diff --git a/src/patches/strongswan-ipfire.patch b/src/patches/strongswan-ipfire.patch
index d8e35cd52..a1f80d361 100644
--- a/src/patches/strongswan-ipfire.patch
+++ b/src/patches/strongswan-ipfire.patch
@@ -1,13 +1,5 @@
-commit b439f74361d393bcb85109b6c41a905cf613a296
-Author: Peter Müller <peter.mueller@ipfire.org>
-Date:   Wed May 18 17:46:57 2022 +0000
-
-    IPFire modifications to _updown script
-    
-    Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
-
 diff --git a/src/_updown/_updown.in b/src/_updown/_updown.in
-index 34eaf68c7..9ed387a0a 100644
+index 34eaf68c7..38aa63354 100644
 --- a/src/_updown/_updown.in
 +++ b/src/_updown/_updown.in
 @@ -242,10 +242,10 @@ up-host:iptables)
@@ -98,7 +90,7 @@ index 34eaf68c7..9ed387a0a 100644
  	      -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
  	fi
  	#
-@@ -342,47 +324,37 @@ up-client:iptables)
+@@ -342,47 +324,46 @@ up-client:iptables)
  	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
  	  then
  	    logger -t $TAG -p $FAC_PRIO \
@@ -111,7 +103,7 @@ index 34eaf68c7..9ed387a0a 100644
  	  fi
  	fi
 +
-+	# Open Firewall for IPinIP + AH + ESP Traffic
++	# Open firewall for incoming and outgoing IPinIP + AH + ESP traffic to the peers' IP
 +	iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p IPIP \
 +		-s $PLUTO_PEER $S_PEER_PORT \
 +		-d $PLUTO_ME $D_MY_PORT -j ACCEPT
@@ -121,6 +113,15 @@ index 34eaf68c7..9ed387a0a 100644
 +	iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p ESP \
 +		-s $PLUTO_PEER $S_PEER_PORT \
 +		-d $PLUTO_ME $D_MY_PORT -j ACCEPT
++	iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p IPIP \
++		-s $PLUTO_ME $D_MY_PORT \
++		-d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
++	iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p AH \
++		-s $PLUTO_ME $D_MY_PORT \
++		-d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
++	iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p ESP \
++		-s $PLUTO_ME $D_MY_PORT \
++		-d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
 +
  	;;
  down-client:iptables)
@@ -161,7 +162,7 @@ index 34eaf68c7..9ed387a0a 100644
  	      -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
  	fi
  	#
-@@ -392,12 +364,24 @@ down-client:iptables)
+@@ -392,12 +373,32 @@ down-client:iptables)
  	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
  	  then
  	    logger -t $TAG -p $FAC_PRIO -- \
@@ -174,7 +175,7 @@ index 34eaf68c7..9ed387a0a 100644
  	  fi
  	fi
 +
-+	# Close Firewall for IPinIP + AH + ESP Traffic
++	# Close firewall for incoming and outgoing IPinIP + AH + ESP traffic to the peers' IP
 +	iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p IPIP \
 +		-s $PLUTO_PEER $S_PEER_PORT \
 +		-d $PLUTO_ME $D_MY_PORT -j ACCEPT
@@ -184,11 +185,19 @@ index 34eaf68c7..9ed387a0a 100644
 +	iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p ESP \
 +		-s $PLUTO_PEER $S_PEER_PORT \
 +		-d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+
++	iptables --wait -D IPSECINPUT -o $PLUTO_INTERFACE -p IPIP \
++		-s $PLUTO_ME $D_MY_PORT \
++		-d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
++	iptables --wait -D IPSECINPUT -o $PLUTO_INTERFACE -p AH \
++		-s $PLUTO_ME $D_MY_PORT \
++		-d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
++	iptables --wait -D IPSECINPUT -o $PLUTO_INTERFACE -p ESP \
++		-s $PLUTO_ME $D_MY_PORT \
++		-d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
  	;;
  #
  # IPv6
-@@ -422,10 +406,10 @@ up-host-v6:iptables)
+@@ -422,10 +423,10 @@ up-host-v6:iptables)
  	# connection to me, with (left/right)firewall=yes, coming up
  	# This is used only by the default updown script, not by your custom
  	# ones, so do not mess with it; see CAUTION comment up at top.
@@ -201,7 +210,7 @@ index 34eaf68c7..9ed387a0a 100644
  	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
  	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
  	#
-@@ -454,10 +438,10 @@ down-host-v6:iptables)
+@@ -454,10 +455,10 @@ down-host-v6:iptables)
  	# connection to me, with (left/right)firewall=yes, going down
  	# This is used only by the default updown script, not by your custom
  	# ones, so do not mess with it; see CAUTION comment up at top.
@@ -214,7 +223,7 @@ index 34eaf68c7..9ed387a0a 100644
  	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
  	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
  	#
-@@ -487,10 +471,10 @@ up-client-v6:iptables)
+@@ -487,10 +488,10 @@ up-client-v6:iptables)
  	# ones, so do not mess with it; see CAUTION comment up at top.
  	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
  	then
@@ -227,7 +236,7 @@ index 34eaf68c7..9ed387a0a 100644
  	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
  	fi
-@@ -499,10 +483,10 @@ up-client-v6:iptables)
+@@ -499,10 +500,10 @@ up-client-v6:iptables)
  	# or sometimes host access via the internal IP is needed
  	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
  	then
@@ -240,7 +249,7 @@ index 34eaf68c7..9ed387a0a 100644
  	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
  	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
  	fi
-@@ -535,11 +519,11 @@ down-client-v6:iptables)
+@@ -535,11 +536,11 @@ down-client-v6:iptables)
  	# ones, so do not mess with it; see CAUTION comment up at top.
  	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
  	then
@@ -254,7 +263,7 @@ index 34eaf68c7..9ed387a0a 100644
  	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
  	         $IPSEC_POLICY_IN -j ACCEPT
-@@ -549,11 +533,11 @@ down-client-v6:iptables)
+@@ -549,11 +550,11 @@ down-client-v6:iptables)
  	# or sometimes host access via the internal IP is needed
  	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
  	then