I have followed the guides to set up DDNS, I expected router's local IP to be synced to afraid.org, and I'd follow the forums to bypass the NAT and get outside IP on there, but so far it's not even communicating with afraid.org. It can correctly lookup the IP address from afraid.org, it just won't update.
Is this NAT related? I'd have expected it to at least send the IP it has behind the NAT. I have tried all 3 afraid configurations and username, hostname and password are all correct.
That will be rejected by the ddns server. The IP on your WAN interface must be the public one that is reported by IP check sites or it won't be possible to take incoming connections.
What you can do now for academical purposes is navigate to DDNS Advanced Settings and change "IP address source" from Interface to URL. That way your DDNS client will first detect the external CGNAT address and then use it in the update sent to DDNS provider.
If that fails, enable logging in the client configuration and post the relevant fragment of the log here.
For a quick test you can simply run curl or wget from the router shell as shown in DDNS provider sample scripts.
Manual wget and curl are good for testing, for everyday use you should use a DDNS client which in turn uses wget under the hood. To secure your connection and your token you must use https