append_mgmt_firewall_config() {
	# Append the configuration block
	cat <<'EOF' >> "$firewall_file"

config zone 'mgmt'
	option name 'mgmt'
	list network 'mgmt_iface'
	list network 'mgmt_iface6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'mgmt'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'mgmt'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'mgmt'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'mgmt'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'mgmt'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'mgmt'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
EOF

	echo "Firewall configuration for 'mgmt' zone appended successfully."
}

l3_mcast_config() {
	# configure L3 mcast config
	local iptv_dev="$1"

	logger -p user.info -t "netmode" "Generating L3 mcast configuration"

	rm -f /etc/config/mcast
	sh /rom/etc/uci-defaults/61-mcast_config_generate

	if [ -n "$iptv_dev" ]; then
		uci -q set mcast.mc_proxy_MLD.upstream_interface="$iptv_dev"
		uci -q set mcast.igmp_proxy_1.upstream_interface="$iptv_dev"
	fi

	uci -q commit mcast
}

# deletes all interfaces except lan, lan6, wan and wan6
delete_extra_interfaces() {
        local sect

        # Extract all interface section names and iterate
        for sect in $(uci -X show network | grep -F '=interface' | cut -d '.' -f2 | cut -d '=' -f1); do
                case "$sect" in
                        lan|lan6|wan|wan6)
                                echo "Skipping reserved interface: network.$sect"
                                continue
                                ;;
                esac

                echo "Deleting interface section: network.$sect"
                uci -q delete network.$sect
        done

        uci -q commit network
}

delete_vlan_and_macvlan_sections() {
	local sect

	# Extract all vlan device section names and iterate
	for sect in $(uci -X show network | grep -E '8021q|8021ad|macvlan' | cut -d '.' -f 2); do
		echo "Deleting device section: network.$sect"
		uci -q delete network.$sect
	done

	uci -q commit network
}
