(cherry picked from commit 4addfd23)

(cherry picked from commit f34957ec)

Not merging ACL and menu entry yet

(cherry picked from commit bd07877f)
(cherry picked from commit 15b8b918)

PR: https://forum.opnsense.org/index.php?topic=3004
(cherry picked from commit d8f5a12d)

(cherry picked from commit 4497a242)

(cherry picked from commit 0c79cbe4)
(cherry picked from commit 31fe2500)
(cherry picked from commit 8f5bb5e9)
(cherry picked from commit 71bef746)

Not really satisfied with the HA split but let's just say it's a
work in progress...

(cherry picked from commit 16503424)

(cherry picked from commit bb9daf3a)

(IPS) add Add promisc mode / physical interface selection, closes https://github.com/opnsense/core/issues/935

(cherry picked from commit 3bacc745)
(cherry picked from commit 8b4b5bbb)

* optionally collect lagg and vlan parents when the physical device isn't configured yet

(cherry picked from commit 73ce0d60)

(cherry picked from commit 803fd5f5)

(cherry picked from commit eebc4bec)
(cherry picked from commit 92f791e1)
(cherry picked from commit 84152de6)

(cherry picked from commit 2578e763)

(ipsec) cleanup unused ciphers, add null cipher for testing purposes, fix some php warnings on empty arrays

(cherry picked from commit feae22dd)

(cherry picked from commit 6edd9027)

(legacy) filter_log.inv move convert_real_interface_to_friendly_descr out of parse loop, https://github.com/opnsense/core/issues/672

(cherry picked from commit b4395817)

NPT is a kind of abandoned feature that had a custom kernel patch.
I tried to trace the origin through OpenBSD, but their pf(4) since
switched away from separate binat rules in the last known form like
it is still in FreeBSD.

Furthermore, the original GUI commit looks odd in that it tries to
push the same traffic downwards that would match in the former line,
which acutally points upwards.  It's either that or completely zapping
the line.  For now, repair the rules reload by trying to retain the
spirit of what it tries to achieve and wait for further feedback.

This late bug report also suggests that virtually nobody uses NPT
today since we've had no upstream reports since at least 15.7 was
out.

PR: https://forum.opnsense.org/index.php?topic=3076.0
(cherry picked from commit 39eed8a1)

(cherry picked from commit f05b35d9)

(cherry picked from commit 5d7d465c)
(cherry picked from commit 3b630722)
(cherry picked from commit 266a1e87)

(cherry picked from commit b9095a55)
(cherry picked from commit 1bf8b3aa)

(cherry picked from commit 6ae6e594)

(cherry picked from commit 52e5e3a3)

(cherry picked from commit da90e813)

Suggested by: @fabianfrz

(cherry picked from commit aa19f4b1)

(cherry picked from commit f759d902)

(cherry picked from commit 5f3538e4)

(cherry picked from commit 48b9b3ff)

(cherry picked from commit cc9cede6)

(cherry picked from commit 7aa0cd11)

(cherry picked from commit cbcfc496)

(cherry picked from commit dde019de)
(cherry picked from commit 4a91515d)

(cherry picked from commit a154812f)

(cherry picked from commit 3ecf0b8a)

(cherry picked from commit 3611e7fb)
(cherry picked from commit 49bb2b82)

It only makes debugging harder as our translations are being
completed one after the other.  Also has the positive side-
effect of freeing a few hard-to-do translations in the process.

(cherry picked from commit 955b73fd)

(cherry picked from commit 95268566)
(cherry picked from commit 5035c508)
(cherry picked from commit 7a068d5b)
(cherry picked from commit c598f2c8)
(cherry picked from commit 4e2b0079)
(cherry picked from commit f34f42d3)
(cherry picked from commit a96b0da4)
(cherry picked from commit 38efa570)
(cherry picked from commit 2c5768dc)

Only one function left.  :)

(cherry picked from commit 4e8debf8)

We'll go the long way here, bumping the values first before making
them configurable in the next iteration.

(cherry picked from commit 5ad1fa69)

(cherry picked from commit 7700f7c7)