FULL AI ANALYSIS

UPnP port mappings vanish after ISP modem reboot despite static DHCP lease and fixed WAN IP

Generated Oct 3, 2026, 12:35:03 AM

Analysis summary

Symptoms point to the modem acting as the authoritative NAT and not applying or not honoring the translation chains after a reboot even though the UPnP lease entries are parsed and displayed. Two likely interaction patterns cause this: (1) the modem's UPnP implementation stores requested mappings but fails to install kernel NAT rules until an internal event (e.g., refresh or external packet) occurs; (2) the modem's upstream NAT or firewall policy is applied before the internal NAT table reconciliation, blocking inbound traffic until mappings are reasserted. The fact that switching the internal router into bridge mode makes port forwarding work indicates the modem is the bottleneck. The modem showing the public IP unchanged rules out dynamic IP-based filtering as the root cause.

Possible causes

Modem firmware bug: UPnP entries stored in config but not applied to kernel NAT table after reboot.

90%

Race condition where modem applies firewall policy before applying UPnP/NAT rules, dropping inbound packets until mappings are reasserted.

60%

Modem treats DMZ/bridge mode inconsistently across reboots, causing stale route or ARP entry that prevents packet forwarding even though mapping exists in UI.

50%

Internal router and modem both attempting NAT (double NAT) with UPnP mapping created at the modem but external packets arriving at modem firewall are not forwarded to internal router due to mismatch in expected internal source address or interface after reboot.

30%

Suggested fixes

Diagnostic step 1

Temporarily place internal router in true bridge/pass-through mode so the internal router is the single NAT device; verify external ports become reachable. If this restores reachability, continue using bridge mode or ask ISP to support a modem in passthrough.

Diagnostic step 2

Capture packet traces on both modem and internal router during an external connection attempt (tcpdump on internal router WAN interface and, if possible, modem packet capture) to confirm whether inbound packets reach the modem and whether they are forwarded. Save captures and only share with ISP support if comfortable.

Diagnostic step 3

Use a controlled test from a cloud host (single TCP connect or UDP probe) while iterating: (a) create mapping, (b) reboot modem, (c) immediately trigger an external probe to see if first packet is dropped and whether a subsequent probe succeeds; document timing to expose race conditions.

Diagnostic step 4

Disable UPnP on the internal router and configure static forwarding on the modem for critical services to avoid the two-device UPnP interaction; confirm NAT translations appear in modem's 'active' list and are reachable from outside.

Diagnostic step 5

If modem exposes remote logging or advanced NAT/conntrack tables, check conntrack entries after reboot to see if translations were created; if not, escalate to ISP with packet captures and timestamps so they can reproduce and investigate their firmware's UPnP-to-NAT apply path.

Contact • Help • API Docs • Careers • Terms • Privacy • Cookies • Ads