Hi BPI Team and community,
Following our release for the OpenWrt One, I’m excited to share that we have now compiled and optimized a Next-Gen Firewall (NGFW) build (v26.2.1) natively for the Banana Pi BPI-R3 (MediaTek MT7986 / Filogic 830, aarch64_cortex-a53), running on Linux Kernel 6.12.94 (OpenWrt v25.12.5) with full hardware support for SFP cages, Wi-Fi 6 (mt7915e), PWM fan control, hardware crypto (safexcel), and storage.
Hardware, RAM & Storage Optimization
- Full Module Suite on 2 GiB RAM: Leveraging the BPI-R3’s 2 GiB RAM to run all security and inspection modules simultaneously, peaking at ~1.6–1.8 GiB under heavy load.
- Flexible Boot & Multi-Flash: Full support for SD Card, eMMC, SPI-NAND, and SPI-NOR architectures using standard OpenWrt boot-switch workflows.
- Heavy I/O Offloading: Uses external storage (M.2 NVMe / USB3 / eMMC) at
/mnt/datafor logs, feeds, caching, and analytics.
Features Included & Design Philosophy
- Setup & Profiles: Features a Zero-Complexity Startup Wizard and environment security profiles (School, Work, Home) with pre-tuned application and content rules.
- Active Security & Visibility: Includes deep traffic analytics, Netify Application Control, Squid Proxy with SSL Inspection, ClamAV/YARA Antivirus, Cloud Sandbox, Snort 3 IPS, DNS filtering, and automated IP/country blocking.
- Enterprise Connectivity: Built-in WireGuard, OpenVPN, IPsec, and a simplified policy engine (NAT, QoS, SD-WAN).
- Wireless: Enabled out of the box, bridged to LAN, with a dedicated local settings page at
https://192.168.1.1/wifi(plus CLI commands in the attached KBA).
First-Boot & Accessing the Box
- Web UI & Wizard: Access
https://192.168.1.1viaeth1(LAN/Wi-Fi bridge with DHCP) to run the wizard and select your security profile. - Default Credentials: Web UI and CLI/SSH (
root/admin) use usernameadmin/nexwall(note that SSH/Web Admin are active on botheth1LAN andeth2WAN by default in this build). - Default Wi-Fi: SSID
Internet_segura, WPA2 passwordinternetinternet(please change upon first boot).
Available Release Assets
(Note: Do not flash BPI-R3 images on BPI-R4; a dedicated BPI-R4 release is available separately).
nexwall-26.2.1-mediatek-filogic-bananapi_bpi-r3-sdcard.img.gz(SD card image)nexwall-26.2.1-mediatek-filogic-bananapi_bpi-r3-squashfs-sysupgrade.itb(Sysupgrade / eMMC & NAND)sha256sums(Preloader & bl31-uboot FIP files included)
GitHub Release v26.2.1-bpi-r3: Release Next-Gen Firewall Build v26.2.1 for Banana Pi BPI-R3 · nexwall/nexwall-bananapi-fw · GitHub
Administrative Docs: https://docs.nexwall.com.br
Release Notes: https://releasenotes.nexwall.com.br
Feedback on SFP throughput, Wi-Fi 6 stability, and thermals is welcome!
KBA-WIFI-CLI.en.md (8,2,KB)
