NAT/PAT Zephyr stack + CYW43439 WiFi Offload Filters Unsolicited UDP/TCP Packets

[jp-pacotte]

Hardware: Alif E7 DK board with Murata 1YN module (CYW43439)

Software: Zephyr RTOS with AIROC WiFi driver (WHD)

Configuration:

Zephyr 4.1 ( fork alif )

CONFIG_WIFI_OFFLOAD=y
CONFIG_NET_OFFLOAD=y
CONFIG_WIFI_AIROC=y
CONFIG_CYW43439=y
Problem Description
We are implementing a NAT/PAT router with:

LAN side: Ethernet interface (169.254.x.x)
WAN side: WiFi interface via CYW43439
Observed behavior:

Outbound packets (LAN → WAN) work correctly - we can see them forwarded via WiFi
ICMP ping responses (WAN → LAN) work correctly
UDP/TCP responses (WAN → LAN) never arrive at the host
Investigation Results
NAT translation is correct - Source IP/port are properly translated, checksums recalculated
ICMP works - Ping replies return successfully through the same NAT path
UDP never returns - DNS responses (UDP port 53) are never received by the host
Packet filters don't help - Tried whd_pf_add_packet_filter() with UDP pattern matching - filter is accepted but doesn't change behavior
Promiscuous/Monitor mode don't help - Tried WLC_SET_PROMISC and WLC_SET_MONITOR IOCTLs - no effect
Root Cause Analysis
The CYW43439 firmware appears to filter incoming UDP/TCP packets that don't match an open socket on the host. This filtering happens inside the firmware before packets reach whd_network_process_ethernet_data().

The only way to receive UDP/TCP packets is to have an active socket bound to the corresponding port on the host - which defeats the purpose of NAT routing.

Question for Infineon/zephyr :
Is there a way to disable this internal UDP/TCP filtering in the CYW43439 firmware?
Is there an IOCTL, IOVAR, or configuration option to receive all IP packets regardless of socket state?
Is there a firmware variant that supports true L2/L3 bridging or routing use cases?

Workaround:
Currently, the only working solution is to implement application-layer proxies (DNS proxy, TCP relay) that open sockets on the host, which the firmware recognizes and passes traffic to. This is not ideal for a general-purpose NAT router.

Implementation code : https://github.com/pa-cotte/alif-sample-app/tree/wifi-1YN

[jp-pacotte]

@gavinliu-infineon @teburd

[teburd]

I'm working on getting this answered still.

[gavinliu-infineon]

@jp-pacotte,
Maybe you can try this API to disable packet filter.
https://github.com/zephyrproject-rtos/hal_infineon/blob/master/whd-expansion/WHD/COMPONENT_WIFI6/src/whd_wifi_api.c#L5593

[jp-pacotte]

I have already tried this API, but it did not resolve the packet drop issue on reception, since no socket is created.

Are the filtering APIs specifically intended to address my packet drop issue?

[jp-pacotte]

Update: Resolved

I managed to get full NAT/PAT working (ICMP, UDP/DNS, TCP/HTTP/HTTPS, concurrent connections) on the Alif E7 DK + CYW43439.

The issues turned out to be:

Bugs in my AIROC WiFi driver usage — the scan callback had null pointer dereferences, and I was using whd_wifi_join() instead of whd_wifi_join_specific() which caused unreliable connections. Also needed to pass the target SSID to whd_wifi_scan() for directed scanning.
Migration to WHD v4.2.1 (new hal_infineon) — the whd_wifi_check_join_status() function doesn't handle the JOIN_NO_NETWORKS | JOIN_SECURITY_COMPLETE bitmask combination, causing spurious WHD_INVALID_JOIN_STATUS errors.
Buffer sizing — CONFIG_NET_BUF_DATA_SIZE at default 128 bytes meant 13 fragments per WiFi packet (WHD_LINK_MTU=1544). NAT cloning doubles that, exhausting buffers under load. Setting it to 1600 fixed HTTPS and concurrent connections.
The firmware filtering I described in the original post was not actually the root cause — with promiscuous mode enabled (WLC_SET_PROMISC=1), all packets are delivered to the host correctly.

code : https://github.com/pa-cotte/alif-sample-app/tree/network-routing