[Software Release] Next-Gen Firewall Build v26.2.1 for Banana Pi BPI-R4 (MT7988A / Kernel 6.12)

nexwall · November 12, 2026, 1:56am

Hi BPI Team and community,

Following our releases for the OpenWrt One and the Banana Pi BPI-R3, I’m excited to share that we have now compiled and optimized a Next-Gen Firewall (NGFW) build (v26.2.1) natively for the Banana Pi BPI-R4 (MediaTek MT7988A / Filogic 880, Quad-Core aarch64_cortex-a73), running on Linux Kernel 6.12.94 (OpenWrt v25.12.5) with full hardware support for 10GbE SFP+ cages, 2.5GbE/1GbE switch ports, PWM fan control, hardware crypto (safexcel), PCIe/M.2 NVMe slots, and optional Wi-Fi 7 (mt7996e) modules.

Hardware, RAM & High-Throughput Optimization

Unconstrained Performance on 4 GiB / 8 GiB RAM: Leveraging the BPI-R4’s 4 GiB / 8 GiB DDR4 RAM and faster Cortex-A73 cores to run every security and inspection engine simultaneously with massive headroom for multi-gigabit routing and VPN throughput.
Flexible Boot & Multi-Flash: Full support for SD Card, eMMC, and SPI-NAND architectures using standard OpenWrt boot-switch workflows.
Heavy I/O Offloading: Uses external storage (M.2 NVMe / eMMC / USB3) at /mnt/data for logs, feeds, caching, and analytics to protect onboard flash.

Features Included & Design Philosophy

Setup & Profiles: Features a Zero-Complexity Startup Wizard and environment security profiles (School, Work, Home) with pre-tuned application and content rules.
Active Security & Visibility: Includes deep traffic analytics, Netify Application Control, Squid Proxy with SSL Inspection, ClamAV / YARA Antivirus, Cloud Sandbox, Snort 3 IPS, DNS filtering, and automated IP/country blocking.
Enterprise Connectivity: Built-in WireGuard, OpenVPN, IPsec, and a simplified policy engine (NAT, QoS, SD-WAN).
Wireless Ready: When the optional Wi-Fi 7 module is installed, wireless interfaces are auto-configured, bridged to LAN, and manageable via a dedicated local settings page at https://192.168.1.1/wifi (plus CLI commands in the attached KBA).

First-Boot & Accessing the Box

Web UI & Wizard: Access https://192.168.1.1 via eth1 (LAN/Wi-Fi bridge with DHCP) to run the wizard, select your security profile, and disable WAN management access if desired.
Default Credentials: Web UI (admin / nexwall) and CLI/SSH (root / nexwall). (Note: SSH and Web Admin are active on both eth1 LAN and eth2 WAN by default in this build, and can be disabled directly inside the wizard).
Default Wi-Fi (When Radio Installed): SSID Internet_segura (case-sensitive), WPA2 password internetinternet (please change upon first boot).

Available Release Assets

(Note: Do not flash BPI-R4 images on BPI-R3, BPI-R4 PoE 2.5GE, or BPI-R4 Lite).

nexwall-26.2.1-mediatek-filogic-bananapi_bpi-r4-sdcard.img.gz (SD card image)
nexwall-26.2.1-mediatek-filogic-bananapi_bpi-r4-squashfs-sysupgrade.itb (Sysupgrade / eMMC & NAND)
sha256sums (Preloader, BL31 U-Boot FIP, and *-emmc-gpt.bin partition table included for emmc and snand)

GitHub Release v26.2.1-bpi-r4: Release Next-Gen Firewall Build v26.2.1 for Banana Pi BPI-R4 · nexwall/nexwall-bananapi-fw · GitHub
Administrative Docs: https://docs.nexwall.com.br
Release Notes: https://releasenotes.nexwall.com.br

Feedback on 10GbE SFP+ throughput, Wi-Fi 7 stability, and thermals is welcome! KBA-WIFI-CLI.en.md (8,2,KB)