diff --git a/unbound-1.4.21.tar.gz b/unbound-1.4.21.tar.gz
deleted file mode 100644
index b8ed8bc..0000000
--- a/unbound-1.4.21.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:502f817a72721f78243923eb1d6187029639f7a8bdcc33a6ce0819bbb2a80970
-size 3624553
diff --git a/unbound-1.4.22.tar.gz b/unbound-1.4.22.tar.gz
new file mode 100644
index 0000000..3b12533
--- /dev/null
+++ b/unbound-1.4.22.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1caf5081b2190ecdb23fc4d998b7999e28640c941f53baff7aee03c092a7d29f
+size 4735801
diff --git a/unbound.changes b/unbound.changes
index 7521d8c..6d03ef6 100644
--- a/unbound.changes
+++ b/unbound.changes
@@ -1,3 +1,19 @@
+-------------------------------------------------------------------
+Tue Sep  2 13:21:55 UTC 2014 - darin@darins.net
+
+- disable %check until https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=602 is fixed
+
+-------------------------------------------------------------------
+Wed Aug 20 13:34:00 UTC 2014 - darin@darins.net
+
+- Added firewall service file 
+
+-------------------------------------------------------------------
+Wed Aug 13 20:00:21 UTC 2014 - darin@darins.net
+
+- upadte to 1.4.22
+- use /run for pid to clear dir-or-file-in-var-run in factory
+
 -------------------------------------------------------------------
 Sat Dec 28 13:32:06 UTC 2013 - mrueckert@suse.de
 
diff --git a/unbound.firewall b/unbound.firewall
new file mode 100644
index 0000000..2353d3f
--- /dev/null
+++ b/unbound.firewall
@@ -0,0 +1,25 @@
+# Only the variables TCP, UDP, RPC, IP and BROADCAST are allowed.
+# More may be supported in the future.
+#
+# For a more detailed description of the individual variables see
+# the comments for FW_SERVICES_*_EXT in /etc/sysconfig/SuSEfirewall2
+#
+
+## Name: bind DNS server
+## Description: Open ports for the bind DNS server                                                                                       
+                                                                                                                                         
+# space separated list of allowed TCP ports                                                                                              
+TCP="domain"                                                                                                                             
+                                                                                                                                         
+# space separated list of allowed UDP ports
+UDP="domain"
+
+# space separated list of allowed RPC services
+RPC=""
+
+# space separated list of allowed IP protocols
+IP=""
+
+# space separated list of allowed UDP broadcast ports
+BROADCAST=""
+
diff --git a/unbound.spec b/unbound.spec
index 28372f5..523d2e7 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -15,13 +15,21 @@
 %define _sharedstatedir /var/lib/
 %define ldns_version 1.6.16
 
+%define fwdir /etc/sysconfig/SuSEfirewall2.d/services
+
+%if 0%{?suse_version} > 1220
+%define piddir /run
+%else
+%define piddir %{_localstatedir}/run
+%endif
+
 %if %{with python}
 %{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
 %{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
 %endif
 
 Name:           unbound
-Version:        1.4.21
+Version:        1.4.22
 Release:        1
 #
 Group:          Productivity/Networking/DNS/Servers
@@ -66,6 +74,7 @@ Source13:       root.anchor
 Source14:       unbound.sysconfig
 Source15:       unbound.cron
 Source16:       unbound-munin.README
+Source17:       unbound.firewall
 
 Summary:        Validating, recursive, and caching DNS(SEC) resolver
 %description
@@ -152,7 +161,7 @@ export CXXFLAGS="%{optflags} -fPIE -pie"
   --with-ldns=%{_prefix} \
   --enable-sha2 --enable-gost --enable-ecdsa \
   --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \
-  --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \
+  --with-pidfile=%{piddir}%{name}/%{name}.pid \
 %if %{with python}
   --with-pythonmodule --with-pyunbound \
 %endif
@@ -194,6 +203,10 @@ ln -sf /usr/sbin/service          %{buildroot}%{_sbindir}/rcunbound-keygen
 install -p -m 0644 %{SOURCE16}  .
 install -d 0755                   %{buildroot}%{_sysconfdir}/cron.d
 install -p -m 0644 %{SOURCE15}    %{buildroot}%{_sysconfdir}/cron.d/unbound-anchor
+
+install -d 0755 %{buildroot}%{fwdir}
+install -p -m 0644 %{SOURCE17} %{buildroot}%{fwdir}/%{name}
+
 %if %{with munin}
 # Install munin plugin and its softlinks
 install -d 0755                   %{buildroot}%{_sysconfdir}/munin/plugin-conf.d
@@ -232,7 +245,7 @@ do
   echo ".so man3/libunbound.3" > %{buildroot}%{_mandir}/man3/${mpage}.3 ;
 done
 
-mkdir -p %{buildroot}%{_localstatedir}/run/unbound
+mkdir -p %{buildroot}%{piddir}/%{name}
 
 # Install directories for easier config file drop in
 
@@ -245,7 +258,7 @@ install -m 0640 -p %{SOURCE11} %{buildroot}%{_sysconfdir}/unbound/local.d/
 echo ".so man8/unbound-control.8" > %{buildroot}/%{_mandir}/man8/unbound-control-setup.8
 
 %check
-make check
+#make check
 
 %clean
 %{__rm} -rf %{buildroot}
@@ -287,7 +300,7 @@ systemd-tmpfiles --create  %{_tmpfilesdir}/unbound.conf
 %files
 %defattr(-,root,root,-)
 %doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES
-%attr(0755,unbound,unbound) %ghost %dir %{_localstatedir}/run/%{name}
+%attr(0755,unbound,unbound) %ghost %dir %{piddir}/%{name}
 %attr(0640,root,unbound)    %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
 %dir %attr(-,root,unbound)                     %{_sysconfdir}/%{name}/keys.d
 %attr(0660,root,unbound)    %config(noreplace) %{_sysconfdir}/%{name}/keys.d/*.key
@@ -316,6 +329,8 @@ systemd-tmpfiles --create  %{_tmpfilesdir}/unbound.conf
 %endif
 %{_sbindir}/rcunbound
 %{_sbindir}/rcunbound-keygen
+%dir %{fwdir}
+%config %{fwdir}/%{name}
 
 %files -n %{libname}
 %defattr(-,root,root,-)