diff --git a/BUILD.gn b/BUILD.gn
index f930832c..620f535b 100644
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -71,3 +71,77 @@ ohos_executable("iptables") {
   part_name = "netmanager_base"
   subsystem_name = "communication"
 }
+
+ohos_executable("iptables-save") {
+  sources = [
+    "//third_party/iptables/iptables/ip6tables-standalone.c",
+    "//third_party/iptables/iptables/ip6tables.c",
+    "//third_party/iptables/iptables/iptables-restore.c",
+    "//third_party/iptables/iptables/iptables-save.c",
+    "//third_party/iptables/iptables/iptables-standalone.c",
+    "//third_party/iptables/iptables/iptables-xml.c",
+    "//third_party/iptables/iptables/iptables.c",
+    "//third_party/iptables/iptables/xshared.c",
+    "//third_party/iptables/iptables/xtables-legacy-multi.c",
+  ]
+
+  include_dirs = [
+    "//third_party/iptables",
+    "//third_party/iptables/extensions",
+    "//third_party/iptables/include",
+    "//third_party/iptables/iptables",
+    "//third_party/iptables/libiptc",
+  ]
+  configs = [ ":iptables_config" ]
+
+  install_enable = true
+
+  deps = [
+    "//third_party/iptables/extensions:libext",
+    "//third_party/iptables/extensions:libext4",
+    "//third_party/iptables/extensions:libext6",
+    "//third_party/iptables/libiptc:libip4tc",
+    "//third_party/iptables/libiptc:libip6tc",
+    "//third_party/iptables/libxtables:libxtables",
+  ]
+
+  part_name = "netmanager_base"
+  subsystem_name = "communication"
+}
+
+ohos_executable("iptables-restore") {
+  sources = [
+    "//third_party/iptables/iptables/ip6tables-standalone.c",
+    "//third_party/iptables/iptables/ip6tables.c",
+    "//third_party/iptables/iptables/iptables-restore.c",
+    "//third_party/iptables/iptables/iptables-save.c",
+    "//third_party/iptables/iptables/iptables-standalone.c",
+    "//third_party/iptables/iptables/iptables-xml.c",
+    "//third_party/iptables/iptables/iptables.c",
+    "//third_party/iptables/iptables/xshared.c",
+    "//third_party/iptables/iptables/xtables-legacy-multi.c",
+  ]
+
+  include_dirs = [
+    "//third_party/iptables",
+    "//third_party/iptables/extensions",
+    "//third_party/iptables/include",
+    "//third_party/iptables/iptables",
+    "//third_party/iptables/libiptc",
+  ]
+  configs = [ ":iptables_config" ]
+
+  install_enable = true
+
+  deps = [
+    "//third_party/iptables/extensions:libext",
+    "//third_party/iptables/extensions:libext4",
+    "//third_party/iptables/extensions:libext6",
+    "//third_party/iptables/libiptc:libip4tc",
+    "//third_party/iptables/libiptc:libip6tc",
+    "//third_party/iptables/libxtables:libxtables",
+  ]
+
+  part_name = "netmanager_base"
+  subsystem_name = "communication"
+}
diff --git a/extensions/BUILD.gn b/extensions/BUILD.gn
index 77dbb339..f94919f2 100644
--- a/extensions/BUILD.gn
+++ b/extensions/BUILD.gn
@@ -110,6 +110,7 @@ ohos_static_library("libext") {
     "//third_party/iptables/extensions/gen/libxt_pkttype.c",
     "//third_party/iptables/extensions/gen/libxt_policy.c",
     "//third_party/iptables/extensions/gen/libxt_quota.c",
+    "//third_party/iptables/extensions/gen/libxt_quota2.c",
     "//third_party/iptables/extensions/gen/libxt_rateest.c",
     "//third_party/iptables/extensions/gen/libxt_recent.c",
     "//third_party/iptables/extensions/gen/libxt_rpfilter.c",
diff --git a/extensions/libxt_quota2.c b/extensions/libxt_quota2.c
new file mode 100644
index 00000000..f6879347
--- /dev/null
+++ b/extensions/libxt_quota2.c
@@ -0,0 +1,113 @@
+/*
+ *	"quota2" match extension for iptables
+ *	Sam Johnston <samj [at] samj net>
+ *	Jan Engelhardt, 2008
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License; either
+ *	version 2 of the License, or any later version, as published by the
+ *	Free Software Foundation.
+ */
+#include <getopt.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <xtables.h>
+#include <linux/netfilter/xt_quota2.h>
+
+enum {
+	FL_QUOTA     = 1 << 0,
+	FL_NAME      = 1 << 1,
+	FL_GROW      = 1 << 2,
+	FL_PACKET    = 1 << 3,
+	FL_NO_CHANGE = 1 << 4,
+};
+
+enum {
+	O_QUOTA     = 0,
+	O_GROW,
+	O_PACKET,
+	O_NO_CHANGE,
+	O_NAME,
+};
+
+
+static const struct xt_option_entry quota_mt2_opts[] = {
+	{.name = "grow", .id = O_GROW, .type = XTTYPE_NONE},
+	{.name = "no-change", .id = O_NO_CHANGE, .type = XTTYPE_NONE},
+	{.name = "name", .id = O_NAME, .type = XTTYPE_STRING,
+	 .flags = XTOPT_PUT, XTOPT_POINTER(struct xt_quota_mtinfo2, name)},
+	{.name = "quota", .id = O_QUOTA, .type = XTTYPE_UINT64,
+	 .flags = XTOPT_INVERT | XTOPT_PUT,
+	 XTOPT_POINTER(struct xt_quota_mtinfo2, quota)},
+	{.name = "packets", .id = O_PACKET, .type = XTTYPE_NONE},
+	XTOPT_TABLEEND,
+};
+
+static void quota_mt2_help(void)
+{
+	printf(
+	"quota match options:\n"
+	"    --grow           provide an increasing counter\n"
+	"    --no-change      never change counter/quota value for matching packets\n"
+	"    --name name      name for the file in sysfs\n"
+	"[!] --quota quota    initial quota (bytes or packets)\n"
+	"    --packets        count packets instead of bytes\n"
+	);
+}
+
+static void quota_mt2_parse(struct xt_option_call *cb)
+{
+	struct xt_quota_mtinfo2 *info = cb->data;
+
+	xtables_option_parse(cb);
+	if (cb->entry->id == O_NAME || (cb->entry->id == O_QUOTA && !cb->invert))
+		return;
+	else
+		info->flags |= 1 << (int)cb->entry->id;
+}
+
+static void
+quota_mt2_save(const void *ip, const struct xt_entry_match *match)
+{
+	const struct xt_quota_mtinfo2 *q = (void *)match->data;
+
+	if (q->flags & XT_QUOTA_INVERT)
+		printf(" !");
+	if (q->flags & XT_QUOTA_GROW)
+		printf(" --grow ");
+	if (q->flags & XT_QUOTA_NO_CHANGE)
+		printf(" --no-change ");
+	if (q->flags & XT_QUOTA_PACKET)
+		printf(" --packets ");
+	if (*q->name != '\0')
+		printf(" --name %s ", q->name);
+	printf(" --quota %llu ", (unsigned long long)q->quota);
+}
+
+static void quota_mt2_print(const void *ip, const struct xt_entry_match *match,
+                            int numeric)
+{
+	printf(" -m quota");
+	quota_mt2_save(ip, match);
+}
+
+static struct xtables_match quota_mt2_reg = {
+	.family        = NFPROTO_UNSPEC,
+	.revision      = 3,
+	.name          = "quota2",
+	.version       = XTABLES_VERSION,
+	.size          = XT_ALIGN(sizeof (struct xt_quota_mtinfo2)),
+	.userspacesize = offsetof(struct xt_quota_mtinfo2, quota),
+	.help          = quota_mt2_help,
+	.x6_parse      = quota_mt2_parse,
+	.print         = quota_mt2_print,
+	.save          = quota_mt2_save,
+	.x6_options    = quota_mt2_opts,
+};
+
+void _init(void)
+{
+	xtables_register_match(&quota_mt2_reg);
+}
diff --git a/extensions/libxt_quota2.man b/extensions/libxt_quota2.man
new file mode 100644
index 00000000..7e820e60
--- /dev/null
+++ b/extensions/libxt_quota2.man
@@ -0,0 +1,38 @@
+.PP
+The "quota2" implements a named counter which can be increased or decreased
+on a per-match basis. Available modes are packet counting or byte counting.
+The value of the counter can be read and reset through procfs, thereby making
+this match a minimalist accounting tool.
+.PP
+When counting down from the initial quota, the counter will stop at 0 and
+the match will return false, just like the original "quota" match. In growing
+(upcounting) mode, it will always return true.
+.TP
+\fB\-\-grow\fP
+Count upwards instead of downwards.
+.TP
+\fB\-\-no\-change\fP
+Makes it so the counter or quota amount is never changed by packets matching
+this rule. This is only really useful in "quota" mode, as it will allow you to
+use complex prerouting rules in association with the quota system, without
+counting a packet twice.
+.TP
+\fB\-\-name\fP \fIname\fP
+Assign the counter a specific name. This option must be present, as an empty
+name is not allowed. Names starting with a dot or names containing a slash are
+prohibited.
+.TP
+[\fB!\fP] \fB\-\-quota\fP \fIiq\fP
+Specify the initial quota for this counter. If the counter already exists,
+it is not reset. An "!" may be used to invert the result of the match. The
+negation has no effect when \fB\-\-grow\fP is used.
+.TP
+\fB\-\-packets\fP
+Count packets instead of bytes that passed the quota2 match.
+.PP
+Because counters in quota2 can be shared, you can combine them for various
+purposes, for example, a bytebucket filter that only lets as much traffic go
+out as has come in:
+.PP
+\-A INPUT \-p tcp \-\-dport 6881 \-m quota \-\-name bt \-\-grow;
+\-A OUTPUT \-p tcp \-\-sport 6881 \-m quota \-\-name bt;
diff --git a/include/linux/netfilter/xt_quota2.h b/include/linux/netfilter/xt_quota2.h
new file mode 100644
index 00000000..7291e38f
--- /dev/null
+++ b/include/linux/netfilter/xt_quota2.h
@@ -0,0 +1,25 @@
+#ifndef _XT_QUOTA2_H
+#define _XT_QUOTA2_H
+
+enum xt_quota_flags {
+	XT_QUOTA_INVERT    = 1 << 0,
+	XT_QUOTA_GROW      = 1 << 1,
+	XT_QUOTA_PACKET    = 1 << 2,
+	XT_QUOTA_NO_CHANGE = 1 << 3,
+	XT_QUOTA_MASK      = 0x0F,
+};
+
+struct xt_quota_counter;
+
+struct xt_quota_mtinfo2 {
+	char name[15];
+	u_int8_t flags;
+
+	/* Comparison-invariant */
+	aligned_u64 quota;
+
+	/* Used internally by the kernel */
+	struct xt_quota_counter *master __attribute__((aligned(8)));
+};
+
+#endif /* _XT_QUOTA2_H */
\ No newline at end of file