		$(use_with readline cli)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	exeinto /usr/libexec/${PN}
+	doexe "${FILESDIR}"/libexec/${PN}.sh
+
+	newconfd "${FILESDIR}"/${PN}.confd ${PN}
+	newinitd "${FILESDIR}"/${PN}.init ${PN}
+	keepdir /var/lib/nftables
+
+	systemd_dounit "${FILESDIR}"/systemd/${PN}-restore.service
+	systemd_enable_service basic.target ${PN}-restore.service
+
+	docinto /usr/share/doc/${PF}/skels
+	dodoc "${D}"/etc/nftables/*
+	rm -R "${D}"/etc/nftables
+}
+
+pkg_postinst() {
+	local save_file
+	save_file="${EROOT%/}/var/lib/nftables/rules-save"
+
+	# In order for the nftables-restore systemd service to start
+	# the save_file must exist.
+	if [[ ! -f ${save_file} ]]; then
+		touch ${save_file}
+	fi
+
+	elog "If you are creating firewall rules before the next system restart "
+	elog "the nftables-restore service must be manually started in order to "
+	elog "save those rules on shutdown."
+}
diff --git a/net-firewall/shorewall/Manifest b/net-firewall/shorewall/Manifest
index c8592ba2a120..9caf45b90479 100644
--- a/net-firewall/shorewall/Manifest
+++ b/net-firewall/shorewall/Manifest
@@ -15,12 +15,12 @@ AUX shorewall.systemd 568 BLAKE2B 385edad8857f029f691481483cc3e5e5981836254b7b39
 AUX shorewall6-lite.systemd 612 BLAKE2B e658af2b6d399fe527a58201b80997651954df67a18be2465a1099b81f7ed89cc3c63d4ef550521d3b9e3cc995915439e21e1142f46f8df1e44e22b5c29009d5 SHA512 0bd832d4f8857bf9b1c9c776a53739d8666f002d1caab29c976a248916cf1eb5806d6b59dbf7ee8a120a3158b10e6fa6e179e34fe9fa6077a794ffa7d1e06cec
 AUX shorewall6.systemd 577 BLAKE2B 5c755c0105954a34e39e077af0e012d9d6e647715a4b12fbae4fc47f4ae19afd6a63266b3684ddead689b2d4f7450b7a12906258fc86ef33fc36a4dac3771274 SHA512 96b69df246a18e8b7dbfdbe78959da1baa8f2a97eb290853d4040a895f2ae91b97addd2ab4e4e19345960ffe8f1b099442f40ce319b27f0d4d8d7d4780d2e78d
 AUX shorewallrc-r3 2035 BLAKE2B 6f4e4c93cee1f25405cc3ac76958064f1241a325c8b530c30f6dbd94423577d592e88613f463c4b41c1af1db22c7e53512fd8509931bb6527a8da669f2dbe773 SHA512 eaa32bf6baca0d3555db918d6221c7678f5ba67e78bf9dcdc1bf96deded8f64838d3a332226fa6605f0c1ae82e51e0f2c1540fa6188fd9bced22460a631f48a8
-DIST shorewall-5.2.1.1.tar.bz2 552739 BLAKE2B bfbfdb3320eb884b965f3c7b8d5af61a78bb625a10ad2bc493a5c8a191d676d933855335209a41f893ccb2edb644cf510930da936227fad9fb667793dce88e91 SHA512 59e1b4bb09114162911f0cb42d67df0d82c5a4410322ceb972506705c10cf903cb482123a00181399da99513c857d382771de36ec11433ff7bd9d57a343c48dc
-DIST shorewall-core-5.2.1.1.tar.bz2 78022 BLAKE2B dfa53a4558ec819feee25116021e410ac65dfad20d3d9384e3a233d47e7e443957149d025166d094397fb2c01b8be7694db8c06e927776250b5edafa97e5d287 SHA512 0c12d5deb4a93fb174a7c97459f2863149eec52ab778c30523c23cbdfbeb94d890442a0eb8ad9869158a967f2daac59a9d7194734e35e69982889d93d984b58b
-DIST shorewall-docs-html-5.2.1.1.tar.bz2 4303275 BLAKE2B d2a9c980f0486671103653a6944e12f03e282bd859a9c06558d6dbfdf9fd6a7c72993355ab61138c94317d36228cbbb55903c9d17547ecdc18af57e989a5ef7b SHA512 c9eef71fdc53a97a523a580c5df0c7773f7dc6fc8abfbfe7a2fbc607be6d0e6377f47886001a87a37260118edb298880abda06e3ac4581d8551b3934791332fc
-DIST shorewall-init-5.2.1.1.tar.bz2 33215 BLAKE2B 3b151f60e368cd4237a8549d6de14ec4ed896c2c838f680a59aa12492c46bfb48accfa1a5bc98877663523861040af4995628e75f693c9fa5433483ef0fc6161 SHA512 21cdccc01b60df48e7e1204102c0b371d7e32fb1f897310e31a6cff128ebf5ed5efe3903bc487aa41ee093c23eb87e59764b78903ee5c6eba03552a1dcccc634
-DIST shorewall-lite-5.2.1.1.tar.bz2 39020 BLAKE2B 40697930bb2251062a126a4bd86cd8379d32d9543f32d67208106205b35d3ae9cb9a67e48a48451053ae90138ffcda6cbe5dd5ce7c25bda6eab340dd4680bec8 SHA512 c10ee8ec81817fe8fc35caac253a89fb58be105fa1fb1c692d269f6916537007d555daeba4e5445568a6a6972dfc6db3e21f5637844c6a5e51e91b2a4795724d
-DIST shorewall6-5.2.1.1.tar.bz2 191039 BLAKE2B 4d40d30d4d6ad6a9aacf4acc4da6a4b31546a07969f12fde0d568f75e31ca587a31a830f386092ec0061df8cbff4032402c834e374076097fedb5de18127071b SHA512 0eb342a89f875527242be5e91c64a2debb7e2d159f5edc7f53a86c504e4e782f5635dd4e52b573526d1528d4aa4944384f52f68dc9a7c25513c3e5b2a7922b8c
-DIST shorewall6-lite-5.2.1.1.tar.bz2 38766 BLAKE2B 3a60a877516676a85f5d5d645ce3140c92438c7bb44abb5d8b8e188611bc14a0f3611e977a26526e6408439dd29eb00584217230e20e94ead9f5cbab73a980b3 SHA512 3df814352027ef9f16df030c7187eaa4d7b984cbb23e123eaa19a123a85e276a730b510ff7a76cafba80978474ed5bcb57a4b569332396780e14f7aa7d0d8669
-EBUILD shorewall-5.2.1.1.ebuild 17002 BLAKE2B 72da8a4b999f3cdefcc487019542ab52e0fb6a701d4dbed620fd27ebb4b081469894333efd08dc72e9f044a5c634b97178d95e0930ffdec635d3069ab5146876 SHA512 420539c11f0d5aa81595bd96cd4dabb3036eeba90d604761b845d5b2fd7b2c23d0047e9a367b0fb26c766ead0295e37cb584ae8acc4e65fff32ecff6164503ba
+DIST shorewall-5.2.1.4.tar.bz2 554756 BLAKE2B cfbc917fb12049a0e8817c478fcccb93b02634ad9aebcd31a839f934e52890f6c20dc2a7d10742d4e10ac0adb1500d9e6445b43390db5bc28874e610b9c07939 SHA512 3682399ddc743c03965e0c0c26b5714e611d186bddf9169524268488cc4f2d6e9e9fb3b2a4c24408cc247ce7d32f793fb35090f85b73a645bb0dd0e99c671564
+DIST shorewall-core-5.2.1.4.tar.bz2 78957 BLAKE2B 7310813f4c4ac57378ed9565b1aa32fc3db3bcf9e1dc6e6307a7c399465a051110262dcb78c6d465a6227beeadc1f5c4a82d204c1926f66bcecf5469dc44b5e3 SHA512 9418cb6ef14def2a1a2c7879c6364881d80245ff5a59996bb71d093c14e67c6ce1d462d0217f0ae8574e9a916d3796f945dbececbe6b9851f892022f29a389c9
+DIST shorewall-docs-html-5.2.1.4.tar.bz2 4303361 BLAKE2B 22f7a94d9cb0de5ee9903e8d05498a6a6de6ea643f2d08b709bf9f8dd516ba507f80ed11207973884905421443eedf56e3693b9e42f5f372515b957e2be8132c SHA512 44bb66feecac927de6fe1cdfba9247e9f01c982c3b105f7cd68348fee0803b9b7bd76e7551528e0b2d6ff8e65e6ebf8a05c26831871a98565374692d6405f34a
+DIST shorewall-init-5.2.1.4.tar.bz2 34088 BLAKE2B f285b04e448584fe1f9a5528b6ddb6e16cbedcfda51f9c9925228835b2b065c658e9314ecad23364dc4ee21579fa113fe5a1c5581ea3e7c310d12744de64798d SHA512 58044bbcd2f30aaecb3c02374ca21a51b6f5fee49e9cf9565444649d64e3babd3070a72eddaccb52224201064e8642f9bcd9979bde41c13bfe10438720911d24
+DIST shorewall-lite-5.2.1.4.tar.bz2 39858 BLAKE2B dcaf1adfc20640c22cdca20e2b786ec4ad2736567c0c5eec6cd22a95f0b0c461b24826afa933eac7a1ecffd836da55b8053a1370623d73dd6434b91d59d63e36 SHA512 25712a264ee615b4b0ae038836636ea07f4fedca721759b3860912838ef1aee4535831ed4dd8abd670e082e9f59bd52ac00fb0fd1c5907786bb239e270d5fdf1
+DIST shorewall6-5.2.1.4.tar.bz2 191855 BLAKE2B 3967e715ca88c85fd05f0cce1d4836c2b7f17b7a7360698c269b109f54dfbac2c4d67958c3c8c2d8cb74b5117d7f8ac30dc9ab3c09d97243cffe21ef3005c7b7 SHA512 8b49f187b7141c3eedb02c64a17fe8fa3f01e4b40b33184c4b4c5914e65557595828f87f3e1534abb973320b7a1103b10296b6dfc316ea78f698aeb61a0d63a1
+DIST shorewall6-lite-5.2.1.4.tar.bz2 39599 BLAKE2B cb0e2b45fecc4c126504f5caafcd291e919542cd08fb53d69f89c11d4bca784744e2c6eedc0e86a234bcfe7dd9baee46498de1600bdba4475be6a705c92faa54 SHA512 a994cc1a37174ac085d784c5638eb9c5713e6f191260857c7b288a5ba5c54e3d99e88fb31a5b887d3d637edbd2ba8c7711575ca323d616f49b7a0595431b6e13
+EBUILD shorewall-5.2.1.4.ebuild 17106 BLAKE2B b8b7c9102d95232a92437c39851ed621d32d53e69cd44f7a6030670dda3db5e66e1a9639e2a434411b4e735189c43cf2ee40b141413cbcd8eb6b9ef5a5b2648e SHA512 40ecf6a362deff9174783baaeb87f418e17af3bd85814b8a20ff898ea531ffb13bfde13e1abe4b276ce7db93972e430ecdc73c8f622331ce05938f301a5a7adf
 MISC metadata.xml 2254 BLAKE2B e9d48407a0f055415070f5b0266ed9f534768f6d17d52b7070de30a037b89dbd08daac40b0ec313b8dfc65ba40ff38dae96c9758b78ec66d100ac8fa6b870d5f SHA512 0a201cf40dd1282b52897f751903baf28a2eb284b94316a45d8af6879f995dde1cdd4a7d474293835a0bde801ce41497bde558a51035a5e3650f0ec098688f33
diff --git a/net-firewall/shorewall/shorewall-5.2.1.1.ebuild b/net-firewall/shorewall/shorewall-5.2.1.4.ebuild
index 9bbd07625123..206f56bc7453 100644
--- a/net-firewall/shorewall/shorewall-5.2.1.1.ebuild
+++ b/net-firewall/shorewall/shorewall-5.2.1.4.ebuild
@@ -127,18 +127,21 @@ pkg_pretend() {
 	local WARNING_CONNTRACK="Without NF_CONNTRACK support, you will be unable"
 	local WARNING_CONNTRACK+=" to run any shorewall-based firewall on the local system."
 
-	if use ipv4 || use lite4; then
-		CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV4"
+	# kernel >=4.19 has unified NF_CONNTRACK module, bug 671176
+	if kernel_is -lt 4 19; then
+		if use ipv4 || use lite4; then
+			CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV4"
 
-		local WARNING_CONNTRACK_IPV4="Without NF_CONNTRACK_IPV4 support, you will"
-		local WARNING_CONNTRACK_IPV4+=" be unable to run any shorewall-based IPv4 firewall on the local system."
-	fi
+			local WARNING_CONNTRACK_IPV4="Without NF_CONNTRACK_IPV4 support, you will"
+			local WARNING_CONNTRACK_IPV4+=" be unable to run any shorewall-based IPv4 firewall on the local system."
+		fi
 
-	if use ipv6 || use lite6; then
-		CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV6"
+		if use ipv6 || use lite6; then
+			CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV6"
 
-		local WARNING_CONNTRACK_IPV6="Without NF_CONNTRACK_IPV6 support, you will"
-		local WARNING_CONNTRACK_IPV6+=" be unable to run any shorewall-based IPv6 firewall on the local system."
+			local WARNING_CONNTRACK_IPV6="Without NF_CONNTRACK_IPV6 support, you will"
+			local WARNING_CONNTRACK_IPV6+=" be unable to run any shorewall-based IPv6 firewall on the local system."
+		fi
 	fi
 
 	check_extra_config