diff --git a/feeds/ucentral/ucentral-schema/Makefile b/feeds/ucentral/ucentral-schema/Makefile
index 36382a9ee..1df78b11f 100644
--- a/feeds/ucentral/ucentral-schema/Makefile
+++ b/feeds/ucentral/ucentral-schema/Makefile
@@ -4,10 +4,10 @@ PKG_NAME:=ucentral-schema
 PKG_RELEASE:=1
 
 PKG_SOURCE_URL=https://github.com/Telecominfraproject/wlan-ucentral-schema.git
-PKG_MIRROR_HASH:=e0da520ace57c4439c9b3620853987e44afd482f4aca789883bceaa4b5dd7a99
+PKG_MIRROR_HASH:=9890eca665cdc87f18608e620bbc26a4650977b05ad4da1bf2780877a44ea4a9
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2022-05-29
-PKG_SOURCE_VERSION:=53e3bb434a0dc32a2fc6d806019f6427d3fb92bb
+PKG_SOURCE_VERSION:=d698ad24a281cf936c9ad2ce47bf1a0325fad7ab
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=BSD-3-Clause
diff --git a/feeds/ucentral/uspot/Makefile b/feeds/ucentral/uspot/Makefile
index 8e2761e2a..977648182 100644
--- a/feeds/ucentral/uspot/Makefile
+++ b/feeds/ucentral/uspot/Makefile
@@ -13,7 +13,7 @@ define Package/uspot
   SECTION:=net
   CATEGORY:=Network
   TITLE:=hotspot daemon
-  DEPENDS:=+spotfilter +uhttpd-mod-ucode +libradcli
+  DEPENDS:=+spotfilter +uhttpd-mod-ucode +libradcli +iptables-mod-conntrack-extra +conntrack
 endef
 
 define Package/uspot/install
diff --git a/feeds/ucentral/uspot/files/usr/share/uspot/accounting.uc b/feeds/ucentral/uspot/files/usr/share/uspot/accounting.uc
index 52eb54bae..7981f3c5b 100755
--- a/feeds/ucentral/uspot/files/usr/share/uspot/accounting.uc
+++ b/feeds/ucentral/uspot/files/usr/share/uspot/accounting.uc
@@ -56,12 +56,15 @@ function radius_call(mac, payload) {
 	system('/usr/bin/radius-client /tmp/acct' + mac + '.json');
 }
 
-function radius_stop(mac) {
+function radius_stop(mac, payload) {
 	if (!radius_available(mac))
 		return;
 	debug(mac, 'stopping accounting');
+	ubus.call('spotfilter', 'client_set', payload);
+	system('conntrack -D -s ' + clients[mac].ip4addr  + ' -m 2');
 	if (clients[mac].accounting)
 		clients[mac].timeout.cancel();
+	delete clients[mac];
 }
 
 function radius_acct(mac, payload) {
@@ -166,6 +169,10 @@ function client_add(mac, state) {
 		idle,
 		max_total,
 	};
+	if (state.ip4addr)
+		clients[mac].ip4addr = state.ip4addr;
+	if (state.ip6addr)
+		clients[mac].ip6addr = state.ip6addr;
 	if (state.data?.radius?.request)
 		clients[mac].radius= state.data.radius.request;
 	syslog(mac, 'adding client');
@@ -175,39 +182,34 @@ function client_add(mac, state) {
 
 function client_remove(mac, reason) {
 	syslog(mac, reason);
-	radius_stop(mac);
-	delete clients[mac];
-	ubus.call('spotfilter', 'client_remove', {
-			interface: "hotspot",
-			address: mac
-		});
+	radius_stop(mac, {
+		interface: "hotspot",
+		address: mac
+	});
 }
 
 function client_flush(mac) {
 	syslog(mac, 'logoff event');
-	radius_stop(mac);
-	ubus.call('spotfilter', 'client_set', {
-			interface: 'hotspot',
-			address: mac,
-			state: 0,
-			dns_state: 1,
-			accounting: [],
-			flush: true
-		});
+	radius_stop(mac, {
+		interface: 'hotspot',
+		address: mac,
+		state: 0,
+		dns_state: 1,
+		accounting: [],
+		flush: true
+	});
 }
 
 function client_timeout(mac, reason) {
 	syslog(mac, reason);
-	radius_stop(mac);
-	delete clients[mac];
-	ubus.call('spotfilter', 'client_set', {
-			interface: "hotspot",
-			state: 0,
-			dns_state: 1,
-			address: mac,
-			accounting: [],
-			flush: true,
-		});
+	radius_stop(mac, {
+		interface: "hotspot",
+		state: 0,
+		dns_state: 1,
+		address: mac,
+		accounting: [],
+		flush: true,
+	});
 }
 
 uloop.init();
diff --git a/feeds/ucentral/uspot/files/usr/share/uspot/firewall.ipt b/feeds/ucentral/uspot/files/usr/share/uspot/firewall.ipt
new file mode 100644
index 000000000..3023396ad
--- /dev/null
+++ b/feeds/ucentral/uspot/files/usr/share/uspot/firewall.ipt
@@ -0,0 +1,3 @@
+*mangle
+-A POSTROUTING -m mark --mark 0x2 -j CONNMARK --set-mark 0x2
+COMMIT