[Software Release] Nexwall Firewall v26.2.1 ported for the Banana Pi BPI-R4 (MT7988A / Filogic 880 / Kernel 6.12)

[nexwall (Ecossistema de segurança e conectividade)]

Hi BPI Team and community,

Following our releases for the OpenWrt One and the Banana Pi BPI-R3, I’m excited to share that we have now compiled and optimized Nexwall Firewall (v26.2.1) natively for the Banana Pi BPI-R4 (MediaTek MT7988A / Filogic 880, Quad-Core aarch64_cortex-a73).

This build runs on Linux Kernel 6.12.94 (based on OpenWrt v25.12.5) and includes full hardware support for the R4’s 10GbE SFP+ cages, 2.5GbE/1GbE switch ports, PWM fan control, hardware crypto offload (safexcel), PCIe/M.2 NVMe slots, and optional Wi-Fi 7 (mt7996e) modules.

Hardware, RAM & High-Throughput Optimization

• Unconstrained Performance on 4 GiB / 8 GiB RAM: While our 2 GiB BPI-R3 build runs the full security suite near its memory ceiling (~1.8 GiB under heavy load), the BPI-R4’s 4 GiB / 8 GiB DDR4 RAM and faster Cortex-A73 cores let you run every inspection engine simultaneously with massive headroom for high-speed routing, deep packet inspection, and multi-gigabit VPN throughput.
• Flexible Boot & Flash Support: Built with full support for the R4’s multi-boot architecture (SD Card, eMMC, SPI-NAND, and SPI-NOR). You can boot directly via the .img.gz on an SD card and migrate to eMMC or NAND using the standard OpenWrt boot-switch workflow.
• Heavy I/O Offloading: Designed to leverage the M.2 NVMe slot (or eMMC/USB3) for heavy disk operations—such as threat intelligence feeds, live analytics charts, web proxy caching, and deep traffic logs.

Features Included & Design Philosophy

Nexwall turns the BPI-R4 into a high-throughput Next-Gen Firewall (NGFW) built around simplicity and minimal first principles—giving you full enterprise protection without requiring complex manual tuning:

• Zero-Complexity Startup Wizard: The initial setup wizard configures the entire firewall on its own without requiring advanced networking knowledge, and ongoing management is designed to be clean and intuitive.
• Environment Security Profiles (School, Work, Home): Choose a tailored security profile during setup. Each profile automatically applies pre-tuned Application Control rules, blocked web categories, and content filtering suited for that specific environment.
• Deep Traffic Visibility: Real-time throughput analytics, live connection tracking, and granular block logs.
• Active Security Services: Application Control, Web Protection (Proxy), SSL Inspection, AV, Sandbox (free cloud service), Intrusion Prevention System (IPS) with live engine health, DNS filtering, and automated IP/country blocking.
• Enterprise VPNs: Built-in WireGuard, OpenVPN (remote access), and IPsec (site-to-site).
• Simplified Policy Engine: Plain-language firewall rules, NAT, QoS, SD-WAN, and zone-based matrices.
• Wireless Ready: If you have the optional BPI-R4 Wi-Fi 7 module installed, wireless interfaces are automatically detected, configured out of the box, and bridged to the LAN. (See the attached KBA file for CLI wireless configuration commands).

First-Boot & Accessing the Box

• LAN & Web Wizard: eth1 is configured as LAN (bridged with Wireless when present) with DHCP enabled. Access the Web UI at https://192.168.1.1 to launch the startup wizard, select your School, Work, or Home security profile, update passwords, and disable WAN management access if desired.
• Default Credentials & WAN Access: Out of the box, the system boots with all protection engines active:
  • Web UI: User admin / Password nexwall
  • CLI / SSH: User root / Password nexwall (By default, SSH and Web Admin are enabled on both eth1 LAN and eth2 WAN (in the next build the ssh and web ui access from wan will be disabled by default), and can be easily disabled directly inside the startup wizard).
• Default Wi-Fi (When Radio Installed): Starts enabled with SSID Internet_segura (case-sensitive) and default WPA2 password internetinternet.

Available Release Assets

The compiled images and bootloader binaries for the BPI-R4 are hosted on our public GitHub repository:

• nexwall-26.2.1-mediatek-filogic-bananapi_bpi-r4-sdcard.img.gz (Ready-to-flash SD card image)
• nexwall-26.2.1-mediatek-filogic-bananapi_bpi-r4-squashfs-sysupgrade.itb (Sysupgrade / eMMC & NAND deployment)
• sha256sums (Plus individual preloader & bl31-uboot FIP files for NOR/SNAND/eMMC)

Get the Files (GitHub Release v26.2.1-bpi-r4): Release Nexwall Firewall v26.2.1 for Banana Pi BPI-R4 · nexwall/nexwall-bananapi-fw · GitHub

Administrative Docs: https://docs.nexwall.com.br

Release Notes: https://releasenotes.nexwall.com.br

If you have a BPI-R4 on your bench, give this build a spin! We would love to hear your feedback on 10GbE SFP+ throughput, Wi-Fi 7 module compatibility, thermals, and overall performance under load. KBA-WIFI-CLI.en.md (8,2,KB)