diff --git a/files/etc/config.mesh/firewall b/files/etc/config.mesh/firewall
index ac86de33..955bf69a 100644
--- a/files/etc/config.mesh/firewall
+++ b/files/etc/config.mesh/firewall
@@ -83,6 +83,8 @@ config rule
 config include
         option path /etc/firewall.user
 
+config include
+        option path /etc/firewall.tun
 
 config rule
        option src              wan
diff --git a/files/etc/config.mesh/firewall.tun b/files/etc/config.mesh/firewall.tun
new file mode 100644
index 00000000..e69de29b
diff --git a/files/www/cgi-bin/tunfunc.pm b/files/www/cgi-bin/tunfunc.pm
index 5795f624..a55a36f3 100644
--- a/files/www/cgi-bin/tunfunc.pm
+++ b/files/www/cgi-bin/tunfunc.pm
@@ -154,12 +154,13 @@ sub check_freespace()
 ##########################
 sub open_5525_on_wan() {
     my $rc;
-    $rc=&uci_add_sectiontype("firewall","rule");
-    $rc=&uci_set_indexed_option("firewall","rule","-1","src","wan");
-    $rc=&uci_set_indexed_option("firewall","rule","-1","dest_port","5525");
-    $rc=&uci_set_indexed_option("firewall","rule","-1","proto","tcp");
-    $rc=&uci_set_indexed_option("firewall","rule","-1","target","ACCEPT");
-    $rc=&uci_commit("firewall");
+    $rc=&uci_add_sectiontype("firewall.tun","rule");
+    $rc=&uci_set_indexed_option("firewall.tun","rule","-1","src","wan");
+    $rc=&uci_set_indexed_option("firewall.tun","rule","-1","dest_port","5525");
+    $rc=&uci_set_indexed_option("firewall.tun","rule","-1","proto","tcp");
+    $rc=&uci_set_indexed_option("firewall.tun","rule","-1","target","ACCEPT");
+    $rc=&uci_commit("firewall.tun");
+    $rc=&uci_clone("firewall.tun");
 }
 
 sub vpn_setup_required()