diff --git a/package-21.02/kernel/crypto-eip/src/xfrm-offload.c b/package-21.02/kernel/crypto-eip/src/xfrm-offload.c
index 9e101e8..1f29dd0 100644
--- a/package-21.02/kernel/crypto-eip/src/xfrm-offload.c
+++ b/package-21.02/kernel/crypto-eip/src/xfrm-offload.c
@@ -282,6 +282,16 @@
 {
 	struct mtk_xfrm_params *xfrm_params;
 
+	/*
+	 * EIP197 does not support fragmentation. As a result, we can not bind UDP
+	 * flow since it may cause network fail due to fragmentation
+	 */
+	if (ntohs(skb->protocol) != ETH_P_IP
+	    || ip_hdr(skb)->protocol != IPPROTO_TCP) {
+		skb_hnat_alg(skb) = 1;
+		return false;
+	}
+
 	xfrm_params = (struct mtk_xfrm_params *)xs->xso.offload_handle;
 	skb_hnat_cdrt(skb) = xfrm_params->cdrt->idx;
 
diff --git a/target/linux/mediatek/patches-5.4/999-4102-mtk-crypto-offload-support.patch b/target/linux/mediatek/patches-5.4/999-4102-mtk-crypto-offload-support.patch
index 360be72..75880ed 100644
--- a/target/linux/mediatek/patches-5.4/999-4102-mtk-crypto-offload-support.patch
+++ b/target/linux/mediatek/patches-5.4/999-4102-mtk-crypto-offload-support.patch
@@ -95,7 +95,22 @@
  		return 0;
  
  	ct = nf_ct_get(skb, &ctinfo);
-@@ -3005,7 +3017,10 @@ mtk_hnat_ipv4_nf_local_out(void *priv, s
+@@ -2709,6 +2721,14 @@ static unsigned int mtk_hnat_nf_post_rou
+ 		}
+ 	}
+ 
++	/* we are not support protocols other than IPv4 TCP for crypto offload yet */
++	if (skb_hnat_is_decrypt(skb)
++	    && (ntohs(skb->protocol) != ETH_P_IP
++		|| ip_hdr(skb)->protocol != IPPROTO_TCP)) {
++		skb_hnat_alg(skb) = 1;
++		return 0;
++	}
++
+ 	if (!IS_LAN_GRP(out) && !IS_WAN(out) && !IS_EXT(out))
+ 		is_virt_dev = true;
+ 
+@@ -3016,7 +3036,10 @@ mtk_hnat_ipv4_nf_local_out(void *priv, s
  	if (iph->protocol == IPPROTO_IPV6) {
  		entry->udib1.pkt_type = IPV6_6RD;
  		hnat_set_head_frags(state, skb, 0, hnat_set_alg);
diff --git a/target/linux/mediatek/patches-5.4/999-4103-mtk-tunnel-crypto-offload-support.patch b/target/linux/mediatek/patches-5.4/999-4103-mtk-tunnel-crypto-offload-support.patch
index 8bc2300..b2cc240 100644
--- a/target/linux/mediatek/patches-5.4/999-4103-mtk-tunnel-crypto-offload-support.patch
+++ b/target/linux/mediatek/patches-5.4/999-4103-mtk-tunnel-crypto-offload-support.patch
@@ -138,7 +138,7 @@
  	skb_hnat_magic_tag(skb) = HNAT_MAGIC_TAG;
  
  	if (skb_hnat_iface(skb) == FOE_MAGIC_WED0)
-@@ -3017,7 +3062,8 @@ mtk_hnat_ipv4_nf_local_out(void *priv, s
+@@ -3037,7 +3082,8 @@ mtk_hnat_ipv4_nf_local_out(void *priv, s
  		entry->udib1.pkt_type = IPV6_6RD;
  		hnat_set_head_frags(state, skb, 0, hnat_set_alg);
  	} else if (is_magic_tag_valid(skb)