diff --git a/net-firewall/firewalld/Manifest b/net-firewall/firewalld/Manifest
index 27b177c822362..7ed5c47884595 100644
--- a/net-firewall/firewalld/Manifest
+++ b/net-firewall/firewalld/Manifest
@@ -1,3 +1,4 @@
 DIST firewalld-2.4.0.tar.bz2 1342244 BLAKE2B 8e878eefe9b458e2c9b742b55268839e746cfa5c8f4460df17fff74c4f6b03bad64981ec530565d6746fca05a797dcd82f3af99a3cb64dfbe98be6f7d6c38f41 SHA512 24071b2f0a2d5acf41430e41238480d78b1f758bceb493b44dba89dbc02a73f6adfc47359d108d502c41ac2b1ac8302bbda426d7f89095b44240c98739f58ae8
 DIST firewalld-2.4.2.tar.bz2 1366993 BLAKE2B add319d100c01e6431e3a416ba802827c762f0882869f1a3a6e5fd49016c193050f73c5c520ebc82e967516d782cc802738048b30e2a0592e2e8849dcc18b96b SHA512 725fb01c5982e1e824fddb18ccb5ffe95a74c3b1d04a406e08f7aa93d1d6b7b8e8f3eabd7bd3b7e15112c876a9b07cf4fce0effeb091a1ccf00c481706faac02
 DIST firewalld-2.4.4.tar.bz2 1389273 BLAKE2B e7054580bf587c28b982548c831936694f32d7a94a8438f282e0bb983997aac1518db3303fe9816e5cc28679003ef6f35876c6a4e6a8ead48ac4d8a24782d782 SHA512 b28649cdb6b63117380d6d5ac93fecce12e617d36bdb5e4bbb15a72110305fc06ec73ca63f885d782ade67e7d43ad660356ac89fbbee74a58e048492a0e5dae7
+DIST firewalld-2.5.1.tar.bz2 1467099 BLAKE2B afa8929f6c1cd053bd7ce56f8f8b1f053b3e147cd02e7f8dc1c44ef7b9638a0dd0c0d5b9423cf751c5a1eb6a7dd7389f76a5695767cbcb551433818c5e176cad SHA512 9b7d61cef7dc016e55ea3493c2566cb516f40446029a1d74805411e1a91d15848d69740d5d2182ea5448118ec59ebc20c78c941fdb4c003628769cb0f0976114
diff --git a/net-firewall/firewalld/files/firewalld-2.5.1-autoconf.patch b/net-firewall/firewalld/files/firewalld-2.5.1-autoconf.patch
new file mode 100644
index 0000000000000..67adf61b14ae6
--- /dev/null
+++ b/net-firewall/firewalld/files/firewalld-2.5.1-autoconf.patch
@@ -0,0 +1,14 @@
+Fix broken gettext domain.
+--- a/configure.ac
++++ b/configure.ac
+@@ -137,8 +137,8 @@ AC_ARG_VAR([DEFAULT_LOG_TARGET], m4_flatten([
+ 
+ #############################################################
+ 
+-AC_SUBST([GETTEXT_PACKAGE], [PACKAGE_NAME])
+-AC_DEFINE_UNQUOTED([GETTEXT_PACKAGE], ["$GETTEXT_PACKAGE"],)
++GETTEXT_PACKAGE=firewalld
++AC_SUBST(GETTEXT_PACKAGE)
+ 
+ IT_PROG_INTLTOOL([0.35.0], [no-xml])
+ AM_PO_SUBDIRS
diff --git a/net-firewall/firewalld/firewalld-2.5.1.ebuild b/net-firewall/firewalld/firewalld-2.5.1.ebuild
new file mode 100644
index 0000000000000..3948c4b48a844
--- /dev/null
+++ b/net-firewall/firewalld/firewalld-2.5.1.ebuild
@@ -0,0 +1,231 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{12..14} )
+inherit autotools gnome2-utils linux-info optfeature plocale python-single-r1
+inherit shell-completion systemd xdg-utils
+
+DESCRIPTION="Firewall daemon with D-Bus interface providing a dynamic firewall"
+HOMEPAGE="https://firewalld.org/"
+SRC_URI="https://github.com/firewalld/firewalld/releases/download/v${PV}/${P}.tar.bz2"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="gui selinux test"
+# Tests are too unreliable in sandbox environment
+RESTRICT="!test? ( test ) test"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND="
+	${PYTHON_DEPS}
+	|| ( >=sys-apps/openrc-0.11.5 sys-apps/systemd )
+	$(python_gen_cond_dep '
+		dev-python/dbus-python[${PYTHON_USEDEP}]
+		dev-python/pygobject:3[${PYTHON_USEDEP}]
+		>=net-firewall/nftables-0.9.4[python,json,${PYTHON_USEDEP}]
+		gui? (
+			dev-python/pyqt6[gui,widgets,${PYTHON_USEDEP}]
+			x11-libs/gtk+:3
+			x11-libs/libnotify[introspection]
+		)
+	')
+	net-firewall/ipset
+	net-firewall/nftables[xtables(+)]
+	selinux? ( sec-policy/selinux-firewalld )
+"
+DEPEND="
+	${RDEPEND}
+	dev-libs/glib:2
+"
+BDEPEND="
+	app-text/docbook-xml-dtd
+	>=dev-util/intltool-0.35
+	sys-devel/gettext
+"
+
+# Testsuite's Makefile.am calls missing(!)
+# ... but this seems to be consistent with the autoconf docs?
+# Needs more investigation: https://www.gnu.org/software/autoconf/manual/autoconf-2.67/html_node/autom4te-Invocation.html
+QA_AM_MAINTAINER_MODE=".*--run autom4te --language=autotest.*"
+
+PLOCALES="ar as ast bg bn_IN ca cs da de el en_GB en_US es et eu fa fi fr gl gu he hi hr hu ia id it ja ka kk kn ko lt ml mr nl or pa pl pt_BR pt ro ru si sk sl sq sr@latin sr sv ta te tr uk zh_CN zh_TW"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.4.2-systemd-service.patch
+	"${FILESDIR}"/${PN}-2.5.1-autoconf.patch
+)
+
+pkg_setup() {
+	# See bug #830132 for the huge list
+	# We can probably narrow it down a bit but it's rather fragile
+	local CONFIG_CHECK="
+		~NF_CONNTRACK ~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER
+		~NETFILTER_ADVANCED
+		~NETFILTER_INGRESS
+		~NF_NAT_MASQUERADE
+		~NF_NAT_REDIRECT
+		~NF_TABLES_INET
+		~NF_TABLES_IPV4
+		~NF_TABLES_IPV6
+		~NF_CONNTRACK
+		~NF_CONNTRACK_BROADCAST
+		~NF_CONNTRACK_NETBIOS_NS
+		~NF_CONNTRACK_TFTP
+		~NF_CT_NETLINK
+		~NF_CT_NETLINK_HELPER
+		~NF_DEFRAG_IPV4
+		~NF_DEFRAG_IPV6
+		~NF_NAT
+		~NF_NAT_TFTP
+		~NF_REJECT_IPV4
+		~NF_REJECT_IPV6
+		~NF_SOCKET_IPV4
+		~NF_SOCKET_IPV6
+		~NF_TABLES
+		~NF_TPROXY_IPV4
+		~NF_TPROXY_IPV6
+		~IP_NF_FILTER
+		~IP_NF_IPTABLES
+		~IP_NF_MANGLE
+		~IP_NF_NAT
+		~IP_NF_RAW
+		~IP_NF_SECURITY
+		~IP_NF_TARGET_MASQUERADE
+		~IP_NF_TARGET_REJECT
+		~IP6_NF_FILTER
+		~IP6_NF_IPTABLES
+		~IP6_NF_MANGLE
+		~IP6_NF_NAT
+		~IP6_NF_RAW
+		~IP6_NF_SECURITY
+		~IP6_NF_TARGET_MASQUERADE
+		~IP6_NF_TARGET_REJECT
+		~IP_SET
+		~NETFILTER_CONNCOUNT
+		~NETFILTER_NETLINK
+		~NETFILTER_NETLINK_OSF
+		~NETFILTER_NETLINK_QUEUE
+		~NETFILTER_SYNPROXY
+		~NETFILTER_XTABLES
+		~NETFILTER_XT_CONNMARK
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_MULTIPORT
+		~NETFILTER_XT_MATCH_STATE
+		~NETFILTER_XT_NAT
+		~NETFILTER_XT_TARGET_MASQUERADE
+		~NFT_COMPAT
+		~NFT_CT
+		~NFT_FIB
+		~NFT_FIB_INET
+		~NFT_FIB_IPV4
+		~NFT_FIB_IPV6
+		~NFT_HASH
+		~NFT_LIMIT
+		~NFT_LOG
+		~NFT_MASQ
+		~NFT_NAT
+		~NFT_QUEUE
+		~NFT_QUOTA
+		~NFT_REDIR
+		~NFT_REJECT
+		~NFT_REJECT_INET
+		~NFT_REJECT_IPV4
+		~NFT_REJECT_IPV6
+		~NFT_SOCKET
+		~NFT_SYNPROXY
+		~NFT_TPROXY
+		~NFT_TUNNEL
+		~NFT_XFRM
+	"
+
+	# kernel >= 4.19 has a unified NF_CONNTRACK module, bug #692944
+	if kernel_is -lt 4 19; then
+		CONFIG_CHECK+=" ~NF_CONNTRACK_IPV4 ~NF_CONNTRACK_IPV6"
+	fi
+
+	# bug #831259
+	if kernel_is -le 5 4 ; then
+		CONFIG_CHECK+=" ~NF_TABLES_SET"
+	fi
+
+	# bug #853055
+	if kernel_is -lt 5 18 ; then
+		CONFIG_CHECK+=" ~NFT_COUNTER"
+	fi
+
+	# bug #926685
+	if kernel_is -le 6 1 ; then
+		CONFIG_CHECK+=" ~NFT_OBJREF"
+	fi
+
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# Skip XML schema verification for tests
+	cat <<-EOF > config/xmlschema/check.sh || die
+	#!/bin/sh
+	exit 0
+	EOF
+	chmod +x config/xmlschema/check.sh || die
+
+	# for autotools patch
+	eautoreconf
+
+	plocale_find_changes "po" "" ".po" || die
+	plocale_get_locales | sed -e 's/ /\n/g' > po/LINGUAS
+}
+
+src_configure() {
+	python_setup
+
+	local myeconfargs=(
+		--enable-systemd
+		--with-systemd-unitdir="$(systemd_get_systemunitdir)"
+		--with-bashcompletiondir="$(get_bashcompdir)"
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+	python_optimize
+
+	# Get rid of junk
+	rm -rf "${ED}"/etc/sysconfig/ || die
+
+	# For non-gui installs we need to remove GUI bits
+	if ! use gui; then
+		rm -rf "${ED}"/etc/xdg/autostart || die
+		rm -f "${ED}"/usr/bin/firewall-applet || die
+		rm -f "${ED}"/usr/bin/firewall-config || die
+		rm -rf "${ED}"/usr/share/applications || die
+		rm -rf "${ED}"/usr/share/icons || die
+	fi
+
+	newinitd "${FILESDIR}"/firewalld.init firewalld
+}
+
+pkg_preinst() {
+	gnome2_schemas_savelist
+}
+
+pkg_postinst() {
+	xdg_icon_cache_update
+	gnome2_schemas_update
+
+	# bug #833569
+	optfeature "changing zones with NetworkManager" gnome-extra/nm-applet
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	gnome2_schemas_update
+}