[Software Release] Nexwall Firewall v26.2.1 ported for the Banana Pi BPI-R3 (MT7986 / Kernel 6.12)

Banana Pi Router design BPI-R3/R3 Mini(MT7986)
1

Hi BPI Team and community,

Following our release for the OpenWrt One, I’m excited to share that we have now compiled and optimized Nexwall Firewall (v26.2.1) natively for the Banana Pi BPI-R3 (MediaTek MT7986 / Filogic 830, aarch64_cortex-a53).

This build runs on Linux Kernel 6.12.94 (based on OpenWrt v25.12.5) and includes full hardware support for the R3’s SFP cages, Wi-Fi 6 (mt7915e), PWM fan control, hardware crypto offload (safexcel), and storage interfaces.

:floppy_disk: Hardware, RAM & Storage Optimization

  • Full Module Suite on 2 GiB RAM: Unlike more constrained boards, the BPI-R3’s 2 GiB RAM allows us to enable all Nexwall security modules simultaneously out of the box. Under heavy load testing with all inspection engines active, memory utilization peaks smoothly around 1.8 GiB, leaving stable headroom for routing and packet offloading.
  • Flexible Boot & Flash Support: Built with full support for the R3’s multi-boot architecture (SD Card, eMMC, SPI-NAND, and SPI-NOR). You can boot directly via the .img.gz on an SD card and migrate to eMMC or NAND using the standard OpenWrt boot-switch workflow.
  • Heavy I/O Offloading: Designed to leverage external storage (M.2 NVMe / USB3 / eMMC) for heavy disk operations—such as threat intelligence feeds, live analytics charts, web proxy caching, and deep traffic logs.

:shield: Features Included & Design Philosophy

Nexwall turns the BPI-R3 into a full-featured Next-Gen Firewall (NGFW) built around simplicity and minimal first principles—giving you full enterprise protection without requiring complex manual tuning:

  • Zero-Complexity Startup Wizard: The initial setup wizard configures the entire firewall on its own without requiring advanced networking knowledge, and ongoing management is designed to be clean and intuitive.
  • Environment Security Profiles (School, Work, Home): Choose a tailored security profile during setup. Each profile automatically applies pre-tuned Application Control rules, blocked web categories, and content filtering suited for that specific environment.
  • Deep Traffic Visibility: Real-time throughput analytics, live connection tracking, and granular block logs.
  • Active Security Services: Application Control, Web Protection (Proxy), SSL Inspection, AV, Sandbox (free cloud service), Intrusion Prevention System (IPS) with live engine health, DNS filtering, and automated IP/country blocking.
  • Enterprise VPNs: Built-in WireGuard, OpenVPN (remote access), and IPsec (site-to-site).
  • Simplified Policy Engine: Plain-language firewall rules, NAT, QoS, SD-WAN, and zone-based matrices.
  • Wireless Pre-Configured: Wi-Fi is enabled out of the box and bridged to the LAN. (See the attached KBA file for CLI wireless configuration commands).

:key: First-Boot & Accessing the Box

  • LAN & Web Wizard: eth1 is configured as LAN (bridged with Wi-Fi) with DHCP enabled. Access the Web UI at https://192.168.1.1 to launch the startup wizard, select your School, Work, or Home security profile, update passwords, and disable WAN management access if desired.
  • Default Credentials & WAN Access: Out of the box, the system boots with all protection engines active:
    • Web UI: User admin / Password nexwall
    • CLI / SSH: User root / Password nexwall (By default, SSH and Web Admin are enabled on both eth1 LAN and eth2 WAN for initial remote provisioning, and can be easily disabled directly inside the startup wizard).
  • Default Wi-Fi: Starts enabled with SSID Internet_segura (case-sensitive) and default WPA2 password internetinternet.

:package: Available Release Assets

The compiled images and bootloader binaries are hosted on our public GitHub repository (Note: this release is specifically for the BPI-R3; BPI-R4 builds are planned next):

  • nexwall-26.2.1-mediatek-filogic-bananapi_bpi-r3-sdcard.img.gz (Ready-to-flash SD card image)
  • nexwall-26.2.1-mediatek-filogic-bananapi_bpi-r3-squashfs-sysupgrade.itb (Sysupgrade / eMMC & NAND deployment)
  • sha256sums (Plus individual preloader & bl31-uboot FIP files for NOR/SNAND/eMMC)

:point_right: Get the Files (GitHub Release v26.2.1-bpi-r3): Release Nexwall Firewall v26.2.1 for Banana Pi BPI-R3 · nexwall/nexwall-bananapi-fw · GitHub

:point_right: Administrative Docs: https://docs.nexwall.com.br

:point_right: Release Notes: https://releasenotes.nexwall.com.br

If you have a BPI-R3 on your bench, give this build a spin! We would love to hear your feedback on SFP throughput, Wi-Fi 6 stability, thermals, and overall performance under load.

KBA-WIFI-CLI.en.md (8,2,KB)

en0
en01349×734 27.1 KB
en1
en11371×935 215 KB
en7
en71381×722 75.5 KB
en10
en101373×831 161 KB