UPNP doesn't work

[Whistrock]

Hi. I've installed OpenWRT (Version 23.05.3) for the first time today. I've got network and WIFI sorted out (using PPPoE, if necessary) but for the life of me I can't seem to get uPnP to work.

I have TP-Link Archer AX23 and while I've had my factory firmware, Nicotine+ (Soulseek client. Peer to Peer file sharing software with uPnP support) used to connect fine.

I am behind CGNAT (Dynamic IP) and Port Forwarding is not an option so I rely on uPnP. Before people used to be able to download from me through uPnP but now no one can.

Nicotine shows [ UPnP: Failed to forward external port 1337: Error code 501: ActionFailed ]

logread shows [ daemon.err miniupnpd[15827]: Failed to add NAT-PMP 1337 tcp->192.168.1.146:1337 'NAT-PMP 1337 tcp' ]

Nicotine also doesn't appear on the "Active UPnP Redirects". It's empty. It used to show up and connect on factory firmware.

Tried this trick. Also contains STUN configuration for Dynamic IP's. It didn't work.

Solution to upnp not working

People who are trying to use Upnp module but ended up not working well there are two workarounds. First method is by adding line external_ip 'your_ip_address' in upnpd file. Well the only caveat is that after few days your IP address changes. So every time you'll have to replace current IP with the new one. In second method we use STUN tool built in upnpd module. You can find that option under services > UpnP > Advanced settings > Use STUN I've had tried "stun.stunprotocol.org" host with "34…

I've also messed with config files from what I could piece together online but there is no change.

Following configs are a copy of what is written right now:

/etc/config/upnpd

config upnpd 'config'
        option download '1024'
        option upload '512'
        option internal_iface 'lan'
        option port '5000'
        option upnp_lease_file '/var/run/miniupnpd.leases'
        option enabled '1'
        option uuid 'e623712f-e5b4-479c-896a-87d08fa8db76'
        option use_stun '1'
        option stun_host 'stun.l.google.com'
        option stun_port '19302'
        option igdv1 '1'

config perm_rule
        option action 'allow'
        option ext_ports '1024-65535'
        option int_addr '0.0.0.0/0'
        option int_ports '1024-65535'
        option comment 'Allow high ports'

config perm_rule
        option action 'deny'
        option ext_ports '0-65535'
        option int_addr '0.0.0.0/0'
        option int_ports '0-65535'
        option comment 'Default deny'

/etc/config/miniupnpd

config upnpd config
        option enable_natpmp  1
        option secure_mode    1
        option log_output     0
        option download       1024
        option upload         512
        option external_iface wan
        option internal_iface lan

config perm_rule
        option action    deny
        option ext_ports 0-65535
        option int_addr  0.0.0.0/0
        option int_ports 0:65535

Also tried changing option int_addr '0.0.0.0/0' to '192.128.0.0/24' and '192.168.1.146/24' (my pc's ipv4). Neither helped.

I don't know what logs are stored where. If you need more logs or configs etc. please tell me their directory beforehand (like /etc/config/miniupnpd) and I will send it to you.

I am also quite clueless when it comes to OpenWRT or doing "advanced" router setup so please be patient with me.

Regards.

[trendy]

Miniupnpd will surely fail as there is only one rule which denies everything.
Just open on the firewall a port redirect for port 1337 and leave upnp and its security issues alone.
https://openwrt.org/docs/guide-user/firewall/upnp/start

[Arie]

First step would be to ask your ISP for a non-CGNAT aka a real internet connection.

I don't have a /etc/config/miniupnpd on my router, just /etc/config/upnpd, so maybe you created that file. If that's loaded instead, it would block all rules from being created like @trendy says.
Enable additional logging for upnp to get more details on why upnp is failing/refusing to add the rule requested by Nicotine. I'm assuming it's unable to learn the external ip address of your WAN interface, despite configuring STUN.

[Whistrock]

A static IP is paid. And before OpenWRT Nicotine used to work, so, i'd like to see if I can get this to work again. FYI my public and private IP's are different, IP changes after every restart and geolocation shows the ISP's central so that should confirm I am behind CGNAT.

Anyway. I've removed the miniupnpd config just now. I did create it myself before after reading the miniupnpd wiki page. It doesn't tell if it reads from upnpd file or has it's own miniupnpd file so I've done the latter. Though after removal and a reboot nothing has changed.

I've also enabled additional logging just now. If you know where the logs are located please tell. I don't know where they are or how to access them. I did try reading wiki about logging ( https://openwrt.org/docs/guide-user/base-system/log.essentials ) but I've couldn't make sense of it. I'm probably searching the wrong place for it.

Just open on the firewall a port redirect for port 1337 and leave upnp and its security issues alone.

Port forwarding is not an option on this network since it's behind CGNAT.

Regards. Thank you for your time.

[trendy]

@Whistrock

Port forwarding is not an option on this network since it's behind CGNAT.

Just to make it clear, the role of upnp is to learn from the servers running in the lan which ports to open on the firewall of the OpenWrt router. It won't open ports on the ISP CGNAT.

[Whistrock]

True but Nicotine somehow could connect through uPnP before OpenWRT. Port forwarding didn't work before and doesn't work now since I'm behind CGNAT. So It's a mystery to me how this works.

Here are my settings. I've also did static lease for my PC's IPv4. When I check the port I get [ IP: 176.42.xx.xx Port: 1337/tcp CLOSED ].
Before OpenWRT I would get the same result with uPnP "on" and "working" (Nico and TP-Link ui said so) but people could download from me just fine.
Maybe Nicotine connecting to uPnP never actually did anything this entire time and people could still download from me without a port. But that should be impossible since it's peer to peer, or so I thought. Maybe I'm somehow not behind CGNAT (even though I'm certain) and port forwarding works but I can't set up one properly.

As I was looking for a solution for this long ago I've shelved this mystery when I saw it could do uPnP and people could download from me anyway. But now It came back from it's grave. Since OpenWrt no one downloaded anything from me yet. Not that I get downloads often but I am watching. I've just assumed no one could download from me since uPnP gives error 501 now. Despite all of this though I always could download at any time out of the box. Makes me wonder if Slsk is somehow not so PtP.

Any way to figure out what's going on?

Regards.

[Whistrock]

I've just read this in Soulseek subreddit

Those with open ports can see and be seen by everybody
Those with closed ports can only see and be seen by those with open ports

So to really clarify uPnP is as useless as port forwarding if I am behind CGNAT. And I believe I am behind CGNAT because of the following observations:

my public and private IP's are different, IP changes after every restart and geolocation shows the ISP's central

And that would mean this entire time the uPnP was a lie and those who could download from me could download because they've had open port, not everyone could download from me.

As I was looking to fix OpenWRT's uPnP I've read somewhere that uPnP failing is just not OpenWRT's fault and Error code 501: ActionFailed is just CGNAT related and not a configuration issue. Though if that's the case it's unknown to me why TP-Link could pick up Nicotine just fine. Maybe it only picked it up but never connected to anything but it didn't tell me about it because of it's limited web interface.

Regards.

[Arie]

Yeah p2p will still work on CGNAT if the other side has their port forwarding figured out or the app supports STUN/TURN.

To view the miniupnpd log:

Open 2 terminals to your OpenWRT router.

In the first, enter logread -f.
In the second, enter /etc/init.d/miniupnpd restart

Why the restart? Either on startup of miniupnpd or on the attempted creation of the upnp rule, I'm expecting there to be a message informing you of why it's not possible.

[timur.davletshin]

@Arie

In the first, enter logread -f.
In the second, enter /etc/init.d/miniupnpd restart

killall miniupnd && /usr/sbin/miniupnpd -d -f /var/etc/miniupnpd.conf by default it gives nothing in logread

[timur.davletshin]

Need Help with UPnP on Tp-Link Archer C6 V3 GCNAT - very similar question.

[Whistrock]

In the first, enter logread -f.
In the second, enter /etc/init.d/miniupnpd restart

root@OpenWrt:~# logread -f
Thu Jul 18 19:50:25 2024 authpriv.info dropbear[5917]: Child connection from 192.168.1.146:55192
Thu Jul 18 19:50:36 2024 authpriv.notice dropbear[5917]: Password auth succeeded for 'root' from 192.168.1.146:55192
Thu Jul 18 19:50:46 2024 daemon.info miniupnpd[5980]: system uptime is 34976 seconds
Thu Jul 18 19:50:46 2024 daemon.info miniupnpd[5980]: mnl_socket bound, port_id=5980
Thu Jul 18 19:50:46 2024 daemon.info miniupnpd[5980]: Reloading rules from lease file
Thu Jul 18 19:50:46 2024 daemon.info miniupnpd[5980]: version 2.3.3 starting NAT-PMP/PCP UPnP-IGD ext if pppoe-wan BOOTID=1721321446
Thu Jul 18 19:50:46 2024 daemon.info miniupnpd[5980]: specific IPv6 ext if
Thu Jul 18 19:50:46 2024 daemon.info miniupnpd[5980]: STUN: Performing with host=stun.l.google.com and port=19302 ...
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: resolve_stun_host: stun.l.google.com:19302 => 74.125.250.129:19302
Thu Jul 18 19:50:46 2024 daemon.info miniupnpd[5980]: perform_stun: local ports 39056 49273 55228 55806
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: wait_for_stun_responses: waiting 3 secs and 0 usecs
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: wait_for_stun_responses: received responses: 1
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: wait_for_stun_responses: waiting 3 secs and 0 usecs
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: wait_for_stun_responses: received responses: 3
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: wait_for_stun_responses: waiting 3 secs and 0 usecs
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: wait_for_stun_responses: received responses: 4
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: table_cb(0x7f7ba5d8, 0x7f7bb608) fw4 upnp_forward 2
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: table_cb(0x7f7ba7cc, 0x7f7bb608) fw4 upnp_forward 2
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: table_cb(0x7f7ba9cc, 0x7f7bb608) fw4 upnp_forward 2
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: table_cb(0x7f7babcc, 0x7f7bb608) fw4 upnp_forward 2
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: table_cb(0x7f7ba5d8, 0x7f7bb608) fw4 upnp_forward 2
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: table_cb(0x7f7ba7cc, 0x7f7bb608) fw4 upnp_forward 2
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: table_cb(0x7f7ba9cc, 0x7f7bb608) fw4 upnp_forward 2
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: table_cb(0x7f7ba5d8, 0x7f7bb608) fw4 upnp_forward 2
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: table_cb(0x7f7ba7cc, 0x7f7bb608) fw4 upnp_forward 2
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: table_cb(0x7f7ba5d8, 0x7f7bb608) fw4 upnp_forward 2
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: parse_stun_response: Type 0x0101, Length 12, Magic Cookie 2112a442
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: parse_stun_response: XOR-MAPPED-ADDRESS 176.42.31.38:5476
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: parse_stun_response: Type 0x0101, Length 12, Magic Cookie 2112a442
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: parse_stun_response: XOR-MAPPED-ADDRESS 176.42.31.38:5297
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: parse_stun_response: Type 0x0101, Length 12, Magic Cookie 2112a442
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: parse_stun_response: XOR-MAPPED-ADDRESS 176.42.31.38:5778
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: parse_stun_response: Type 0x0101, Length 12, Magic Cookie 2112a442
Thu Jul 18 19:50:46 2024 daemon.debug miniupnpd[5980]: parse_stun_response: XOR-MAPPED-ADDRESS 176.42.31.38:6080
Thu Jul 18 19:50:46 2024 daemon.notice miniupnpd[5980]: perform_stun: #0 external address or port changed
Thu Jul 18 19:50:46 2024 daemon.notice miniupnpd[5980]: perform_stun: #1 external address or port changed
Thu Jul 18 19:50:46 2024 daemon.notice miniupnpd[5980]: perform_stun: #2 external address or port changed
Thu Jul 18 19:50:46 2024 daemon.notice miniupnpd[5980]: perform_stun: #3 external address or port changed
Thu Jul 18 19:50:46 2024 daemon.warn miniupnpd[5980]: STUN: ext interface pppoe-wan with private IP address 10.72.22.242 is now behind restrictive or symmetric NAT with public IP address 176.42.31.38 which does not support port forwarding
Thu Jul 18 19:50:46 2024 daemon.warn miniupnpd[5980]: NAT on upstream router blocks incoming connections set by miniupnpd
Thu Jul 18 19:50:46 2024 daemon.warn miniupnpd[5980]: Turn off NAT on upstream router or change it to full-cone NAT 1:1 type
Thu Jul 18 19:50:46 2024 daemon.warn miniupnpd[5980]: Port forwarding is now disabled
Thu Jul 18 19:50:46 2024 daemon.notice miniupnpd[5980]: HTTP listening on port 5000
Thu Jul 18 19:50:46 2024 daemon.notice miniupnpd[5980]: HTTP IPv6 address given to control points : [fde0:58fa:33e4::1]
Thu Jul 18 19:50:46 2024 daemon.notice miniupnpd[5980]: Listening for NAT-PMP/PCP traffic on port 5351

Why the restart? Either on startup of miniupnpd or on the attempted creation of the upnp rule, I'm expecting there to be a message informing you of why it's not possible.

I've done it to "ensure" changes are applied. I'm quite clueless with it, haha.

killall miniupnd && /usr/sbin/miniupnpd -d -f /var/etc/miniupnpd.conf

root@OpenWrt:~# killall miniupnpd && /usr/sbin/miniupnpd -d -f /var/etc/miniupnp
d.conf
miniupnpd[5904]: system uptime is 34625 seconds
miniupnpd[5904]: mnl_socket bound, port_id=5904
miniupnpd[5904]: Reloading rules from lease file
miniupnpd[5904]: could not open lease file: /var/run/miniupnpd.leases
miniupnpd[5904]: version 2.3.3 starting NAT-PMP/PCP UPnP-IGD ext if pppoe-wan BOOTID=1721321096
miniupnpd[5904]: specific IPv6 ext if 
miniupnpd[5904]: STUN: Performing with host=stun.l.google.com and port=19302 ...
miniupnpd[5904]: resolve_stun_host: stun.l.google.com:19302 => 74.125.250.129:19302
miniupnpd[5904]: perform_stun: local ports 41348 41722 42988 43596
miniupnpd[5904]: wait_for_stun_responses: waiting 3 secs and 0 usecs
miniupnpd[5904]: wait_for_stun_responses: received responses: 1
miniupnpd[5904]: wait_for_stun_responses: waiting 3 secs and 0 usecs
miniupnpd[5904]: wait_for_stun_responses: received responses: 3
miniupnpd[5904]: wait_for_stun_responses: waiting 3 secs and 0 usecs
miniupnpd[5904]: wait_for_stun_responses: received responses: 4
miniupnpd[5904]: table_cb(0x7fb968f8, 0x7fb97928) fw4 upnp_forward 2
miniupnpd[5904]: table_cb(0x7fb96aec, 0x7fb97928) fw4 upnp_forward 2
miniupnpd[5904]: table_cb(0x7fb96cec, 0x7fb97928) fw4 upnp_forward 2
miniupnpd[5904]: table_cb(0x7fb96eec, 0x7fb97928) fw4 upnp_forward 2
miniupnpd[5904]: table_cb(0x7fb968f8, 0x7fb97928) fw4 upnp_forward 2
miniupnpd[5904]: table_cb(0x7fb96aec, 0x7fb97928) fw4 upnp_forward 2
miniupnpd[5904]: table_cb(0x7fb96cec, 0x7fb97928) fw4 upnp_forward 2
miniupnpd[5904]: table_cb(0x7fb968f8, 0x7fb97928) fw4 upnp_forward 2
miniupnpd[5904]: table_cb(0x7fb96aec, 0x7fb97928) fw4 upnp_forward 2
miniupnpd[5904]: table_cb(0x7fb968f8, 0x7fb97928) fw4 upnp_forward 2
miniupnpd[5904]: parse_stun_response: Type 0x0101, Length 12, Magic Cookie 2112a442
miniupnpd[5904]: parse_stun_response: XOR-MAPPED-ADDRESS 176.42.xx.xx:5330
miniupnpd[5904]: parse_stun_response: Type 0x0101, Length 12, Magic Cookie 2112a442
miniupnpd[5904]: parse_stun_response: XOR-MAPPED-ADDRESS 176.42.xx.xx:5428
miniupnpd[5904]: parse_stun_response: Type 0x0101, Length 12, Magic Cookie 2112a442
miniupnpd[5904]: parse_stun_response: XOR-MAPPED-ADDRESS 176.42.xx.xx:6372
miniupnpd[5904]: parse_stun_response: Type 0x0101, Length 12, Magic Cookie 2112a442
miniupnpd[5904]: parse_stun_response: XOR-MAPPED-ADDRESS 176.42.xx.xx:5462
miniupnpd[5904]: perform_stun: #0 external address or port changed
miniupnpd[5904]: perform_stun: #1 external address or port changed
miniupnpd[5904]: perform_stun: #2 external address or port changed
miniupnpd[5904]: perform_stun: #3 external address or port changed
miniupnpd[5904]: STUN: ext interface pppoe-wan with private IP address 10.72.22.242 is now behind restrictive or symmetric NAT with public IP address 176.42.xx.xx which does not support port forwarding
miniupnpd[5904]: NAT on upstream router blocks incoming connections set by miniupnpd
miniupnpd[5904]: Turn off NAT on upstream router or change it to full-cone NAT 1:1 type
miniupnpd[5904]: Port forwarding is now disabled
miniupnpd[5904]: HTTP listening on port 5000
miniupnpd[5904]: HTTP IPv6 address given to control points : [fde0:58fa:33e4::1]
miniupnpd[5904]: Listening for NAT-PMP/PCP traffic on port 5351

---------here i reconnect nicotine+...--------

miniupnpd[5904]: NAT-PMP request received from 192.168.1.146:42601 12bytes
miniupnpd[5904]: NAT-PMP port mapping request : 1337->192.168.1.146:1337 tcp lifetime=43200s
miniupnpd[5904]: UPnP permission rule 0 matched : port mapping accepted
miniupnpd[5904]: Check protocol tcp for port 1337 on ext_if pppoe-wan 10.72.22.242, F216480A
miniupnpd[5904]: Failed to add NAT-PMP 1337 tcp->192.168.1.146:1337 'NAT-PMP 1337 tcp'
miniupnpd[5904]: level=0 type=8
miniupnpd[5904]: ifindex = 15  192.168.1.1
miniupnpd[5904]: ST: urn:schemas-upnp-org:service:WANIPConnection:1 (ver=1)
miniupnpd[5904]: SSDP M-SEARCH from 192.168.1.146:50276 ST: urn:schemas-upnp-org:service:WANIPConnection:1
miniupnpd[5904]: Single search found
miniupnpd[5904]: SendSSDPResponse(): 0 bytes to 192.168.1.146:50276 ST: HTTP/1.1 200 OK
CACHE-CONTROL: max-age=120
ST: urn:schemas-upnp-org:service:WANIPConnection:1
USN: uuid:e623712f-e5b4-479c-896a-87d08fa8db78::urn:schemas-upnp-org:service:WANIPConnection:1
EXT:
SERVER: OpenWrt/5.15.150 UPnP/1.1 MiniUPnPd/2.3.3
LOCATION: http://192.168.1.1:5000/rootDesc.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 1721321096
BOOTID.UPNP.ORG: 1721321096
CONFIGID.UPNP.ORG: 1337

miniupnpd[5904]: Received UDP Packet (IPv6)
miniupnpd[5904]: ST: urn:schemas-upnp-org:service:WANIPConnection:1 (ver=1)
miniupnpd[5904]: SSDP M-SEARCH from [::ffff:192.168.1.146]:50276 ST: urn:schemas-upnp-org:service:WANIPConnection:1
miniupnpd[5904]: Single search found
miniupnpd[5904]: SendSSDPResponse(): 0 bytes to [::ffff:192.168.1.146]:50276 ST: HTTP/1.1 200 OK
CACHE-CONTROL: max-age=120
ST: urn:schemas-upnp-org:service:WANIPConnection:1
USN: uuid:e623712f-e5b4-479c-896a-87d08fa8db78::urn:schemas-upnp-org:service:WANIPConnection:1
EXT:
SERVER: OpenWrt/5.15.150 UPnP/1.1 MiniUPnPd/2.3.3
LOCATION: http://192.168.1.1:5000/rootDesc.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 1721321096
BOOTID.UPNP.ORG: 1721321096
CONFIGID.UPNP.ORG: 1337

miniupnpd[5904]: level=0 type=8
miniupnpd[5904]: ifindex = 15  192.168.1.1
miniupnpd[5904]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1 (ver=1)
miniupnpd[5904]: SSDP M-SEARCH from 192.168.1.146:50276 ST: urn:schemas-upnp-org:service:WANPPPConnection:1
miniupnpd[5904]: Single search found
miniupnpd[5904]: SendSSDPResponse(): 0 bytes to 192.168.1.146:50276 ST: HTTP/1.1 200 OK
CACHE-CONTROL: max-age=120
ST: urn:schemas-upnp-org:service:WANPPPConnection:1
USN: uuid:e623712f-e5b4-479c-896a-87d08fa8db78::urn:schemas-upnp-org:service:WANPPPConnection:1
EXT:
SERVER: OpenWrt/5.15.150 UPnP/1.1 MiniUPnPd/2.3.3
LOCATION: http://192.168.1.1:5000/rootDesc.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 1721321096
BOOTID.UPNP.ORG: 1721321096
CONFIGID.UPNP.ORG: 1337

miniupnpd[5904]: Received UDP Packet (IPv6)
miniupnpd[5904]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1 (ver=1)
miniupnpd[5904]: SSDP M-SEARCH from [::ffff:192.168.1.146]:50276 ST: urn:schemas-upnp-org:service:WANPPPConnection:1
miniupnpd[5904]: Single search found
miniupnpd[5904]: SendSSDPResponse(): 0 bytes to [::ffff:192.168.1.146]:50276 ST: HTTP/1.1 200 OK
CACHE-CONTROL: max-age=120
ST: urn:schemas-upnp-org:service:WANPPPConnection:1
USN: uuid:e623712f-e5b4-479c-896a-87d08fa8db78::urn:schemas-upnp-org:service:WANPPPConnection:1
EXT:
SERVER: OpenWrt/5.15.150 UPnP/1.1 MiniUPnPd/2.3.3
LOCATION: http://192.168.1.1:5000/rootDesc.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 1721321096
BOOTID.UPNP.ORG: 1721321096
CONFIGID.UPNP.ORG: 1337

miniupnpd[5904]: level=0 type=8
miniupnpd[5904]: ifindex = 15  192.168.1.1
miniupnpd[5904]: ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 (ver=1)
miniupnpd[5904]: SSDP M-SEARCH from 192.168.1.146:50276 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1
miniupnpd[5904]: Single search found
miniupnpd[5904]: SendSSDPResponse(): 0 bytes to 192.168.1.146:50276 ST: HTTP/1.1 200 OK
CACHE-CONTROL: max-age=120
ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1
USN: uuid:e623712f-e5b4-479c-896a-87d08fa8db76::urn:schemas-upnp-org:device:InternetGatewayDevice:1
EXT:
SERVER: OpenWrt/5.15.150 UPnP/1.1 MiniUPnPd/2.3.3
LOCATION: http://192.168.1.1:5000/rootDesc.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 1721321096
BOOTID.UPNP.ORG: 1721321096
CONFIGID.UPNP.ORG: 1337

miniupnpd[5904]: Received UDP Packet (IPv6)
miniupnpd[5904]: ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 (ver=1)
miniupnpd[5904]: SSDP M-SEARCH from [::ffff:192.168.1.146]:50276 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1
miniupnpd[5904]: Single search found
miniupnpd[5904]: SendSSDPResponse(): 0 bytes to [::ffff:192.168.1.146]:50276 ST: HTTP/1.1 200 OK
CACHE-CONTROL: max-age=120
ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1
USN: uuid:e623712f-e5b4-479c-896a-87d08fa8db76::urn:schemas-upnp-org:device:InternetGatewayDevice:1
EXT:
SERVER: OpenWrt/5.15.150 UPnP/1.1 MiniUPnPd/2.3.3
LOCATION: http://192.168.1.1:5000/rootDesc.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 1721321096
BOOTID.UPNP.ORG: 1721321096
CONFIGID.UPNP.ORG: 1337

miniupnpd[5904]: level=0 type=8
miniupnpd[5904]: ifindex = 15  192.168.1.1
miniupnpd[5904]: ST: urn:schemas-upnp-org:service:WANIPConnection:2 (ver=2)
miniupnpd[5904]: SSDP M-SEARCH from 192.168.1.146:50276 ST: urn:schemas-upnp-org:service:WANIPConnection:2
miniupnpd[5904]: Single search found
miniupnpd[5904]: SendSSDPResponse(): 0 bytes to 192.168.1.146:50276 ST: HTTP/1.1 200 OK
CACHE-CONTROL: max-age=120
ST: urn:schemas-upnp-org:service:WANIPConnection:2
USN: uuid:e623712f-e5b4-479c-896a-87d08fa8db78::urn:schemas-upnp-org:service:WANIPConnection:2
EXT:
SERVER: OpenWrt/5.15.150 UPnP/1.1 MiniUPnPd/2.3.3
LOCATION: http://192.168.1.1:5000/rootDesc.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 1721321096
BOOTID.UPNP.ORG: 1721321096
CONFIGID.UPNP.ORG: 1337

miniupnpd[5904]: Received UDP Packet (IPv6)
miniupnpd[5904]: ST: urn:schemas-upnp-org:service:WANIPConnection:2 (ver=2)
miniupnpd[5904]: SSDP M-SEARCH from [::ffff:192.168.1.146]:50276 ST: urn:schemas-upnp-org:service:WANIPConnection:2
miniupnpd[5904]: Single search found
miniupnpd[5904]: SendSSDPResponse(): 0 bytes to [::ffff:192.168.1.146]:50276 ST: HTTP/1.1 200 OK
CACHE-CONTROL: max-age=120
ST: urn:schemas-upnp-org:service:WANIPConnection:2
USN: uuid:e623712f-e5b4-479c-896a-87d08fa8db78::urn:schemas-upnp-org:service:WANIPConnection:2
EXT:
SERVER: OpenWrt/5.15.150 UPnP/1.1 MiniUPnPd/2.3.3
LOCATION: http://192.168.1.1:5000/rootDesc.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 1721321096
BOOTID.UPNP.ORG: 1721321096
CONFIGID.UPNP.ORG: 1337

miniupnpd[5904]: level=0 type=8
miniupnpd[5904]: ifindex = 15  192.168.1.1
miniupnpd[5904]: ST: urn:schemas-upnp-org:device:InternetGatewayDevice:2 (ver=2)
miniupnpd[5904]: SSDP M-SEARCH from 192.168.1.146:50276 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:2
miniupnpd[5904]: Single search found
miniupnpd[5904]: SendSSDPResponse(): 0 bytes to 192.168.1.146:50276 ST: HTTP/1.1 200 OK
CACHE-CONTROL: max-age=120
ST: urn:schemas-upnp-org:device:InternetGatewayDevice:2
USN: uuid:e623712f-e5b4-479c-896a-87d08fa8db76::urn:schemas-upnp-org:device:InternetGatewayDevice:2
EXT:
SERVER: OpenWrt/5.15.150 UPnP/1.1 MiniUPnPd/2.3.3
LOCATION: http://192.168.1.1:5000/rootDesc.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 1721321096
BOOTID.UPNP.ORG: 1721321096
CONFIGID.UPNP.ORG: 1337

miniupnpd[5904]: Received UDP Packet (IPv6)
miniupnpd[5904]: ST: urn:schemas-upnp-org:device:InternetGatewayDevice:2 (ver=2)
miniupnpd[5904]: SSDP M-SEARCH from [::ffff:192.168.1.146]:50276 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:2
miniupnpd[5904]: Single search found
miniupnpd[5904]: SendSSDPResponse(): 0 bytes to [::ffff:192.168.1.146]:50276 ST: HTTP/1.1 200 OK
CACHE-CONTROL: max-age=120
ST: urn:schemas-upnp-org:device:InternetGatewayDevice:2
USN: uuid:e623712f-e5b4-479c-896a-87d08fa8db76::urn:schemas-upnp-org:device:InternetGatewayDevice:2
EXT:
SERVER: OpenWrt/5.15.150 UPnP/1.1 MiniUPnPd/2.3.3
LOCATION: http://192.168.1.1:5000/rootDesc.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 1721321096
BOOTID.UPNP.ORG: 1721321096
CONFIGID.UPNP.ORG: 1337

miniupnpd[5904]: HTTP REQUEST from [::ffff:192.168.1.146]:39028 : GET /rootDesc.xml (HTTP/1.1)
miniupnpd[5904]: Host: 192.168.1.1:5000
miniupnpd[5904]: HTTP REQUEST from [::ffff:192.168.1.146]:39032 : POST /ctl/IPConn (HTTP/1.1)
miniupnpd[5904]: Host: 192.168.1.1:5000
miniupnpd[5904]: SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping
miniupnpd[5904]: AddPortMapping: ext port 1337 to 192.168.1.146:1337 protocol TCP for: NicotinePlus leaseduration=43200 rhost=
miniupnpd[5904]: UPnP permission rule 0 matched : port mapping accepted
miniupnpd[5904]: Check protocol tcp for port 1337 on ext_if pppoe-wan 10.72.22.242, F216480A
miniupnpd[5904]: redirecting port 1337 to 192.168.1.146:1337 protocol TCP for: NicotinePlus
miniupnpd[5904]: Returning UPnPError 501: ActionFailed

Not sure what goes wrong myself. I'll read deeper into it later.

Regards.

[trendy]

@Whistrock

miniupnpd[5904]: STUN: ext interface pppoe-wan with private IP address 10.72.22.242 is now behind restrictive or symmetric NAT with public IP address 176.42.xx.xx which does not support port forwarding

It's quite clear

[Whistrock]

Oh. I've overlooked that. I've also just had someone download something from me too. So I guess this is finally demystified. This is how I learn I guess, haha.

Thank you all for your time and attention. I greatly appreciate it. I will mark this as solved now, as there is nothing more to do.

[Whistrock]

Still strange of TP-Link to pick up Nicotine without issues unlike OpenWRT. That combined with it being P2P made me overlook the small detail that users with open ports can share and more importantly download from everyone else and made me believe uPnP did some magic trick that somehow made it work. I think I will chalk it up to firmware. Silly of me to not search deeper into it but I'm happy I've learned what's been going on here.

[trendy]

What most likely happened is that the TP-Link firmware just processed the upnp packet regardless of the upstream situation, giving you the false idea that it actually did ask for port forwarding from the ISP CGNAT router, which is very unlikely to be supported or allowed.

[nicefile]

On some ISP You can use mini-upnpd "pcp-peer" (not compiled by default) configuration.
This way LAN client can negotiate with ISP to open port for it even ISP use CGNAT