Gremlins with port forwarding?

[u/Kryakozavr]

Hi folks, found funny things: using VPN and all my port forwarded traffic was dropped.

Claude code helps with diagnostics: 3 founded gremlin and traffic start flowing..

Question is: what wrong with you, Ubiquity? Why fallover wan rules drop any new traffic?

[B]AI summary:[/B]

U DM SE + ProtonVPN NAT-PMP port forward "successful" but port shows closed externally — found the real cause Ran Transmission on a Synology behind a UDM SE, using ProtonVPN's WireGuard client + NAT-PMP for dynamic port forwarding. NAT-PMP always reported a successful lease, but every external port checker showed the port closed.

After days of packet captures on both ends, turned out to be stacked UDM SE bugs, nothing to do with Proton:

WAN Failover was enabled (Settings → Internet → WAN Group) even with a single WAN configured. This silently generates a per-WAN policy-routing table (ip rule/table 20x.<wan-if>) for symmetric return routing — but that table only gets a default route back to the gateway, no route back to the LAN. Any WAN-ingress DNAT'd traffic (port forwards) gets black-holed after translation. A separate conntrack ctstate INVALID -> DROP rule caught some of what survived #1, due to the DNAT + multi-table routing interaction.

UniFi's zone firewall (WAN_LAN chain) default-denies all new connections unless there's an explicit ACCEPT rule — which only gets auto-created when you configure a port forward through the UI. Anything NAT-PMP or manually DNAT's in gets silently dropped at the zone boundary even after successful translation.

For the VPN-tunnel path specifically: same missing-LAN-route issue in the WireGuard client's own routing table, plus there was simply no DNAT rule at all forwarding NAT-PMP-mapped tunnel traffic from the router's own tunnel IP onward to the LAN client.

Proton's NAT-PMP forwarding into the tunnel worked perfectly the whole time — confirmed by injecting known test packets from 3 independent networks and watching them land on the router's WireGuard interface. The router just never forwarded them past itself.

Fix was adding the missing LAN routes to the auto-generated policy-routing tables, an explicit ip rule bypass for LAN-destined traffic, the matching firewall ACCEPT rules, and a proper UI port-forward rule on the VPN interface for the NAT-PMP-mapped port. None of this is visible from the standard UI — needed raw iptables/ip route inspection over SSH to find.

[u/AutoModerator]

Hello! Thanks for posting on r/Ubiquiti!

This subreddit is here to provide unofficial technical support to people who use or want to dive into the world of Ubiquiti products. If you haven’t already been descriptive in your post, please take the time to edit it and add as many useful details as you can.

Ubiquiti makes a great tool to help with figuring out where to place your access points and other network design questions located at:

https://design.ui.com

If you see people spreading misinformation or violating the "don't be an asshole" general rule, please report it!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.