diff --git a/configure.ac b/configure.ac
index 045bd2ae..ba916c5b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -241,6 +241,18 @@ AC_ARG_ENABLE([hotspot],
         [enable_hotspot=true])
 AM_CONDITIONAL([ENABLE_HOTSPOT_SERVICE], [test x$enable_hotspot = xtrue])
 
+AC_ARG_ENABLE([igmpmld],
+         AS_HELP_STRING([--enable-igmpmld],[Enable igmpmld]),
+        [
+          case "${enableval}" in
+            yes) enable_igmpmld=true ;;
+            no) enable_igmpmld=false ;;
+            *) AC_MSG_ERROR([bad value ${enableval} for --enable-igmpmld]) ;;
+          esac
+           ],
+        [enable_igmpmld=true])
+AM_CONDITIONAL([ENABLE_MCAST_SERVICE], [test x$enable_igmpmld = xtrue])
+
 AC_CONFIG_FILES(
 	Makefile
 	source/Makefile
diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c
index 50538050..7172eaa0 100644
--- a/source/firewall/firewall.c
+++ b/source/firewall/firewall.c
@@ -473,6 +473,10 @@ char cellular_ifname[32];
 #define SYSEVENT_MAPT_CONFIG_FLAG "mapt_config_flag"
 #define SYSEVENT_MAPT_IP_ADDRESS "mapt_ip_address"
 #define MAPT_NAT_IPV4_POST_ROUTING_TABLE "postrouting_towan"
+#define MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP "postrouting_towan_tcp"
+#define MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP "postrouting_towan_udp"
+#define MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP "postrouting_towan_icmp"
+
 #define SYSEVENT_MAPT_RATIO "mapt_ratio"
 #define SYSEVENT_MAPT_IPV6_ADDRESS "mapt_ipv6_address"
 #define SYSEVENT_MAPT_PSID_OFFSET "mapt_psid_offset"
@@ -1187,7 +1191,11 @@ int do_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp)
 #if defined(IVI_KERNEL_SUPPORT)
     fprintf(nat_fp, "-A POSTROUTING -o %s -j %s\n",get_current_wan_ifname(),MAPT_NAT_IPV4_POST_ROUTING_TABLE);
 #elif defined(NAT46_KERNEL_SUPPORT) || defined (FEATURE_SUPPORT_MAPT_NAT46)
-    fprintf(nat_fp, "-A POSTROUTING -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE);
+   fprintf(nat_fp, "-A POSTROUTING -p tcp -m conntrack --ctstate NEW -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP);
+   fprintf(nat_fp, "-A POSTROUTING -p udp -m conntrack --ctstate NEW -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP);
+
+   fprintf(nat_fp, "-A POSTROUTING -p icmp -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP);
+
 #endif
 
 #if defined(NAT46_KERNEL_SUPPORT)
@@ -1292,6 +1300,42 @@ int do_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp)
 
         /* Start of port range parameters. */
         /* create rules */
+#if defined (_XB6_PRODUCT_REQ_)
+        if (offset != 0)
+        {
+          for(i = start_i; i < a; i++)
+          {
+              for(j = 0; j < contiguous_port; j++)
+              {
+                  port = (i << block_shift) + (psid << m) + j;
+
+                  if (j == 0)
+                      initialPortValue = port;
+                  if (j == contiguous_port - 1 )
+                      finalPortValue = port;
+              }
+
+              if (i == a-1)
+              {
+                 fprintf(nat_fp, "-A %s -p tcp -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, ipaddress_str, initialPortValue,finalPortValue);
+                 fprintf(nat_fp, "-A %s -p udp -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, ipaddress_str, initialPortValue,finalPortValue);
+              }
+              else if (i > a-4)
+              {
+                 fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 45/second --hashlimit-burst 60 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, ipaddress_str, initialPortValue,finalPortValue);
+                 fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 100/second --hashlimit-burst 100 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, ipaddress_str, initialPortValue,finalPortValue);
+              }
+              else
+              {
+                 fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 30/second --hashlimit-burst 60 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, ipaddress_str, initialPortValue,finalPortValue);
+                 fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 60/second --hashlimit-burst 100 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, ipaddress_str, initialPortValue,finalPortValue);
+              }
+
+              fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+              FIREWALL_DEBUG("MAPT Rule: Port range is initialPortValue=%d, finalPortValue=%d \n" COMMA initialPortValue COMMA finalPortValue);
+          }
+        }
+#endif
         for(i = start_i; i < a; i++)
         {
             for(j=0; j<(contiguous_port); j++)
@@ -1314,9 +1358,32 @@ int do_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp)
             fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
             fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
 #else
-            fprintf(nat_fp, "-A %s -p tcp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
-            fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
-            fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+            if (offset == 0)
+            {
+               fprintf(nat_fp, "-A %s -p tcp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+               fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+               fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+            }
+            else
+            {
+               if (i == a-1)
+               {
+                   fprintf(nat_fp, "-A %s -p tcp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+                   fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+               }
+               else if(i > a-4)
+               {
+                   fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 45/second --hashlimit-burst 60 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+                   fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 100/second --hashlimit-burst 100 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+               }
+               else
+               {
+                   fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 30/second --hashlimit-burst 60 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+                   fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 60/second --hashlimit-burst 100 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+               }
+
+               fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
+            }
 #endif //_HUB4_PRODUCT_REQ_NO_DPORT_
 #endif //IVI_KERNEL_SUPPORT
             FIREWALL_DEBUG("MAPT Rule: Port range is initialPortValue=%u, finalPortValue=%u \n" COMMA initialPortValue COMMA finalPortValue);
@@ -1500,6 +1567,14 @@ void do_webui_attack_filter(FILE *filter_fp)
    fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", ".pi");
    fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", ".sh");
    fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", ".py");
+#if defined(_CBR2_PRODUCT_REQ_) || defined(_ONESTACK_PRODUCT_REQ_)
+   #ifdef _ONESTACK_PRODUCT_REQ_
+        if(isFeatureSupportedInCurrentMode(FEATURE_SAVE_RESTORE))
+   #endif
+    {
+   fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -p tcp -m string --algo bm --from 0 --to 64 --string \"%s\" -j RETURN \n", "POST /restoreConfig.jst HTTP");
+    }
+#endif
    fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", "multipart/form-data");
    FIREWALL_DEBUG("Exiting do_webui_attack_filter\n");
 }
@@ -12133,6 +12208,10 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE *
 #endif
 
    fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan");
+   fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan_tcp");
+   fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan_udp");
+   fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan_icmp");
+
    fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_tolan");
    fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_plugins");
    fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_ephemeral");
diff --git a/source/scripts/init/c_registration/Makefile.am b/source/scripts/init/c_registration/Makefile.am
index a39bee3a..d432e4b0 100644
--- a/source/scripts/init/c_registration/Makefile.am
+++ b/source/scripts/init/c_registration/Makefile.am
@@ -49,8 +49,6 @@ bin_PROGRAMS = \
     03_connectcheck \
     09_xdns \
     10_firewall \
-    10_mcastproxy \
-    10_mldproxy \
     10_ntpd \
     15_ccsphs \
     15_ddnsclient \
@@ -69,6 +67,10 @@ if FEATURE_RDKB_EXTENDER
 bin_PROGRAMS += 02_devicemode
 endif
 
+if ENABLE_MCAST_SERVICE
+bin_PROGRAMS += 10_mcastproxy 10_mldproxy
+endif
+
 if ENABLE_POTD_SERVICE
 bin_PROGRAMS += 26_potd
 endif
@@ -98,9 +100,6 @@ endif
 10_bootstrap_dns_SOURCES = 10_bootstrap_dns.c
 10_firewall_SOURCES = 10_firewall.c
 10_fpm_SOURCES = 10_fpm.c
-10_mcastproxy_SOURCES = 10_mcastproxy.c
-10_mcastsnooper_SOURCES = 10_mcastsnooper.c
-10_mldproxy_SOURCES = 10_mldproxy.c
 10_ntpclient_SOURCES = 10_ntpclient.c
 10_ntpd_SOURCES = 10_ntpd.c
 10_sysevent_proxy_SOURCES = 10_sysevent_proxy.c
@@ -130,6 +129,11 @@ endif
 if FEATURE_RDKB_EXTENDER
 02_devicemode_SOURCES = 02_devicemode.c
 endif
+if ENABLE_MCAST_SERVICE
+10_mcastproxy_SOURCES = 10_mcastproxy.c
+10_mcastsnooper_SOURCES = 10_mcastsnooper.c
+10_mldproxy_SOURCES = 10_mldproxy.c
+endif
 if ENABLE_POTD_SERVICE
 26_potd_SOURCES = 26_potd.c
 endif
diff --git a/source/scripts/init/service.d/service_misc.sh b/source/scripts/init/service.d/service_misc.sh
index 70383c71..bea1fd0d 100755
--- a/source/scripts/init/service.d/service_misc.sh
+++ b/source/scripts/init/service.d/service_misc.sh
@@ -75,11 +75,11 @@ if [ "$RG_MD" = "1" -o "$RG_MD" = "3" ]; then
 	/etc/utopia/service.d/service_igd.sh lan-status&
 fi
 
-if [ "$RG_MD" = "1" -o "$RG_MD" = "3" ]; then
+if [[ "$RG_MD" = "1" -o "$RG_MD" = "3" ]] && [ -f /etc/utopia/service.d/service_mcastproxy.sh ]; then
 	/etc/utopia/service.d/service_mcastproxy.sh lan-status&
 fi
 
-if [ "$RG_MD" = "2" -o "$RG_MD" = "3" ]; then
+if [[ "$RG_MD" = "2" -o "$RG_MD" = "3" ]] && [ -f /etc/utopia/service.d/service_mldproxy.sh ]; then
 	/etc/utopia/service.d/service_mldproxy.sh lan-status&
 fi