FULL AI ANALYSIS

ISP modem drops UPnP NAT mappings after brief DSL SNR resyncs, breaking incoming services

Generated Oct 3, 2026, 12:35:03 AM

Analysis summary

UPnP is designed to create dynamic NAT mappings tied to the perceived gateway or NAT state. When the ISP modem experiences a link resync it typically rebuilds its internal NAT/session tables or may restart the NAT function even if the external IP is unchanged. That invalidates any UPnP state maintained by downstream routers. If the modem is performing NAT (double NAT), it owns the external mapping and may not preserve mappings across internal resets. OpenWrt/miniupnpd can only create mappings on the device that terminates the public IP; if the ISP modem/router is doing NAT, mappings created on the OpenWrt box may not be reflected/retained by the modem.

Possible causes

ISP modem performs an internal NAT or firewall restart during DSL resyncs, flushing UPnP/NAT state even when WAN IP unchanged.

90%

Modem firmware bug that resets NAT/UPnP state on physical link retrain rather than preserving sessions.

85%

miniupnpd-created mappings are only local to the OpenWrt router; the ISP modem sits in front doing NAT and drops its own mapping table on resync (double NAT scenario).

70%

CGNAT or ISP-side transient behavior that prevents stable external binding (less likely if public IP unchanged).

10%

Suggested fixes

Diagnostic step 1

Determine path of NAT: put modem into bridge mode if the ISP supports it so OpenWrt receives the public IP directly; this removes double NAT and allows persistent static port forwarding on OpenWrt. If bridge mode is unavailable, request ISP support to enable bridge/DMZ mode or persistent NAT behavior — escalate to ISP with logs showing mapping loss.

Diagnostic step 2

Configure static port forwarding on the device that owns the public IP (ISP modem) rather than relying on UPnP. This is the most reliable approach and survives link resyncs because static rules are persisted across restarts.

Diagnostic step 3

If static forwarding on modem is impossible, implement a resilient reverse-tunnel (reverse SSH or a small rendezvous server/NGROK-style service) from a LAN host to an external host to accept inbound connections without relying on UPnP. This avoids modifying modem state and is reversible by stopping the tunnel.

Diagnostic step 4

Collect logs to prove cause before escalation: capture modem logs around the resync time, collect OpenWrt syslog and miniupnpd logs, and note exact timestamps. Avoid exposing credentials; redact any sensitive data when sharing logs with ISP or support.

Diagnostic step 5

Temporary mitigation: implement a script on OpenWrt that detects WAN resync (watch wan interface link or PPP events) and reissues the UPnP mapping or triggers an API call to the modem (if available). This is a workaround and not a true fix; prefer static forwarding or bridging. Escalate to ISP if modem firmware appears to clear NAT state on resync.

Contact • Help • API Docs • Careers • Terms • Privacy • Cookies • Ads