diff --git a/net/xtables-addons/Makefile b/net/xtables-addons/Makefile
index 4f92a4093..282337a71 100644
--- a/net/xtables-addons/Makefile
+++ b/net/xtables-addons/Makefile
@@ -9,9 +9,9 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=xtables-addons
-PKG_VERSION:=3.5
+PKG_VERSION:=3.7
 PKG_RELEASE:=1
-PKG_HASH:=189ff57a0b8960969bd99141a6c79c345efa67e4461f450e2f162c9bd3d17da6
+PKG_HASH:=045ee3fcfe5d6edb95483cf49e2446ff8cab4bb79411018b18354138b70c5eb5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@SF/xtables-addons
diff --git a/net/xtables-addons/patches/003-restore-support-for-Linux-4.9.patch b/net/xtables-addons/patches/003-restore-support-for-Linux-4.9.patch
deleted file mode 100644
index 3e7e34a52..000000000
--- a/net/xtables-addons/patches/003-restore-support-for-Linux-4.9.patch
+++ /dev/null
@@ -1,312 +0,0 @@
-Restore support for kernel 4.9
-This reverts commits:
-94656621ed269882aedf116f900009f1ccade3f6
-95d4f9e113fae3ef1e161548fe25c43c091392e3
-123e1a14e95f01b6ba2e4a31b3b2a74ff250be57
-f4f3f9860916d2ec88eb8339680d9ca0f64d41a4
-9b1c7c1c047f0e9c6cb4f9abbdb9fd7b86ae6c1b
----
- configure.ac                    |  2 +-
- extensions/ACCOUNT/xt_ACCOUNT.c |  4 ++++
- extensions/compat_xtables.h     |  8 ++++++--
- extensions/xt_CHAOS.c           | 28 ++++++++++++++++++++++++++--
- extensions/xt_DELUDE.c          |  8 +++++++-
- extensions/xt_DNETMAP.c         | 13 +++++++++++++
- extensions/xt_ECHO.c            |  4 ++++
- extensions/xt_LOGMARK.c         |  8 ++++++++
- extensions/xt_TARPIT.c          | 10 ++++++++++
- extensions/xt_iface.c           |  8 ++++++++
- extensions/xt_lscan.c           |  4 ++++
- 11 files changed, 91 insertions(+), 6 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 0d3aa72..1cea354 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -61,7 +61,7 @@ if test -n "$kbuilddir"; then
- 			echo "WARNING: That kernel version is not officially supported yet. Continue at own luck.";
- 		elif test "$kmajor" -eq 5 -a "$kminor" -ge 0; then
- 			:
--		elif test "$kmajor" -eq 4 -a "$kminor" -ge 14; then
-+		elif test "$kmajor" -eq 4 -a "$kminor" -ge 9; then
- 			:
- 		else
- 			echo "WARNING: That kernel version is not officially supported.";
-diff --git a/extensions/ACCOUNT/xt_ACCOUNT.c b/extensions/ACCOUNT/xt_ACCOUNT.c
-index 019f5bd..8abe8ab 100644
---- a/extensions/ACCOUNT/xt_ACCOUNT.c
-+++ b/extensions/ACCOUNT/xt_ACCOUNT.c
-@@ -485,7 +485,11 @@ static void ipt_acc_depth2_insert(struct ipt_acc_mask_8 *mask_8,
- static unsigned int
- ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
- {
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 	struct ipt_acc_net *ian = net_generic(par->state->net, ipt_acc_net_id);
-+#else
-+	struct ipt_acc_net *ian = net_generic(par->net, ipt_acc_net_id);
-+#endif
- 	struct ipt_acc_table *ipt_acc_tables = ian->ipt_acc_tables;
- 	const struct ipt_acc_info *info =
- 		par->targinfo;
-diff --git a/extensions/compat_xtables.h b/extensions/compat_xtables.h
-index faf5dd8..23785d9 100644
---- a/extensions/compat_xtables.h
-+++ b/extensions/compat_xtables.h
-@@ -8,8 +8,8 @@
- 
- #define DEBUGP Use__pr_debug__instead
- 
--#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
--#	warning Kernels below 4.14 not supported.
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 9, 0)
-+#	warning Kernels below 4.9 not supported.
- #endif
- 
- #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
-@@ -44,7 +44,11 @@
- 
- static inline struct net *par_net(const struct xt_action_param *par)
- {
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0)
- 	return par->state->net;
-+#else
-+	return par->net;
-+#endif
- }
- 
- #ifndef NF_CT_ASSERT
-diff --git a/extensions/xt_CHAOS.c b/extensions/xt_CHAOS.c
-index eec36d4..cee2026 100644
---- a/extensions/xt_CHAOS.c
-+++ b/extensions/xt_CHAOS.c
-@@ -58,7 +58,12 @@ xt_chaos_total(struct sk_buff *skb, const struct xt_action_param *par)
- 
- 	{
- 		struct xt_action_param local_par;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 		local_par.state    = par->state;
-+#else
-+		local_par.in        = par->in,
-+		local_par.out       = par->out,
-+#endif
- 		local_par.match     = xm_tcp;
- 		local_par.matchinfo = &tcp_params;
- 		local_par.fragoff   = fragoff;
-@@ -73,7 +78,14 @@ xt_chaos_total(struct sk_buff *skb, const struct xt_action_param *par)
- 	destiny = (info->variant == XTCHAOS_TARPIT) ? xt_tarpit : xt_delude;
- 	{
- 		struct xt_action_param local_par;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 		local_par.state    = par->state;
-+#else
-+		local_par.in       = par->in;
-+		local_par.out      = par->out;
-+		local_par.hooknum  = par->hooknum;
-+		local_par.family   = par->family;
-+#endif
- 		local_par.target   = destiny;
- 		local_par.targinfo = par->targinfo;
- 		destiny->target(skb, &local_par);
-@@ -96,15 +108,27 @@ chaos_tg(struct sk_buff *skb, const struct xt_action_param *par)
- 
- 	if ((unsigned int)prandom_u32() <= reject_percentage) {
- 		struct xt_action_param local_par;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 		local_par.state    = par->state;
-+#else
-+		local_par.in       = par->in;
-+		local_par.out      = par->out;
-+		local_par.hooknum  = par->hooknum;
-+#endif
- 		local_par.target   = xt_reject;
- 		local_par.targinfo = &reject_params;
- 		return xt_reject->target(skb, &local_par);
- 	}
- 
- 	/* TARPIT/DELUDE may not be called from the OUTPUT chain */
--	if (iph->protocol == IPPROTO_TCP && info->variant != XTCHAOS_NORMAL &&
--	    par->state->hook != NF_INET_LOCAL_OUT)
-+	if (iph->protocol == IPPROTO_TCP &&
-+	    info->variant != XTCHAOS_NORMAL &&
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
-+	    par->state->hook
-+#else
-+	    par->hooknum
-+#endif
-+	    != NF_INET_LOCAL_OUT)
- 		xt_chaos_total(skb, par);
- 
- 	return NF_DROP;
-diff --git a/extensions/xt_DELUDE.c b/extensions/xt_DELUDE.c
-index 618de5e..221f342 100644
---- a/extensions/xt_DELUDE.c
-+++ b/extensions/xt_DELUDE.c
-@@ -151,7 +151,13 @@ delude_tg(struct sk_buff *skb, const struct xt_action_param *par)
- 	 * a problem, as that is supported since Linux 2.6.35. But since we do not
- 	 * actually want to have a connection open, we are still going to drop it.
- 	 */
--	delude_send_reset(par_net(par), skb, par->state->hook);
-+	delude_send_reset(par_net(par), skb,
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
-+	                  par->state->hook
-+#else
-+	                  par->hooknum
-+#endif
-+	                  );
- 	return NF_DROP;
- }
- 
-diff --git a/extensions/xt_DNETMAP.c b/extensions/xt_DNETMAP.c
-index de7d4ec..36a59e2 100644
---- a/extensions/xt_DNETMAP.c
-+++ b/extensions/xt_DNETMAP.c
-@@ -356,7 +356,11 @@ out:
- static unsigned int
- dnetmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
- {
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 	struct net *net = dev_net(par->state->in ? par->state->in : par->state->out);
-+#else
-+	struct net *net = dev_net(par->in ? par->in : par->out);
-+#endif
- 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(net);
- 	struct nf_conn *ct;
- 	enum ip_conntrack_info ctinfo;
-@@ -371,7 +375,11 @@ dnetmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
- 	struct dnetmap_entry *e;
- 	struct dnetmap_prefix *p;
- 	__s32 jttl;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 	unsigned int hooknum = par->state->hook;
-+#else
-+	unsigned int hooknum = par->hooknum;
-+#endif
- 	ct = nf_ct_get(skb, &ctinfo);
- 
- 	jttl = tginfo->flags & XT_DNETMAP_TTL ? tginfo->ttl * HZ : jtimeout;
-@@ -496,7 +504,12 @@ bind_new_prefix:
- 	newrange.max_addr.ip = postnat_ip;
- 	newrange.min_proto = mr->min_proto;
- 	newrange.max_proto = mr->max_proto;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 	return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->state->hook));
-+#else
-+	return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->hooknum));
-+#endif
-+
- no_rev_map:
- no_free_ip:
- 	spin_unlock_bh(&dnetmap_lock);
-diff --git a/extensions/xt_ECHO.c b/extensions/xt_ECHO.c
-index e99312b..60cb815 100644
---- a/extensions/xt_ECHO.c
-+++ b/extensions/xt_ECHO.c
-@@ -35,7 +35,11 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
- 	void *payload;
- 	struct flowi6 fl;
- 	struct dst_entry *dst = NULL;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 	struct net *net = dev_net((par->state->in != NULL) ? par->state->in : par->state->out);
-+#else
-+	struct net *net = dev_net((par->in != NULL) ? par->in : par->out);
-+#endif
- 
- 	/* This allows us to do the copy operation in fewer lines of code. */
- 	if (skb_linearize(oldskb) < 0)
-diff --git a/extensions/xt_LOGMARK.c b/extensions/xt_LOGMARK.c
-index 0474bf8..02e32be 100644
---- a/extensions/xt_LOGMARK.c
-+++ b/extensions/xt_LOGMARK.c
-@@ -77,13 +77,21 @@ logmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
- 	printk("<%u>%.*s""iif=%d hook=%s nfmark=0x%x "
- 	       "secmark=0x%x classify=0x%x",
- 	       info->level, (unsigned int)sizeof(info->prefix), info->prefix,
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 	       skb_ifindex(skb), hook_names[par->state->hook],
-+#else
-+	       skb_ifindex(skb), hook_names[par->hooknum],
-+#endif
- 	       skb_nfmark(skb), skb_secmark(skb), skb->priority);
- 
- 	ct = nf_ct_get(skb, &ctinfo);
- 	printk(" ctdir=%s", dir_names[ctinfo >= IP_CT_IS_REPLY]);
- 	if (ct == NULL)
- 		printk(" ct=NULL ctmark=NULL ctstate=INVALID ctstatus=NONE");
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0)
-+	else if (nf_ct_is_untracked(ct))
-+		printk(" ct=UNTRACKED ctmark=NULL ctstate=UNTRACKED ctstatus=NONE");
-+#endif
- 	else
- 		logmark_ct(ct, ctinfo);
- 
-diff --git a/extensions/xt_TARPIT.c b/extensions/xt_TARPIT.c
-index cb98e9e..b78683c 100644
---- a/extensions/xt_TARPIT.c
-+++ b/extensions/xt_TARPIT.c
-@@ -436,7 +436,12 @@ tarpit_tg4(struct sk_buff *skb, const struct xt_action_param *par)
- 	/* We are not interested in fragments */
- 	if (iph->frag_off & htons(IP_OFFSET))
- 		return NF_DROP;
-+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 	tarpit_tcp4(par_net(par), skb, par->state->hook, info->variant);
-+#else
-+	tarpit_tcp4(par_net(par), skb, par->hooknum, info->variant);
-+#endif
- 	return NF_DROP;
- }
- 
-@@ -477,7 +482,12 @@ tarpit_tg6(struct sk_buff *skb, const struct xt_action_param *par)
- 		pr_debug("addr is not unicast.\n");
- 		return NF_DROP;
- 	}
-+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 	tarpit_tcp6(par_net(par), skb, par->state->hook, info->variant);
-+#else
-+	tarpit_tcp6(par_net(par), skb, par->hooknum, info->variant);
-+#endif
- 	return NF_DROP;
- }
- #endif
-diff --git a/extensions/xt_iface.c b/extensions/xt_iface.c
-index 7704686..be52a52 100644
---- a/extensions/xt_iface.c
-+++ b/extensions/xt_iface.c
-@@ -45,9 +45,17 @@ static const struct net_device *iface_get(const struct xt_iface_mtinfo *info,
-     const struct xt_action_param *par, struct net_device **put)
- {
- 	if (info->flags & XT_IFACE_DEV_IN)
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 		return par->state->in;
-+#else
-+		return par->in;
-+#endif
- 	else if (info->flags & XT_IFACE_DEV_OUT)
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 		return par->state->out;
-+#else
-+		return par->out;
-+#endif
- 	return *put = dev_get_by_name(&init_net, info->ifname);
- }
- 
-diff --git a/extensions/xt_lscan.c b/extensions/xt_lscan.c
-index 060fe44..3a7d2ed 100644
---- a/extensions/xt_lscan.c
-+++ b/extensions/xt_lscan.c
-@@ -204,7 +204,11 @@ lscan_mt(const struct sk_buff *skb, struct xt_action_param *par)
- 		unsigned int n;
- 
- 		n = lscan_mt_full(ctdata->mark & connmark_mask, ctstate,
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
- 		    par->state->in == init_net.loopback_dev, tcph,
-+#else
-+		    par->in == init_net.loopback_dev, tcph,
-+#endif
- 		    skb->len - par->thoff - 4 * tcph->doff);
- 
- 		ctdata->mark = (ctdata->mark & ~connmark_mask) | n;
--- 
-2.21.0
-