miniupnpd: Fails to honor ext_perform_stun=allow-filtered setting

Package Name

miniupnpd

Maintainer

common packages maintainers

OpenWrt Version

25.12.2

OpenWrt Target/Subtarget

generic

Steps to Reproduce

1. Add "option ext_perform_stun 'allow-filtered'" to /etc/config/upnpd
2. restart miniupnpd
3. Check /var/etc/miniupnpd.conf
4. Setting doesn't appear in /var/etc/miniupnpd.conf

Actual Behaviour

In a CGNAT configuration with STUN enabled we get the error message when starrting miniupnpd

Wed May 6 08:41:12 2026 daemon.warn miniupnpd[357761]: STUN: ext interface wan with private IP address 192.168.70.10 is now possibly behind restrictive or symmetric NAT with public IP address XX.XX.XX.XX which does not support port forwarding
Wed May 6 08:41:12 2026 daemon.warn miniupnpd[357761]: NAT on upstream router blocks incoming connections set by miniupnpd
Wed May 6 08:41:12 2026 daemon.warn miniupnpd[357761]: Turn off NAT on upstream router or change it to full-cone NAT 1:1 type
Wed May 6 08:41:12 2026 daemon.warn miniupnpd[357761]: Port forwarding is now disabled
Wed May 6 08:41:12 2026 daemon.warn miniupnpd[357761]: Set ext_perform_stun=allow-filtered if you still want to use port forwarding in current situation
Wed May 6 08:41:12 2026 daemon.notice miniupnpd[357761]: HTTP listening on port 5000

But setting this in the conf file and restarting miniupnpd ignores the value and the created /var/etc/miniupnpd.conf that is used to start miniupnpd is missing this option leading to the same error as described in the error messages above.

In addition a LuCI option would be helpful to get this setting from the LUCI UI, but i can log another enhancement request once this issue is resolved.

Confirmation Checklist

• The package is maintained in this repository.
• I understand that issues related to the base OpenWrt repository or LuCI repository will be closed.
• I am reporting an issue for OpenWrt, not an unsupported fork.

Start by tracing how the /etc/config/upnpd option ext_perform_stun is transformed into /var/etc/miniupnpd.conf when miniupnpd restarts. Confirm the allow-filtered value is preserved in the generated configuration, then verify that the resulting service behavior no longer omits this setting.