diff --git a/package/gluon-private-ap/luasrc/lib/gluon/upgrade/325-gluon-private-ap b/package/gluon-private-ap/luasrc/lib/gluon/upgrade/325-gluon-private-ap
index 2e0b61dd..64698789 100755
--- a/package/gluon-private-ap/luasrc/lib/gluon/upgrade/325-gluon-private-ap
+++ b/package/gluon-private-ap/luasrc/lib/gluon/upgrade/325-gluon-private-ap
@@ -23,6 +23,7 @@ uci:section('network', 'interface', 'ap', {
 	proto = 'static',
 	ipaddr = uci:get('network_gluon-old', 'ap', 'ipaddr') or '192.168.178.1/24',
 	ip6assign = '64',
+	zone = 'ap',
 })
 
 uci:section('dhcp', 'dhcp', 'ap', {
@@ -32,6 +33,20 @@ uci:section('dhcp', 'dhcp', 'ap', {
 	leasetime = '12h',
 })
 
+uci:section('firewall', 'zone', 'ap', {
+	name = 'ap',
+	network = { 'ap' },
+ 	input = 'ACCEPT',
+ 	output = 'ACCEPT',
+ 	forward = 'ACCEPT'
+})
+
+uci:section('firewall', 'forwarding', 'afm', {
+	src = 'ap',
+	dest = 'mesh'
+})
+
+uci:save('firewall')
 uci:save('network')
 uci:save('dhcp')
 uci:save('wireless')