diff --git a/package/lean/luci-app-flowoffload/luasrc/model/cbi/flowoffload.lua b/package/lean/luci-app-flowoffload/luasrc/model/cbi/flowoffload.lua
index d42fc86cfb..cef1088041 100644
--- a/package/lean/luci-app-flowoffload/luasrc/model/cbi/flowoffload.lua
+++ b/package/lean/luci-app-flowoffload/luasrc/model/cbi/flowoffload.lua
@@ -26,6 +26,11 @@ hw.rmempty = true
 hw.description = translate("Enable Hardware NAT (depends on hw capability like MTK 762x)")
 hw:depends("flow_offloading", 1)
 
+fc = s:option(Flag, "fullcone_nat", translate("Fullcone NAT"))
+fc.default = 1
+fc.rmempty = true
+fc.description = translate("Enable Fullcone NAT")
+
 bbr = s:option(Flag, "bbr", translate("Enable BBR"))
 bbr.default = 0
 bbr.rmempty = false
diff --git a/package/lean/luci-app-flowoffload/po/zh-cn/flowoffload.po b/package/lean/luci-app-flowoffload/po/zh-cn/flowoffload.po
index b2f0826bbc..7d7fb4ad38 100644
--- a/package/lean/luci-app-flowoffload/po/zh-cn/flowoffload.po
+++ b/package/lean/luci-app-flowoffload/po/zh-cn/flowoffload.po
@@ -22,6 +22,9 @@ msgstr "开启 Flow Offloading 转发加速. (降低CPU占用 / 增强路由转
 msgid "Enable Hardware NAT (depends on hw capability like MTK 762x)"
 msgstr "启用硬件HWNAT加速（依赖特定的硬件，例如 MTK 762x 系列）"
 
+msgid "Enable Fullcone NAT"
+msgstr "启用 Fullcone NAT"
+
 msgid "Enable BBR"
 msgstr "启用 BBR"
 
diff --git a/package/lean/luci-app-flowoffload/root/etc/config/flowoffload b/package/lean/luci-app-flowoffload/root/etc/config/flowoffload
index 1a4f0b4647..17266fcf2c 100644
--- a/package/lean/luci-app-flowoffload/root/etc/config/flowoffload
+++ b/package/lean/luci-app-flowoffload/root/etc/config/flowoffload
@@ -2,6 +2,7 @@
 config flow
 	option flow_offloading '0'
 	option flow_offloading_hw '0'
+	option fullcone_nat '1'
 	option bbr '0'
 	option dns '0'
 	option dnscache_enable '1'
diff --git a/package/lean/luci-app-flowoffload/root/etc/init.d/flowoffload b/package/lean/luci-app-flowoffload/root/etc/init.d/flowoffload
index 11d5cb60ed..fbd96785ff 100755
--- a/package/lean/luci-app-flowoffload/root/etc/init.d/flowoffload
+++ b/package/lean/luci-app-flowoffload/root/etc/init.d/flowoffload
@@ -255,6 +255,7 @@ start_service(){
 
 	uci set firewall.@defaults[0].flow_offloading=$(uci get flowoffload.@flow[0].flow_offloading)
 	uci set firewall.@defaults[0].flow_offloading_hw=$(uci get flowoffload.@flow[0].flow_offloading_hw)
+	uci set firewall.@defaults[0].fullcone=$(uci get flowoffload.@flow[0].fullcone_nat)
 	uci commit firewall
 	if [ "$DNSMASQ_RESTART" = N ]; then
 		/etc/init.d/dnsmasq restart && echo "DNSMASQ change"
diff --git a/package/lean/luci-app-sfe/luasrc/model/cbi/sfe.lua b/package/lean/luci-app-sfe/luasrc/model/cbi/sfe.lua
index eae4f2145e..f7ae9eecc9 100644
--- a/package/lean/luci-app-sfe/luasrc/model/cbi/sfe.lua
+++ b/package/lean/luci-app-sfe/luasrc/model/cbi/sfe.lua
@@ -20,6 +20,11 @@ enable.default = 0
 enable.rmempty = false
 enable.description = translate("Enable Fast Path offloading for connections. (decrease cpu load / increase routing throughput)")
 
+fc = s:option(Flag, "fullcone_nat", translate("Fullcone NAT"))
+fc.default = 1
+fc.rmempty = false
+fc.description = translate("Enable Fullcone NAT")
+
 wifi = s:option(Flag, "wifi", translate("Bridge Acceleration"))
 wifi.default = 0
 wifi.rmempty = false
diff --git a/package/lean/luci-app-sfe/po/zh-cn/sfe.po b/package/lean/luci-app-sfe/po/zh-cn/sfe.po
index 7d991d9a43..0d0fd63ac6 100644
--- a/package/lean/luci-app-sfe/po/zh-cn/sfe.po
+++ b/package/lean/luci-app-sfe/po/zh-cn/sfe.po
@@ -22,6 +22,9 @@ msgstr "启用 SFE Fast Path 加速"
 msgid "Enable Fast Path offloading for connections. (decrease cpu load / increase routing throughput)"
 msgstr "开启 Fast Path 转发加速. (降低CPU占用 / 增强路由转发性能，和多WAN或者QOS功能可能会冲突)"
 
+msgid "Enable Fullcone NAT"
+msgstr "开启 Fullcone NAT"
+
 msgid "Bridge Acceleration"
 msgstr "桥接加速"
 
diff --git a/package/lean/luci-app-sfe/root/etc/config/sfe b/package/lean/luci-app-sfe/root/etc/config/sfe
index b48624ca65..1ae0e60571 100644
--- a/package/lean/luci-app-sfe/root/etc/config/sfe
+++ b/package/lean/luci-app-sfe/root/etc/config/sfe
@@ -1,5 +1,6 @@
 config sfe
 	option enabled '0'
+	option fullcone_nat '1'
 	option ipv6 '0'
 	option wifi '0'
 	option bbr '0'
diff --git a/package/lean/luci-app-sfe/root/etc/init.d/sfe b/package/lean/luci-app-sfe/root/etc/init.d/sfe
index d80d20cba0..d19526f83c 100755
--- a/package/lean/luci-app-sfe/root/etc/init.d/sfe
+++ b/package/lean/luci-app-sfe/root/etc/init.d/sfe
@@ -275,8 +275,12 @@ start_service() {
 		sysctl -w net.ipv4.tcp_congestion_control=cubic
 	fi
 
+	uci set firewall.@defaults[0].fullcone=$(uci get sfe@sfe[0].fullcone_nat)
+	uci commit firewall
+
 	if [ "$DNSMASQ_RESTART" = N ]; then
 		/etc/init.d/dnsmasq restart
+		/etc/init.d/firewall restart
 	fi
 }
 
@@ -288,6 +292,7 @@ stop_service(){
 	kill -9 $(ps | grep dnscache-while.sh | grep -v "grep" | awk '{print $1}') >/dev/null 2>&1
 	if [ "$DNSMASQ_RESTART" = N ]; then
 		/etc/init.d/dnsmasq restart
+		/etc/init.d/firewall restart
 	fi
 }
 
@@ -296,4 +301,5 @@ restart(){
 	stop
 	start
 	/etc/init.d/dnsmasq restart && echo "DNSMASQ restart"
+	/etc/init.d/firewall restart
 }