diff --git a/nix/pkgs/openwrt/default.nix b/nix/pkgs/openwrt/default.nix
index 8549335..45ac716 100644
--- a/nix/pkgs/openwrt/default.nix
+++ b/nix/pkgs/openwrt/default.nix
@@ -72,7 +72,10 @@ in rec {
           extraImageName = "zw-${hostName}";
           packages = [
             # remove unused default .ipk
-            "-dnsmasq" "-ppp" "-ppp-mod-pppoe" "-odhcp6c" "-odhcpd-ipv6only"
+            "-dnsmasq" "-firewall"
+            "-ppp" "-ppp-mod-pppoe" "-kmod-ppp" "-kmod-pppoe" "-kmod-pppox"
+            "-iptables" "-ip6tables" "-kmod-ipt-offload"
+            "-odhcp6c" "-odhcpd-ipv6only"
             # debugging
             "tcpdump"
             # monitoring