diff --git a/package/openwrt/jffs2root.c b/package/openwrt/jffs2root.c
index 140c8a6e08..aa718da593 100644
--- a/package/openwrt/jffs2root.c
+++ b/package/openwrt/jffs2root.c
@@ -30,6 +30,8 @@
 #include <sys/stat.h>
 #include <string.h>
 
+#include <sys/ioctl.h>
+#include <linux/mtd/mtd.h>
 
 #define FILENAME "/dev/mtdblock/1"
 
@@ -71,9 +73,9 @@ unsigned int crc32buf(char *buf, size_t len)
 int main(int argc, char **argv)
 {
     int fd;
+    struct mtd_info_user mtdInfo;
     unsigned long len;
     struct trx_header *ptr;
-    unsigned offset;
 	
     if (((fd = open(FILENAME, O_RDWR))  < 0)
     || ((len = lseek(fd, 0, SEEK_END)) < 0)
@@ -82,27 +84,31 @@ int main(int argc, char **argv)
 	printf("Error reading trx info\n");
 	exit(-1);
     }
+    close (fd);
+
+    if (((fd = open("/dev/mtd/1", O_RDWR))  < 0)
+    || (ioctl(fd, MEMGETINFO, &mtdInfo))) {
+      fprintf(stderr, "Could not get MTD device info from %s\n", FILENAME);
+      close(fd);
+      exit(1);
+    }
+    close(fd);
 
-    /* treat last partition as rootfs offset */
-    offset = ptr->offsets[2] ? : ptr->offsets[1];
-	
     if (argc > 1 && !strcmp(argv[1],"--move")) {
-      if (offset >= ptr->len) {
+      if (ptr->offsets[2] >= ptr->len) {
         printf("Partition already moved outside trx\n");
-#if 0
-      } else if (offset & 0x0001ffff) {
-        printf("Partition does not start on a block boundary\n");
-#endif
       } else {
 	init_crc32();
-	//bzero((void *)((int)ptr + ptr->len), (size_t)(len - ptr->len));
-        ptr->len = offset;
+	ptr->offsets[2] += mtdInfo.erasesize;
+	ptr->offsets[2] &= ~(mtdInfo.erasesize - 1);
+        ptr->len = ptr->offsets[2];
         ptr->crc32 = crc32buf((void *) &(ptr->flag_version), ptr->len - offsetof(struct trx_header, flag_version));
 	msync(ptr,sizeof(struct trx_header),MS_SYNC|MS_INVALIDATE);
 	printf("Partition moved; please reboot\n");
       }
     } else {
       int x;
+      printf(" erase: 0x%08x\n",mtdInfo.erasesize);
       printf("=== trx ===\n");
       printf("mapped: 0x%08x\n", (unsigned)ptr);
       printf(" magic: 0x%08x\n", ptr->magic);
@@ -112,8 +118,6 @@ int main(int argc, char **argv)
 	printf(" offset[%d]: 0x%08x\n", x, ptr->offsets[x]);
     }
 
-
     munmap((void *) ptr, len);
-    close (fd);
     return 0;
 }
diff --git a/target/default/target_skeleton/etc/init.d/S45firewall b/target/default/target_skeleton/etc/init.d/S45firewall
index a506637255..bdb485936a 100755
--- a/target/default/target_skeleton/etc/init.d/S45firewall
+++ b/target/default/target_skeleton/etc/init.d/S45firewall
@@ -16,10 +16,18 @@ iptables -N forwarding_rule
 iptables -t nat -N prerouting_rule
 iptables -t nat -N postrouting_rule
 
+### Allow SSH from WAN
+# iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 22 -j ACCEPT 
+# iptables        -A input_rule      -i $WAN -p tcp --dport 22 -j ACCEPT
+
 ### Port forwarding
 # iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 22 -j DNAT --to 192.168.1.2
 # iptables        -A forwarding_rule -i $WAN -p tcp --dport 22 -d 192.168.1.2 -j ACCEPT
 
+### DMZ (should be placed after port forwarding / accept rules)
+# iptables -t nat -A prerouting_rule -i $WAN -j DNAT --to 192.168.1.2
+# iptables        -A forwarding_rule -i $WAN -d 192.168.1.2 -j ACCEPT
+
 ### INPUT
 ###  (connections with the router as destination)