From fdc08bbeca685b3dd2d2b60a1da53af8f6d8c9e9 Mon Sep 17 00:00:00 2001
From: Kjetil Orbekk <kj@orbekk.com>
Date: Mon, 15 Dec 2025 19:17:03 -0500
Subject: fix

---
 modules/router.nix | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

(limited to 'modules')

diff --git a/modules/router.nix b/modules/router.nix
index 3864d06..63b39fb 100644
--- a/modules/router.nix
+++ b/modules/router.nix
@@ -291,11 +291,13 @@ let
           chain forward {
             type filter hook forward priority 0; policy drop
 
-            ip protocol icmp limit rate 4/second counter accept comment "icmp v4"
+ip protocol icmp limit rate 4/second counter accept comment "icmp v4"
             ip6 nexthdr ipv6-icmp limit rate 4/second counter accept comment "accept all ICMP types"
 
             ct state vmap { established : accept, related : accept, invalid : drop }
 
+            jump miniupnpd
+
             # Don't allow accidental vpn forwarding to wan.
             iifname vpnlan-vport oifname wan-vport counter reject
             oifname he0 counter accept
@@ -346,7 +348,16 @@ let
             meta nfproto ipv6 oifname {"mullvad"} counter masquerade
           }
         }
-        '';
+        table inet miniupnpd {
+          chain miniupnpd {}
+          chain prerouting_miniupnpd {
+            type nat hook prerouting priority dstnat; policy accept;
+          }
+          chain postrouting_miniupnpd {
+            type nat hook postrouting priority srcnat; policy accept;
+          }
+        }
+      '';
   };
 in {
   options = {
-- 
cgit v1.2.3