Regarding the use of Upnp and QoS

Installing and Using OpenWrt
1

Hello everyone, big boss,
Firmware version: 23.05.6 (due to device limitations, this version can only be used)
Upnp version: miniupnpd nftables (2.3.3-2)
QoS version: NFT QoS (1.0.6-4)
We are currently facing a problem

  1. After Upnp is turned on, it cannot work properly and requires the use of Stun to function properly
  2. Unable to restrict uplink speed for multiple IP/MAC through QoS after enabling Upnp
    Are there any special settings for requesting help from experts?
    The software and hardware traffic uninstallation in the firewall have been turned off
    My current network top is:
    Optical modem - Hard Router - DMZ (openwrt) - Device
    The hard router has obtained a public IP address
    屏幕截图(8)
    屏幕截图(8)1920×1080 148 KB

    屏幕截图(7)
    屏幕截图(7)1920×1080 157 KB

    屏幕截图(6)
    屏幕截图(6)1920×1080 145 KB
2

It would be good to start with your configuration.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Screenshot 2025-10-20 at 8.14.14 PM

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
3 
ubus call system board
{
        "kernel": "5.15.189",
        "hostname": "OpenWrt",
        "system": "Intel(R) Atom(TM) CPU D2550   @ 1.86GHz",
        "rootfs_type": "ext4",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.6",
                "revision": "r24232-539228933c",
                "target": "x86/64",
                "description": "OpenWrt 23.05.6 r24232-539228933c"
        }
}

cat /etc/config/network
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd42:db0f:aaec::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'eth0'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'


cat /etc/config/wireless
cat: can't open '/etc/config/wireless': No such file or directory

 cat /etc/config/dhcp
config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

cat /etc/config/firewall
config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option drop_invalid '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'print1'
        option src 'wan'
        option src_dport '7991'
        option dest_ip '192.168.10.237'
        option dest_port '7899'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'prin2'
        option src 'wan'
        option src_dport '7992'
        option dest_ip '192.168.10.185'
        option dest_port '7899'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'print3'
        option src 'wan'
        option src_dport '7993'
        option dest_ip '192.168.10.172'
        option dest_port '7899'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'print4'
        option src 'wan'
        option src_dport '7994'
        option dest_ip '192.168.10.117'
        option dest_port '7899'

config forwarding
        option src 'wan'
        option dest 'lan'
4

I do t understand why you say that

x86/64 is not constrained. You can run 25.12. And you should since 23.05 is eol and unsupported.

5

Due to the high concurrency of the following devices, there was a false crash when using the latest version before, and the backend was able to access, but unable to access the internet

6

I hope that this router is not directly connected to the internet as you allow all traffic from wan to come in

7

Is this a setup error? How do I need to modify it?

8

Probably

If this is a long standing issue then chances are your router and network are infected already.

My advice upgrade to 25.12.4 without keeping settings and afterwards scan your network/PC's for virus and malware

9

My device originally needed to be connected to the internet and also required port forwarding, so my setting is fine
What we need to solve now is the problem of UPNP failing without opening Stun and QoS speed limit failure after opening UPNP