diff --git a/package/lean/shortcut-fe/src/fast-classifier.c b/package/lean/shortcut-fe/src/fast-classifier.c
index 48a2d27f4..6fba3a9f5 100644
--- a/package/lean/shortcut-fe/src/fast-classifier.c
+++ b/package/lean/shortcut-fe/src/fast-classifier.c
@@ -181,7 +181,7 @@ static atomic_t done_fail_msgs = ATOMIC_INIT(0);
  * 	only implement ingress for now, because for egress we
  * 	want to have the bridge devices qdiscs be used.
  */
-static bool skip_to_bridge_ingress;
+static bool skip_to_bridge_ingress = 1;
 
 /*
  * fast_classifier_incr_exceptions()
@@ -310,8 +310,15 @@ rx_exit:
  * We look up the rtable entry for the address and, from its neighbour
  * structure, obtain the hardware address.  This means this function also
  * works if the neighbours are routers too.
+ *
+ * 21/10/17, quarkysg
+ * - modified method signature to accept dst_entry from caller.  It will be used in place of existing method logic to lookup
+ *   destination routes, which fails when packets are policy routed.
+ *
+ * 22/12/17, quarkysg
+ * - changed method signature to accept sk_buff * instead, to make it more efficient.
  */
-static bool fast_classifier_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct net_device **dev, u8 *mac_addr, bool is_v4)
+static bool fast_classifier_find_dev_and_mac_addr(struct sk_buff *skb, sfe_ip_addr_t *addr, struct net_device **dev, u8 *mac_addr, bool is_v4)
 {
 	struct neighbour *neigh;
 	struct rtable *rt;
@@ -319,6 +326,17 @@ static bool fast_classifier_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct ne
 	struct dst_entry *dst;
 	struct net_device *mac_dev;
 
+	/*
+	 * If we have skb provided, use it as the original code is unable
+	 * to lookup routes that are policy routed.
+	 *
+	 * quarkysg, 22/12/17
+	 */
+	if (unlikely(skb)) {
+		dst = skb_dst(skb);
+		goto skip_dst_lookup;
+	}
+
 	/*
 	 * Look up the rtable entry for the IP address then get the hardware
 	 * address from its neighbour structure.  This means this works when the
@@ -340,18 +358,25 @@ static bool fast_classifier_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct ne
 		dst = (struct dst_entry *)rt6;
 	}
 
+skip_dst_lookup:	// quarkysg, 21/10/17
 	rcu_read_lock();
 	neigh = dst_neigh_lookup(dst, addr);
 	if (unlikely(!neigh)) {
 		rcu_read_unlock();
-		dst_release(dst);
+		// only release dst_entry found in this method, quarkysg, 21/10/17
+		if (likely(!skb)) {
+			dst_release(dst);
+		}
 		goto ret_fail;
 	}
 
 	if (unlikely(!(neigh->nud_state & NUD_VALID))) {
 		rcu_read_unlock();
 		neigh_release(neigh);
-		dst_release(dst);
+		// only release dst_entry found in this method, quarkysg, 21/10/17
+		if (likely(!skb)) {
+			dst_release(dst);
+		}
 		goto ret_fail;
 	}
 
@@ -359,7 +384,10 @@ static bool fast_classifier_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct ne
 	if (!mac_dev) {
 		rcu_read_unlock();
 		neigh_release(neigh);
-		dst_release(dst);
+		// only release dst_entry found in this method, quarkysg, 21/10/17
+		if (likely(!skb)) {
+			dst_release(dst);
+		}
 		goto ret_fail;
 	}
 
@@ -369,7 +397,10 @@ static bool fast_classifier_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct ne
 	*dev = mac_dev;
 	rcu_read_unlock();
 	neigh_release(neigh);
-	dst_release(dst);
+	// only release dst_entry found in this method, quarkysg, 21/10/17
+	if (likely(!skb)) {
+		dst_release(dst);
+	}
 
 	return true;
 
@@ -730,7 +761,7 @@ static int fast_classifier_nl_genl_msg_DUMP(struct sk_buff *skb,
 }
 
 /* auto offload connection once we have this many packets*/
-static int offload_at_pkts = 128;
+static int offload_at_pkts = 16;
 
 /*
  * fast_classifier_post_routing()
@@ -1018,26 +1049,27 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 	 * Get the net device and MAC addresses that correspond to the various source and
 	 * destination host addresses.
 	 */
-	if (!fast_classifier_find_dev_and_mac_addr(&sic.src_ip, &src_dev, sic.src_mac, is_v4)) {
+	if (!fast_classifier_find_dev_and_mac_addr(NULL, &sic.src_ip, &src_dev, sic.src_mac, is_v4)) {
 		fast_classifier_incr_exceptions(FAST_CL_EXCEPTION_NO_SRC_DEV);
 		return NF_ACCEPT;
 	}
 
-	if (!fast_classifier_find_dev_and_mac_addr(&sic.src_ip_xlate, &dev, sic.src_mac_xlate, is_v4)) {
+	if (!fast_classifier_find_dev_and_mac_addr(NULL, &sic.src_ip_xlate, &dev, sic.src_mac_xlate, is_v4)) {
 		fast_classifier_incr_exceptions(FAST_CL_EXCEPTION_NO_SRC_XLATE_DEV);
 		goto done1;
 	}
 
 	dev_put(dev);
 
-	if (!fast_classifier_find_dev_and_mac_addr(&sic.dest_ip, &dev, sic.dest_mac, is_v4)) {
+	if (!fast_classifier_find_dev_and_mac_addr(NULL, &sic.dest_ip, &dev, sic.dest_mac, is_v4)) {
 		fast_classifier_incr_exceptions(FAST_CL_EXCEPTION_NO_DEST_DEV);
 		goto done1;
 	}
 
 	dev_put(dev);
 
-	if (!fast_classifier_find_dev_and_mac_addr(&sic.dest_ip_xlate, &dest_dev, sic.dest_mac_xlate, is_v4)) {
+	// we pass in sk_buff(skb) to enable acceleration of policy routed packets, quarkysg, 22/12/17
+	if (!fast_classifier_find_dev_and_mac_addr(skb, &sic.dest_ip_xlate, &dest_dev, sic.dest_mac_xlate, is_v4)) {
 		fast_classifier_incr_exceptions(FAST_CL_EXCEPTION_NO_DEST_XLATE_DEV);
 		goto done1;
 	}
@@ -1690,7 +1722,7 @@ static int __init fast_classifier_init(void)
 	int result = -1;
 	size_t i, j;
 
-	printk(KERN_ALERT "fast-classifier: starting up\n");
+	printk(KERN_ALERT "fast-classifier (PBR safe v2.1b): starting up\n");
 	DEBUG_INFO("SFE CM init\n");
 
 	hash_init(fc_conn_ht);
@@ -1781,7 +1813,7 @@ static int __init fast_classifier_init(void)
 	}
 #endif
 
-	printk(KERN_ALERT "fast-classifier: registered\n");
+	printk(KERN_ALERT "fast-classifier (PBR safe v2.1b): registered\n");
 
 	spin_lock_init(&sc->lock);
 
@@ -1835,7 +1867,7 @@ static void __exit fast_classifier_exit(void)
 	int result = -1;
 
 	DEBUG_INFO("SFE CM exit\n");
-	printk(KERN_ALERT "fast-classifier: shutting down\n");
+	printk(KERN_ALERT "fast-classifier (PBR safe v2.1b): shutting down\n");
 
 	/*
 	 * Unregister our sync callback.