diff --git a/package/network/utils/iproute2/Makefile b/package/network/utils/iproute2/Makefile
index 928f44e79..5439c050c 100644
--- a/package/network/utils/iproute2/Makefile
+++ b/package/network/utils/iproute2/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=iproute2
-PKG_VERSION:=5.15.0
+PKG_VERSION:=5.19.0
 PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/utils/net/iproute2
-PKG_HASH:=38e3e4a5f9a7f5575c015027a10df097c149111eeb739993128e5b2b35b291ff
+PKG_HASH:=26b7a34d6a7fd2f7a42e2b39c5a90cb61bac522d1096067ffeb195e5693d7791
 PKG_BUILD_PARALLEL:=1
 PKG_BUILD_DEPENDS:=iptables
 PKG_LICENSE:=GPL-2.0
@@ -57,7 +57,16 @@ $(call Package/iproute2/Default)
   DEFAULT_VARIANT:=1
   PROVIDES:=tc
   ALTERNATIVES:=200:/sbin/tc:/usr/libexec/tc-tiny
-  DEPENDS:=+kmod-sched-core +libxtables +tc-mod-iptables +(PACKAGE_devlink||PACKAGE_rdma):libmnl
+  DEPENDS:=+kmod-sched-core +(PACKAGE_devlink||PACKAGE_rdma):libmnl
+endef
+
+define Package/tc-bpf
+$(call Package/iproute2/Default)
+  TITLE:=Traffic control utility (bpf)
+  VARIANT:=tcbpf
+  PROVIDES:=tc
+  ALTERNATIVES:=300:/sbin/tc:/usr/libexec/tc-bpf
+  DEPENDS:=+kmod-sched-core +(PACKAGE_devlink||PACKAGE_rdma):libmnl +libbpf
 endef
 
 define Package/tc-full
@@ -65,13 +74,14 @@ $(call Package/iproute2/Default)
   TITLE:=Traffic control utility (full)
   VARIANT:=tcfull
   PROVIDES:=tc
-  ALTERNATIVES:=300:/sbin/tc:/usr/libexec/tc-full
-  DEPENDS:=+kmod-sched-core +libxtables +tc-mod-iptables +libbpf +(PACKAGE_devlink||PACKAGE_rdma):libmnl
+  ALTERNATIVES:=400:/sbin/tc:/usr/libexec/tc-full
+  DEPENDS:=+kmod-sched-core +(PACKAGE_devlink||PACKAGE_rdma):libmnl +libbpf +libxtables +tc-mod-iptables
 endef
 
 define Package/tc-mod-iptables
 $(call Package/iproute2/Default)
   TITLE:=Traffic control module - iptables action
+  VARIANT:=tcfull
   DEPENDS:=+libxtables
 endef
 
@@ -123,13 +133,29 @@ endif
 
 ifeq ($(BUILD_VARIANT),tctiny)
   LIBBPF_FORCE:=off
+endif
+
+ifeq ($(BUILD_VARIANT),tcbpf)
+  HAVE_ELF:=y
+  LIBBPF_FORCE:=on
   SHARED_LIBS:=y
 endif
 
 ifeq ($(BUILD_VARIANT),tcfull)
+  #enable iptables/xtables requirement only if tciptables variant is selected
+  TC_CONFIG_XT:=y
+  TC_CONFIG_XT_OLD:=y
+  TC_CONFIG_XT_OLD_H:=y
+  TC_CONFIG_IPSET:=y
   HAVE_ELF:=y
   LIBBPF_FORCE:=on
   SHARED_LIBS:=y
+else
+  #disable iptables requirement by default
+  TC_CONFIG_XT:=n
+  TC_CONFIG_XT_OLD:=n
+  TC_CONFIG_XT_OLD_H:=n
+  TC_CONFIG_IPSET:=n
 endif
 
 ifdef CONFIG_PACKAGE_devlink
@@ -158,8 +184,13 @@ MAKE_FLAGS += \
 	HAVE_ELF=$(HAVE_ELF) \
 	HAVE_MNL=$(HAVE_MNL) \
 	HAVE_CAP=$(HAVE_CAP) \
+	HAVE_TIRPC=n \
 	IPT_LIB_DIR=/usr/lib/iptables \
 	XT_LIB_DIR=/usr/lib/iptables \
+	TC_CONFIG_XT=$(TC_CONFIG_XT) \
+	TC_CONFIG_XT_OLD=$(TC_CONFIG_XT_OLD) \
+	TC_CONFIG_XT_OLD_H=$(TC_CONFIG_XT_OLD_H) \
+	TC_CONFIG_IPSET=$(TC_CONFIG_IPSET) \
 	FPIC="$(FPIC)" \
 	$(if $(findstring c,$(OPENWRT_VERBOSE)),V=1,V='')
 
@@ -190,6 +221,11 @@ define Package/tc-tiny/install
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/tc/tc $(1)/usr/libexec/tc-tiny
 endef
 
+define Package/tc-bpf/install
+	$(INSTALL_DIR) $(1)/usr/libexec
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/tc/tc $(1)/usr/libexec/tc-bpf
+endef
+
 define Package/tc-full/install
 	$(INSTALL_DIR) $(1)/usr/libexec
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/tc/tc $(1)/usr/libexec/tc-full
@@ -236,6 +272,7 @@ $(eval $(call BuildPackage,ip-full))
 # spurious rebuilds when building multiple variants.
 $(eval $(call BuildPackage,tc-mod-iptables))
 $(eval $(call BuildPackage,tc-tiny))
+$(eval $(call BuildPackage,tc-bpf))
 $(eval $(call BuildPackage,tc-full))
 $(eval $(call BuildPackage,genl))
 $(eval $(call BuildPackage,ip-bridge))
diff --git a/package/network/utils/iproute2/patches/100-configure.patch b/package/network/utils/iproute2/patches/100-configure.patch
index 0c19b2086..2d4fb7b9b 100644
--- a/package/network/utils/iproute2/patches/100-configure.patch
+++ b/package/network/utils/iproute2/patches/100-configure.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -34,7 +34,8 @@ int main(int argc, char **argv) {
+@@ -36,7 +36,8 @@ int main(int argc, char **argv) {
  }
  EOF
  
diff --git a/package/network/utils/iproute2/patches/105-ipstats-Define-MIN-function-to-fix-undefined-referen.patch b/package/network/utils/iproute2/patches/105-ipstats-Define-MIN-function-to-fix-undefined-referen.patch
new file mode 100644
index 000000000..7bf55dd57
--- /dev/null
+++ b/package/network/utils/iproute2/patches/105-ipstats-Define-MIN-function-to-fix-undefined-referen.patch
@@ -0,0 +1,27 @@
+From c69e8e474936795a2cd7638b11ce3e99ff4d5ae7 Mon Sep 17 00:00:00 2001
+From: Nick Hainke <vincent@systemli.org>
+Date: Sat, 6 Aug 2022 10:00:20 +0200
+Subject: [PATCH] ipstats: Define MIN function to fix undefined references
+
+Fixes errors in the form of:
+ in function `ipstats_show_64':
+ <artificial>:(.text+0x4e30): undefined reference to `MIN'
+
+Signed-off-by: Nick Hainke <vincent@systemli.org>
+---
+ ip/ipstats.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/ip/ipstats.c
++++ b/ip/ipstats.c
+@@ -6,6 +6,10 @@
+ #include "utils.h"
+ #include "ip_common.h"
+ 
++#ifndef MIN
++#define MIN(a, b) ((a) < (b) ? (a) : (b))
++#endif
++
+ struct ipstats_stat_dump_filters {
+ 	/* mask[0] filters outer attributes. Then individual nests have their
+ 	 * filtering mask at the index of the nested attribute.
diff --git a/package/network/utils/iproute2/patches/130-no_netem_tipc_dcb_man_vdpa.patch b/package/network/utils/iproute2/patches/130-no_netem_tipc_dcb_man_vdpa.patch
index 8ddb31674..2a3f9eb90 100644
--- a/package/network/utils/iproute2/patches/130-no_netem_tipc_dcb_man_vdpa.patch
+++ b/package/network/utils/iproute2/patches/130-no_netem_tipc_dcb_man_vdpa.patch
@@ -1,11 +1,14 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -55,7 +55,7 @@ WFLAGS += -Wmissing-declarations -Wold-s
+@@ -65,9 +65,9 @@ WFLAGS += -Wmissing-declarations -Wold-s
  CFLAGS := $(WFLAGS) $(CCOPTS) -I../include -I../include/uapi $(DEFINES) $(CFLAGS)
  YACCFLAGS = -d -t -v
  
--SUBDIRS=lib ip tc bridge misc netem genl tipc devlink rdma dcb man vdpa
-+SUBDIRS=lib ip tc bridge misc genl devlink rdma
+-SUBDIRS=lib ip tc bridge misc netem genl man
++SUBDIRS=lib ip tc bridge misc genl
+ ifeq ($(HAVE_MNL),y)
+-SUBDIRS += tipc devlink rdma dcb vdpa
++SUBDIRS += devlink rdma
+ endif
  
  LIBNETLINK=../lib/libutil.a ../lib/libnetlink.a
- LDLIBS += $(LIBNETLINK)
diff --git a/package/network/utils/iproute2/patches/140-keep_libmnl_optional.patch b/package/network/utils/iproute2/patches/140-keep_libmnl_optional.patch
index ff7e9ca4e..a8cdd103b 100644
--- a/package/network/utils/iproute2/patches/140-keep_libmnl_optional.patch
+++ b/package/network/utils/iproute2/patches/140-keep_libmnl_optional.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -387,7 +387,7 @@ check_selinux()
+@@ -411,7 +411,7 @@ check_tirpc()
  
  check_mnl()
  {
diff --git a/package/network/utils/iproute2/patches/145-keep_libelf_optional.patch b/package/network/utils/iproute2/patches/145-keep_libelf_optional.patch
index 079ca0512..0c5c3f59e 100644
--- a/package/network/utils/iproute2/patches/145-keep_libelf_optional.patch
+++ b/package/network/utils/iproute2/patches/145-keep_libelf_optional.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -255,7 +255,7 @@ EOF
+@@ -266,7 +266,7 @@ EOF
  
  check_elf()
  {
diff --git a/package/network/utils/iproute2/patches/150-keep_libcap_optional.patch b/package/network/utils/iproute2/patches/150-keep_libcap_optional.patch
index 68e162416..4cce2c3ca 100644
--- a/package/network/utils/iproute2/patches/150-keep_libcap_optional.patch
+++ b/package/network/utils/iproute2/patches/150-keep_libcap_optional.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -445,7 +445,7 @@ EOF
+@@ -469,7 +469,7 @@ EOF
  
  check_cap()
  {
diff --git a/package/network/utils/iproute2/patches/155-keep_tirpc_optional.patch b/package/network/utils/iproute2/patches/155-keep_tirpc_optional.patch
new file mode 100644
index 000000000..28ba7e521
--- /dev/null
+++ b/package/network/utils/iproute2/patches/155-keep_tirpc_optional.patch
@@ -0,0 +1,11 @@
+--- a/configure
++++ b/configure
+@@ -398,7 +398,7 @@ check_selinux()
+ 
+ check_tirpc()
+ {
+-	if ${PKG_CONFIG} libtirpc --exists; then
++	if [ "${HAVE_TIRPC}" = "y" ] && ${PKG_CONFIG} libtirpc --exists; then
+ 		echo "HAVE_RPC:=y" >>$CONFIG
+ 		echo "yes"
+ 
diff --git a/package/network/utils/iproute2/patches/170-ip_tiny.patch b/package/network/utils/iproute2/patches/170-ip_tiny.patch
index cd687e760..ba2cb0637 100644
--- a/package/network/utils/iproute2/patches/170-ip_tiny.patch
+++ b/package/network/utils/iproute2/patches/170-ip_tiny.patch
@@ -1,6 +1,6 @@
 --- a/ip/Makefile
 +++ b/ip/Makefile
-@@ -17,6 +17,13 @@ RTMONOBJ=rtmon.o
+@@ -19,6 +19,13 @@ RTMONOBJ=rtmon.o
  
  include ../config.mk
  
@@ -12,9 +12,9 @@
 +STATIC_SYM_SOURCES:=$(filter-out $(STATIC_SYM_FILTER),$(wildcard *.c))
 +
  ALLOBJ=$(IPOBJ) $(RTMONOBJ)
- SCRIPTS=ifcfg rtpr routel routef
+ SCRIPTS=routel
  TARGETS=ip rtmon
-@@ -46,7 +53,7 @@ else
+@@ -48,7 +55,7 @@ else
  
  ip: static-syms.o
  static-syms.o: static-syms.h
@@ -30,20 +30,20 @@
  		"Usage: ip [ OPTIONS ] OBJECT { COMMAND | help }\n"
  		"       ip [ -force ] -batch filename\n"
 +#ifndef IPROUTE2_TINY
- 		"where  OBJECT := { address | addrlabel | fou | help | ila | ioam | l2tp | link |\n"
- 		"                   macsec | maddress | monitor | mptcp | mroute | mrule |\n"
+ 		"where  OBJECT := { address | addrlabel | amt | fou | help | ila | ioam | l2tp |\n"
+ 		"                   link | macsec | maddress | monitor | mptcp | mroute | mrule |\n"
  		"                   neighbor | neighbour | netconf | netns | nexthop | ntable |\n"
  		"                   ntbl | route | rule | sr | tap | tcpmetrics |\n"
  		"                   token | tunnel | tuntap | vrf | xfrm }\n"
 +#else
-+		"where  OBJECT := { address | ila | link | macsec | maddress | monitor |\n"
-+		"                   mroute | mrule | neighbor | neighbour | netns | route |\n"
-+		"                   rule | sr | token | tunnel | vrf }\n"
++		"where  OBJECT := { address | link | maddress | monitor |\n"
++		"                   neighbor | neighbour | netns | route |\n"
++		"                   rule | token | tunnel }\n"
 +#endif
  		"       OPTIONS := { -V[ersion] | -s[tatistics] | -d[etails] | -r[esolve] |\n"
  		"                    -h[uman-readable] | -iec | -j[son] | -p[retty] |\n"
  		"                    -f[amily] { inet | inet6 | mpls | bridge | link } |\n"
-@@ -91,37 +97,51 @@ static const struct cmd {
+@@ -91,37 +97,49 @@ static const struct cmd {
  	int (*func)(int argc, char **argv);
  } cmds[] = {
  	{ "address",	do_ipaddr },
@@ -63,9 +63,9 @@
 +#ifndef IPROUTE2_TINY
  	{ "l2tp",	do_ipl2tp },
  	{ "fou",	do_ipfou },
-+#endif
  	{ "ila",	do_ipila },
  	{ "macsec",	do_ipmacsec },
++#endif
  	{ "tunnel",	do_iptunnel },
  	{ "tunl",	do_iptunnel },
 +#ifndef IPROUTE2_TINY
@@ -78,23 +78,21 @@
  	{ "monitor",	do_ipmonitor },
 +#ifndef IPROUTE2_TINY
  	{ "xfrm",	do_xfrm },
-+#endif
  	{ "mroute",	do_multiroute },
  	{ "mrule",	do_multirule },
++#endif
  	{ "netns",	do_netns },
 +#ifndef IPROUTE2_TINY
  	{ "netconf",	do_ipnetconf },
-+#endif
  	{ "vrf",	do_ipvrf},
  	{ "sr",		do_seg6 },
-+#ifndef IPROUTE2_TINY
  	{ "nexthop",	do_ipnh },
  	{ "mptcp",	do_mptcp },
  	{ "ioam",	do_ioam6 },
 +#endif
  	{ "help",	do_help },
+ 	{ "stats",	do_ipstats },
  	{ 0 }
- };
 --- a/lib/Makefile
 +++ b/lib/Makefile
 @@ -3,6 +3,10 @@ include ../config.mk
diff --git a/package/network/utils/iproute2/patches/180-drop_FAILED_POLICY.patch b/package/network/utils/iproute2/patches/180-drop_FAILED_POLICY.patch
index 07d5230a6..094ff393a 100644
--- a/package/network/utils/iproute2/patches/180-drop_FAILED_POLICY.patch
+++ b/package/network/utils/iproute2/patches/180-drop_FAILED_POLICY.patch
@@ -31,7 +31,7 @@ Subject: [PATCH] add support for dropping with FAILED_POLICY
  		if (!end || end == arg || *end || res > 255)
 --- a/include/uapi/linux/rtnetlink.h
 +++ b/include/uapi/linux/rtnetlink.h
-@@ -256,6 +256,7 @@ enum {
+@@ -265,6 +265,7 @@ enum {
  	RTN_THROW,		/* Not in this table		*/
  	RTN_NAT,		/* Translate this address	*/
  	RTN_XRESOLVE,		/* Use external resolver	*/
diff --git a/package/network/utils/iproute2/patches/190-fix-nls-rpath-link.patch b/package/network/utils/iproute2/patches/190-fix-nls-rpath-link.patch
index 92d02b9a4..c7fceb2e2 100644
--- a/package/network/utils/iproute2/patches/190-fix-nls-rpath-link.patch
+++ b/package/network/utils/iproute2/patches/190-fix-nls-rpath-link.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -279,7 +279,7 @@ int main(int argc, char **argv) {
+@@ -290,7 +290,7 @@ int main(int argc, char **argv) {
  }
  EOF
  
@@ -9,7 +9,7 @@
      local ret=$?
  
      rm -f $TMPDIR/libbpf_test.c $TMPDIR/libbpf_test
-@@ -297,7 +297,7 @@ int main(int argc, char **argv) {
+@@ -308,7 +308,7 @@ int main(int argc, char **argv) {
  }
  EOF
  
diff --git a/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch b/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch
index 13418662e..dc9c0b296 100644
--- a/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch
+++ b/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch
@@ -1,9 +1,9 @@
 --- a/ip/Makefile
 +++ b/ip/Makefile
-@@ -26,7 +26,7 @@ STATIC_SYM_SOURCES:=$(filter-out $(STATI
+@@ -28,7 +28,7 @@ STATIC_SYM_SOURCES:=$(filter-out $(STATI
  
  ALLOBJ=$(IPOBJ) $(RTMONOBJ)
- SCRIPTS=ifcfg rtpr routel routef
+ SCRIPTS=routel
 -TARGETS=ip rtmon
 +TARGETS=$(findstring ip,$(BUILD_VARIANT)) rtmon
  
diff --git a/package/network/utils/iproute2/patches/200-drop_libbsd_dependency.patch b/package/network/utils/iproute2/patches/200-drop_libbsd_dependency.patch
index 12a1ccfa3..d1948860e 100644
--- a/package/network/utils/iproute2/patches/200-drop_libbsd_dependency.patch
+++ b/package/network/utils/iproute2/patches/200-drop_libbsd_dependency.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -431,14 +431,8 @@ EOF
+@@ -455,14 +455,8 @@ EOF
      if $CC -I$INCLUDE -o $TMPDIR/strtest $TMPDIR/strtest.c >/dev/null 2>&1; then
  	echo "no"
      else
diff --git a/package/network/utils/iproute2/patches/300-selinux-configurable.patch b/package/network/utils/iproute2/patches/300-selinux-configurable.patch
index b7e61fd3b..817abf7d1 100644
--- a/package/network/utils/iproute2/patches/300-selinux-configurable.patch
+++ b/package/network/utils/iproute2/patches/300-selinux-configurable.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -374,7 +374,7 @@ check_libbpf()
+@@ -385,7 +385,7 @@ check_libbpf()
  check_selinux()
  # SELinux is a compile time option in the ss utility
  {