In the longrun all macro entries should go, but for now a replace should be sufficient.

ipsec, cleanup non-functional nat before ipsec logic and ui for 17.7. In case the feature will reemerge at some point, it would be better to move it to the firewall section anyway. for reference about this long standing issue see https://github.com/opnsense/core/issues/440

This reverts commit c4628a0b.
It looks like pkg can't handle php70 to php71 at all.

filter, rule generation. don't wrap aliases in curly brackets, it seems to crash when a to port is written like {$portalias}

We added the former, but it basically says the same thing.  ;)

firewall, plugin. Add schedules back again, move state kill to end of processing and out of the rule registration.

firewall, plugin. move filter_generate_ipsec_rules() out of the way, move to plugin type rules later.