Repository navigation
feat(upnp): UPnP / NAT-PMP management via miniupnpd - #539
Merged
Merged
Conversation
Optional-package service following the banIP pattern: install miniupnpd through the executor, enable it with safe defaults (off by default; enabling forces secure_mode so only LAN clients can add mappings), list the active mappings read-only from the daemon's lease file, and manage per-client allow/deny ACLs as named UCI perm_rule sections. Verified against the OpenWrt miniupnpd package: the mapping table is read-only because miniupnpd exposes no way to delete a single mapping (the lease file is a daemon-managed snapshot, not the source of the nft rules), and there is no lease-duration cap option, so the table shows each mapping's remaining lease instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
UPnP / NAT-PMP management (miniupnpd) following the optional-package pattern, UniFi-style:
secure_mode=1(LAN-only mappings) and the daemon ships disabled.PROTO:ext:int:port:ts:desclease format.perm_rulesections (no new executor op), validated IP/CIDR and port ranges.Live-verified on a lab router (OpenWrt 25.12, apk): install resolves
miniupnpd-nftables, enable writes enabled+secure_mode and starts the daemon, ACL add/delete land in the real config, disable returns to the safe state.Closes #448