diff --git a/net/shorewall-lite/files/hotplug_iface b/net/shorewall-lite/files/hotplug_iface
index 90ed80c8c..367cea6f4 100644
--- a/net/shorewall-lite/files/hotplug_iface
+++ b/net/shorewall-lite/files/hotplug_iface
@@ -1,13 +1,19 @@
 #!/bin/sh
 
-# should restart shorewall when an interface comes up
+DEVICE=${DEVICE:-$(/sbin/uci -p /var/state get network."$INTERFACE".ifname)}
 
 case "$ACTION" in
     ifup)
-        /etc/init.d/shorewall-lite restart
+        if [ "$INTERFACE" = "lan" ]; then
+            /usr/sbin/shorewall -l start
+	elif [ "${INTERFACE:0:3}" = "wan" ] &&
+             [ "${INTERFACE:$((${#INTERFACE}-2)):2}" != "_6" ]; then
+	    /etc/shorewall-lite/state/firewall enable "$DEVICE"
+	fi
         ;;
     ifdown)
-        # might need to restore some routing
-        /etc/init.d/shorewall-lite restart
+	if [ "${INTERFACE:0:3}" = "wan" ]; then
+	    /etc/shorewall-lite/state/firewall disable "$DEVICE"
+	fi
         ;;
-esac
\ No newline at end of file
+esac
diff --git a/net/shorewall/files/hotplug_iface b/net/shorewall/files/hotplug_iface
index f787424c1..0071e4ff4 100644
--- a/net/shorewall/files/hotplug_iface
+++ b/net/shorewall/files/hotplug_iface
@@ -1,13 +1,19 @@
 #!/bin/sh
 
-# should restart shorewall when an interface comes up
+DEVICE=${DEVICE:-$(/sbin/uci -p /var/state get network."$INTERFACE".ifname)}
 
 case "$ACTION" in
     ifup)
-        /etc/init.d/shorewall restart
+        if [ "$INTERFACE" = "lan" ]; then
+            /usr/sbin/shorewall start
+	elif [ "${INTERFACE:0:3}" = "wan" ] &&
+             [ "${INTERFACE:$((${#INTERFACE}-2)):2}" != "_6" ]; then
+	    /etc/shorewall/state/firewall enable "$DEVICE"
+	fi
         ;;
     ifdown)
-        # might need to restore some routing
-        /etc/init.d/shorewall restart
+	if [ "${INTERFACE:0:3}" = "wan" ]; then
+	    /etc/shorewall/state/firewall disable "$DEVICE"
+	fi
         ;;
 esac
diff --git a/net/shorewall6-lite/files/hotplug_iface b/net/shorewall6-lite/files/hotplug_iface
index bb8973b7b..410266aae 100644
--- a/net/shorewall6-lite/files/hotplug_iface
+++ b/net/shorewall6-lite/files/hotplug_iface
@@ -1,13 +1,19 @@
 #!/bin/sh
 
-# should restart shorewall when an interface comes up
+DEVICE=${DEVICE:-$(/sbin/uci -p /var/state get network."$INTERFACE".ifname)}
 
 case "$ACTION" in
     ifup)
-        /etc/init.d/shorewall6-lite restart
+        if [ "$INTERFACE" = "lan" ]; then
+            /usr/sbin/shorewall -6 -l start
+	elif [ "${INTERFACE:0:3}" = "wan" ] &&
+             [ "${INTERFACE:$((${#INTERFACE}-2)):2}" != "_6" ]; then
+	    /etc/shorewall6-lite/state/firewall enable "$DEVICE"
+	fi
         ;;
     ifdown)
-        # might need to restore some routing
-        /etc/init.d/shorewall6-lite restart
+	if [ "${INTERFACE:0:3}" = "wan" ]; then
+	    /etc/shorewall6-lite/state/firewall disable "$DEVICE"
+	fi
         ;;
-esac
\ No newline at end of file
+esac
diff --git a/net/shorewall6/files/hotplug_iface b/net/shorewall6/files/hotplug_iface
index aaa03e8a9..bfe2bf7b1 100644
--- a/net/shorewall6/files/hotplug_iface
+++ b/net/shorewall6/files/hotplug_iface
@@ -1,13 +1,19 @@
 #!/bin/sh
 
-# should restart shorewall when an interface comes up
+DEVICE=${DEVICE:-$(/sbin/uci -p /var/state get network."$INTERFACE".ifname)}
 
 case "$ACTION" in
     ifup)
-        /etc/init.d/shorewall6 restart
+        if [ "$INTERFACE" = "lan" ]; then
+            /usr/sbin/shorewall -6 start
+	elif [ "${INTERFACE:0:3}" = "wan" ] &&
+             [ "${INTERFACE:$((${#INTERFACE}-2)):2}" != "_6" ]; then
+	    /etc/shorewall6/state/firewall enable "$DEVICE"
+	fi
         ;;
     ifdown)
-        # might need to restore some routing
-        /etc/init.d/shorewall6 restart
+	if [ "${INTERFACE:0:3}" = "wan" ]; then
+	    /etc/shorewall6/state/firewall disable "$DEVICE"
+	fi
         ;;
 esac