diff --git a/trunk/linux-4.4.x/arch/mips/boot/dts/ralink/mt7621-raeth-gmac2.dtsi b/trunk/linux-4.4.x/arch/mips/boot/dts/ralink/mt7621-raeth-gmac2.dtsi
index 0f2d9d59f4..39608a9968 100644
--- a/trunk/linux-4.4.x/arch/mips/boot/dts/ralink/mt7621-raeth-gmac2.dtsi
+++ b/trunk/linux-4.4.x/arch/mips/boot/dts/ralink/mt7621-raeth-gmac2.dtsi
@@ -17,7 +17,7 @@
         mtketh-wan = "eth3";
         mtketh-ppd = "eth2";
         mtketh-lan = "eth2";
-	ext-devices = "wlan0","wlan1","rax0","ra0", "rai0","apclii0","apclix0", "apcli0";
+	ext-devices = "usb0","wwan0","rax0","ra0", "rai0","apclii0","apclix0", "apcli0";
         mtketh-max-gmac = <2>;
         status = "okay";
 };
diff --git a/trunk/linux-4.4.x/drivers/net/ethernet/raeth/mtk_hnat/hnat.c b/trunk/linux-4.4.x/drivers/net/ethernet/raeth/mtk_hnat/hnat.c
index 7104a21334..3c176eb508 100644
--- a/trunk/linux-4.4.x/drivers/net/ethernet/raeth/mtk_hnat/hnat.c
+++ b/trunk/linux-4.4.x/drivers/net/ethernet/raeth/mtk_hnat/hnat.c
@@ -227,7 +227,7 @@ static int hnat_start(void)
 	cr_set_field(hnat_priv->ppe_base + PPE_BIND_LMT_0, HALF_LMT, 16383);
 	cr_set_field(hnat_priv->ppe_base + PPE_BIND_LMT_1, FULL_LMT, 16383);
 	/* setup binding threshold as 30 packets per second */
-	cr_set_field(hnat_priv->ppe_base + PPE_BNDR, BIND_RATE, 0x1E);
+	cr_set_field(hnat_priv->ppe_base + PPE_BNDR, BIND_RATE, 0x5);
 
 	/* setup FOE cf gen */
 	cr_set_field(hnat_priv->ppe_base + PPE_GLO_CFG, PPE_EN, 1);
diff --git a/trunk/linux-4.4.x/drivers/net/ethernet/raeth/mtk_hnat/hnat_nf_hook.c b/trunk/linux-4.4.x/drivers/net/ethernet/raeth/mtk_hnat/hnat_nf_hook.c
index e9976cc57b..d14ce6d017 100644
--- a/trunk/linux-4.4.x/drivers/net/ethernet/raeth/mtk_hnat/hnat_nf_hook.c
+++ b/trunk/linux-4.4.x/drivers/net/ethernet/raeth/mtk_hnat/hnat_nf_hook.c
@@ -29,7 +29,7 @@
 #include "../mtk_eth_soc.h"
 
 #define do_ge2ext_fast(dev, skb)                                               \
-	((IS_LAN(dev) || IS_WAN(dev) || IS_PPD(dev)) && \
+	((IS_LAN(dev) || IS_WAN(dev) || IS_PPD(dev) || IS_EXT(dev)) && \
 	 skb_hnat_is_hashed(skb) && \
 	 skb_hnat_reason(skb) == HIT_BIND_FORCE_TO_CPU)
 #define do_ext2ge_fast_learn(dev, skb)                                         \
@@ -455,6 +455,11 @@ unsigned int do_hnat_ge_to_ext(struct sk_buff *skb, const char *func)
 	if (skb->dev) {
 		skb_set_network_header(skb, 0);
 		skb_push(skb, ETH_HLEN);
+		if (skb_hnat_reason(skb) == HIT_BIND_FORCE_TO_CPU) {
+			trace_printk("[%s] reason=0x%x(force to CPU) from WAN to Ext\n",
+				     __func__, skb_hnat_reason(skb));
+			skb->pkt_type = PACKET_HOST;
+		}
 		dev_queue_xmit(skb);
 		trace_printk("%s: called from %s successfully\n", __func__,
 			     func);