diff --git a/net/miniupnpd/Makefile b/net/miniupnpd/Makefile
index 11482ac4..4c090623 100644
--- a/net/miniupnpd/Makefile
+++ b/net/miniupnpd/Makefile
@@ -8,64 +8,72 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=miniupnpd
-PKG_VERSION:=2.1.20200510
-PKG_RELEASE:=5
+PKG_VERSION:=2.0.20170421
+PKG_RELEASE:=2
 
-PKG_SOURCE_URL:=https://miniupnp.tuxfamily.org/files
+PKG_SOURCE_URL:=http://miniupnp.free.fr/files
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_HASH:=821e708f369cc1fb851506441fbc3a1f4a1b5a8bf8e84a9e71758a32f5127e8b
+PKG_HASH:=9677aeccadf73b4bf8bb9d832c32b5da8266b4d58eed888f3fd43d7656405643
 
+PKG_MAINTAINER:=Markus Stenberg <fingon@iki.fi>
 PKG_LICENSE:=BSD-3-Clause
-PKG_LICENSE_FILES:=LICENSE
-PKG_CPE_ID:=cpe:/a:miniupnp_project:miniupnpd
-
-PKG_INSTALL:=1
-PKG_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/package.mk
-include $(INCLUDE_DIR)/version.mk
 
 define Package/miniupnpd
   SECTION:=net
   CATEGORY:=Network
-  DEPENDS:=+iptables +libip4tc +libuuid +libcap-ng
+  DEPENDS:=+iptables +libip4tc +libuuid
   TITLE:=Lightweight UPnP IGD, NAT-PMP & PCP daemon
   SUBMENU:=Firewall
-  URL:=https://miniupnp.tuxfamily.org/
+  URL:=http://miniupnp.free.fr/
+endef
+
+define Package/miniupnpd/config
+config MINIUPNPD_IGDv2
+	bool
+	default n
+	prompt "Enable IGDv2"
 endef
 
 define Package/miniupnpd/conffiles
 /etc/config/upnpd
 endef
 
-define Build/Prepare
-	$(call Build/Prepare/Default)
-	echo "$(VERSION_NUMBER)" | tr '() ' '_' >$(PKG_BUILD_DIR)/os.openwrt
+define Package/miniupnpd/postinst
+#!/bin/sh
+
+if [ -z "$$IPKG_INSTROOT" ]; then
+  ( . /etc/uci-defaults/99-miniupnpd )
+  rm -f /etc/uci-defaults/99-miniupnpd
+fi
+
+exit 0
 endef
 
-CONFIGURE_ARGS = \
-	$(if $(CONFIG_IPV6),--ipv6) \
-	--igd2 \
-	--leasefile \
-	--portinuse \
-	--firewall=iptables
+define Build/Prepare
+	$(call Build/Prepare/Default)
+	echo "OpenWrt" | tr \(\)\  _ >$(PKG_BUILD_DIR)/os.openwrt
+endef
+
+MAKE_FLAGS += \
+	TARGET_OPENWRT=1 TEST=0 \
+	LIBS="" \
+	CC="$(TARGET_CC) -DIPTABLES_143 \
+		-lip4tc -luuid" \
+	CONFIG_OPTIONS="--portinuse --leasefile \
+		$(if $(CONFIG_MINIUPNPD_IGDv2),--igd2)" \
+	-f Makefile.linux \
+	miniupnpd
 
-TARGET_CFLAGS += $(FPIC) -flto
-TARGET_LDFLAGS += -Wl,--gc-sections,--as-needed
 
 define Package/miniupnpd/install
-	$(INSTALL_DIR) $(1)/usr/sbin
-	$(INSTALL_DIR) $(1)/etc/init.d
-	$(INSTALL_DIR) $(1)/etc/config
-	$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
-	$(INSTALL_DIR) $(1)/etc/uci-defaults
-	$(INSTALL_DIR) $(1)/usr/share/miniupnpd
-
-	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/miniupnpd $(1)/usr/sbin/miniupnpd
+	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/init.d $(1)/etc/config $(1)/etc/uci-defaults $(1)/etc/hotplug.d/iface $(1)/usr/share/miniupnpd
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/miniupnpd $(1)/usr/sbin/miniupnpd
 	$(INSTALL_BIN) ./files/miniupnpd.init $(1)/etc/init.d/miniupnpd
 	$(INSTALL_CONF) ./files/upnpd.config $(1)/etc/config/upnpd
 	$(INSTALL_DATA) ./files/miniupnpd.hotplug $(1)/etc/hotplug.d/iface/50-miniupnpd
-	$(INSTALL_BIN) ./files/miniupnpd.defaults $(1)/etc/uci-defaults/99-miniupnpd
+	$(INSTALL_DATA) ./files/miniupnpd.defaults $(1)/etc/uci-defaults/99-miniupnpd
 	$(INSTALL_DATA) ./files/firewall.include $(1)/usr/share/miniupnpd/firewall.include
 endef
 
diff --git a/net/miniupnpd/files/firewall.include b/net/miniupnpd/files/firewall.include
index 97908af2..0eb96d7c 100644
--- a/net/miniupnpd/files/firewall.include
+++ b/net/miniupnpd/files/firewall.include
@@ -1,44 +1,31 @@
 #!/bin/sh
 # miniupnpd integration for firewall3
 
-IPTABLES=/usr/sbin/iptables
 IP6TABLES=/usr/sbin/ip6tables
 
-$IPTABLES -t filter -N MINIUPNPD 2>/dev/null
-$IPTABLES -t nat -N MINIUPNPD 2>/dev/null
-$IPTABLES -t nat -N MINIUPNPD-POSTROUTING 2>/dev/null
+iptables -t filter -N MINIUPNPD 2>/dev/null
+iptables -t nat -N MINIUPNPD 2>/dev/null
+iptables -t nat -N MINIUPNPD-POSTROUTING 2>/dev/null
 
 [ -x $IP6TABLES ] && $IP6TABLES -t filter -N MINIUPNPD 2>/dev/null
 
 . /lib/functions/network.sh
 
-# helper to insert in chain as penultimate
-iptables_prepend_rule() {
-	local iptables="$1"
-	local table="$2"
-	local chain="$3"
-	local target="$4"
-
-	$iptables -t "$table" -I "$chain" $($iptables -t "$table" --line-numbers -nL "$chain" | \
-		sed -ne '$s/[^0-9].*//p') -j "$target"
-}
-
 ADDED=0
 
 add_extzone_rules() {
-    local ext_zone="$1"
+    local ext_zone=$1
 
     [ -z "$ext_zone" ] && return
 
     # IPv4 - due to NAT, need to add both to nat and filter table
-    # need to insert as penultimate rule for forward & postrouting since final rule might be a fw3 REJECT
-    iptables_prepend_rule "$IPTABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
-    $IPTABLES -t nat -A "zone_${ext_zone}_prerouting"  -j MINIUPNPD
-    iptables_prepend_rule "$IPTABLES" nat "zone_${ext_zone}_postrouting" MINIUPNPD-POSTROUTING
+    iptables -t filter -I zone_${ext_zone}_forward -j MINIUPNPD
+    iptables -t nat -I zone_${ext_zone}_prerouting -j MINIUPNPD
+    iptables -t nat -I zone_${ext_zone}_postrouting -j MINIUPNPD-POSTROUTING
 
     # IPv6 if available - filter only
     [ -x $IP6TABLES ] && {
-	iptables_prepend_rule "$IP6TABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
+        $IP6TABLES -t filter -I zone_${ext_zone}_forward -j MINIUPNPD
     }
     ADDED=$(($ADDED + 1))
 }
@@ -51,7 +38,8 @@ done
 
 add_extzone_rules $(uci -q get upnpd.config.external_zone)
 
-[ "$ADDED" -ne 0 ] && exit 0
+[ ! $ADDED = 0 ] && exit 0
+
 
 # If really nothing is available, resort to network_find_wan{,6} and
 # assume external interfaces all have same firewall zone.
diff --git a/net/miniupnpd/files/miniupnpd.hotplug b/net/miniupnpd/files/miniupnpd.hotplug
index 15b80c4e..320437e8 100644
--- a/net/miniupnpd/files/miniupnpd.hotplug
+++ b/net/miniupnpd/files/miniupnpd.hotplug
@@ -1,46 +1,39 @@
+#!/bin/sh
+
 /etc/init.d/miniupnpd enabled || exit 0
 
+. /lib/functions/service.sh
+
 # If miniupnpd is not running:
-# - check on _any_ event (event updates may contribute to network_find_wan*)
+# - check on _any_ event (even updates may contribute to network_find_wan*)
 
 # If miniupnpd _is_ running:
 # - check only on ifup (otherwise lease updates etc would cause
 #   miniupnpd state loss)
 
-. /lib/functions/procd.sh
-
-[ "$ACTION" != "ifup" ] && procd_running "miniupnpd" "*" && exit 0
+[ ! "$ACTION" = "ifup" ] && service_check /usr/sbin/miniupnpd && exit 0
 
 tmpconf="/var/etc/miniupnpd.conf"
-external_iface=$(uci -q get upnpd.config.external_iface)
-external_iface6=$(uci -q get upnpd.config.external_iface6)
-external_zone=$(uci -q get upnpd.config.external_zone)
+extiface=$(uci get upnpd.config.external_iface)
+extzone=$(uci get upnpd.config.external_zone)
 
 . /lib/functions/network.sh
 
-if [ -n "$external_iface" ] ; then
-	network_get_device ifname "$external_iface"
-else
-	if [ -n "$external_zone" ] ; then
-		ifname=$(fw3 -q zone "$external_zone" 2>/dev/null | head -1)
-	else
-		network_find_wan external_iface && \
-			network_get_device ifname "$external_iface"
-	fi
-fi
-if [ -n "$external_iface6" ] ; then
-	network_get_device ifname6 "$external_iface6"
-else
-	if [ -n "$external_zone" ] ; then
-		ifname6=$(fw3 -q zone "$external_zone" 2>/dev/null | head -1)
-	else
-		network_find_wan6 external_iface6 && \
-			network_get_device ifname6 "$external_iface6"
-	fi
+for iface in $(uci get upnpd.config.internal_iface); do
+    network_get_device device $iface
+    [ "$DEVICE" = "$device" ] && /etc/init.d/miniupnpd restart && exit 0
+done
+
+
+if [ -z "$extiface" ] ; then
+  # manual external zone (if dynamically find interfaces
+  # belonging to it) overrides network_find_wan*
+  if [ -n "$extzone" ] ; then
+    ifname=$(fw3 -q zone $extzone | head -1)
+  fi
+  [ -n "$extiface" ] || network_find_wan extiface
+  [ -n "$extiface" ] || network_find_wan6 extiface
 fi
 
-[ "$DEVICE" != "$ifname" ] && [ "$DEVICE" != "$ifname6" ] && exit 0
-
-grep -qs "^ext_ifname=$ifname" "$tmpconf" && grep -qs "^ext_ifname6=$ifname6" "$tmpconf" && exit 0
-
-/etc/init.d/miniupnpd restart
+[ -n "$ifname" ] || network_get_device ifname ${extiface}
+grep -q "ext_ifname=$ifname" $tmpconf || /etc/init.d/miniupnpd restart
diff --git a/net/miniupnpd/files/miniupnpd.init b/net/miniupnpd/files/miniupnpd.init
index 4c1ccd29..c934a283 100644
--- a/net/miniupnpd/files/miniupnpd.init
+++ b/net/miniupnpd/files/miniupnpd.init
@@ -3,205 +3,210 @@
 
 START=94
 STOP=15
-USE_PROCD=1
-PROG=/usr/sbin/miniupnpd
+
+SERVICE_USE_PID=1
 
 upnpd_get_port_range() {
-	local var="$1"; shift
-	local val
+	local _var="$1"; shift
+	local _val
 
-	config_get val "$@"
+	config_get _val "$@"
 
-	case "$val" in
+	case "$_val" in
 		[0-9]*[:-][0-9]*)
-			export -n -- "${var}_start=${val%%[:-]*}"
-			export -n -- "${var}_end=${val##*[:-]}"
+			export -n -- "${_var}_start=${_val%%[:-]*}"
+			export -n -- "${_var}_end=${_val##*[:-]}"
 		;;
 		[0-9]*)
-			export -n -- "${var}_start=$val"
-			export -n -- "${var}_end="
+			export -n -- "${_var}_start=$_val"
+			export -n -- "${_var}_end="
 		;;
 	esac
 }
 
 conf_rule_add() {
 	local cfg="$1"
-	local action int_addr
-	local ext_start ext_end int_start int_end comment
+	local tmpconf="$2"
+	local action external_port_start external_port_end int_addr
+	local internal_port_start internal_port_end
 
-	config_get action "$cfg" action "deny"                # allow or deny
+	config_get action "$cfg" action "deny"               # allow or deny
 	upnpd_get_port_range "ext" "$cfg" ext_ports "0-65535" # external ports: x, x-y, x:y
 	config_get int_addr "$cfg" int_addr "0.0.0.0/0"       # ip or network and subnet mask (internal)
 	upnpd_get_port_range "int" "$cfg" int_ports "0-65535" # internal ports: x, x-y, x:y or range
-	config_get comment "$cfg" comment "ACL"		      # comment
 
 	# Make a single IP IP/32 so that miniupnpd.conf can use it.
-	[ "${int_addr%/*}" = "$int_addr" ] && int_addr="$int_addr/32"
+	case "$int_addr" in
+		*/*) ;;
+		*) int_addr="$int_addr/32" ;;
+	esac
 
-	echo "$action $ext_start${ext_end:+-}$ext_end $int_addr $int_start${int_end:+-}$int_end #$comment"
+	echo "${action} ${ext_start}${ext_end:+-}${ext_end} ${int_addr} ${int_start}${int_end:+-}${int_end}" >>$tmpconf
 }
 
 upnpd_write_bool() {
 	local opt="$1"
 	local def="${2:-0}"
-	local alt="${3:-$opt}"
+	local alt="$3"
 	local val
 
 	config_get_bool val config "$opt" "$def"
 	if [ "$val" -eq 0 ]; then
-		echo "$alt=no"
+		echo "${alt:-$opt}=no" >> $tmpconf
 	else
-		echo "$alt=yes"
+		echo "${alt:-$opt}=yes" >> $tmpconf
 	fi
 }
 
-upnpd() {
+boot() {
+	return
+}
+
+start() {
 	config_load "upnpd"
-	local external_iface external_iface6 external_zone external_ip internal_iface
-	local upload download log_output port config_file serial_number model_number
-	local use_stun stun_host stun_port uuid notify_interval presentation_url
+	local extiface intiface upload download logging secure enabled natpmp
+	local extip port usesysuptime conffile serial_number model_number
+	local uuid notify_interval presentation_url enable_upnp
 	local upnp_lease_file clean_ruleset_threshold clean_ruleset_interval
-	local ipv6_disable
+        local ipv6_listening_ip enabled
 
-	local enabled
 	config_get_bool enabled config enabled 1
-	[ "$enabled" -eq 0 ] && return 1
 
-	config_get external_iface config external_iface
-	config_get external_iface6 config external_iface6
-	config_get external_zone config external_zone
-	config_get external_ip config external_ip
-	config_get internal_iface config internal_iface
+	[ "$enabled" -gt 0 ] || return 1
+
+	config_get extiface config external_iface
+	config_get extzone config external_zone
+	config_get intiface config internal_iface
+	config_get extip config external_ip
 	config_get port config port 5000
-	config_get upload config upload
+	config_get upload   config upload
 	config_get download config download
-	config_get_bool log_output config log_output 0
-	config_get config_file config config_file
+	config_get_bool logging config log_output 0
+	config_get conffile config config_file
 	config_get serial_number config serial_number
 	config_get model_number config model_number
 	config_get uuid config uuid
-	config_get use_stun config use_stun 0
-	config_get stun_host config stun_host
-	config_get stun_port config stun_port
 	config_get notify_interval config notify_interval
 	config_get presentation_url config presentation_url
 	config_get upnp_lease_file config upnp_lease_file
 	config_get clean_ruleset_threshold config clean_ruleset_threshold
 	config_get clean_ruleset_interval config clean_ruleset_interval
-	config_get ipv6_disable config ipv6_disable 0
+	config_get ipv6_listening_ip config ipv6_listening_ip
 
-	local conf ifname ifname6
+	local args
 
 	. /lib/functions/network.sh
 
-	if [ -n "$external_iface" ] ; then
-		network_get_device ifname "$external_iface"
-	else
-		if [ -n "$external_zone" ] ; then
-			ifname=$(fw3 -q zone "$external_zone" 2>/dev/null | head -1)
-		else
-			network_find_wan external_iface && \
-				network_get_device ifname "$external_iface"
-		fi
-	fi
-	if [ -n "$external_iface6" ] ; then
-		network_get_device ifname6 "$external_iface6"
-	else
-		if [ -n "$external_zone" ] ; then
-			ifname6=$(fw3 -q zone "$external_zone" 2>/dev/null | head -1)
-		else
-			network_find_wan6 external_iface6 && \
-				network_get_device ifname6 "$external_iface6"
-		fi
-	fi
+	local ifname
 
-	if [ -n "$config_file" ]; then
-		conf="$config_file"
+        # manual external interface overrides everything
+        if [ -z "$extiface" ] ; then
+            # manual external zone (if dynamically find interfaces
+            # belonging to it) overrides network_find_wan*
+            if [ -n "$extzone" ] ; then
+                ifname=$(fw3 -q zone $extzone | head -1)
+            fi
+            [ -n "$extiface" ] || network_find_wan extiface
+            [ -n "$extiface" ] || network_find_wan6 extiface
+        fi
+
+	[ -n "$ifname" ] || network_get_device ifname ${extiface}
+
+	if [ -n "$conffile" ]; then
+		args="-f $conffile"
 	else
 		local tmpconf="/var/etc/miniupnpd.conf"
-		conf="$tmpconf"
+		args="-f $tmpconf"
 		mkdir -p /var/etc
 
-		{
-		echo "ext_ifname=$ifname"
-		echo "ext_ifname6=$ifname6"
-		[ -n "$external_ip" ] && echo "ext_ip=$external_ip"
+		echo "ext_ifname=$ifname" >$tmpconf
+
+		[ -n "$extip" ] && \
+			echo "ext_ip=$extip" >>$tmpconf
 
 		local iface
-		for iface in ${internal_iface:-lan}; do
+		for iface in ${intiface:-lan}; do
 			local device
-			network_get_device device "$iface" && echo "listening_ip=$device"
-			network_get_device device "$iface" && echo "ipv6_listening_ip=$device"
+			network_get_device device "$iface" && {
+				echo "listening_ip=$device" >>$tmpconf
+			}
 		done
 
+		[ "$port" != "auto" ] && \
+			echo "port=$port" >>$tmpconf
+
 		config_load "upnpd"
 		upnpd_write_bool enable_natpmp 1
 		upnpd_write_bool enable_upnp 1
 		upnpd_write_bool secure_mode 1
+		upnpd_write_bool pcp_allow_thirdparty 0
 		upnpd_write_bool system_uptime 1
-		upnpd_write_bool igdv1 0 force_igd_desc_v1
-		upnpd_write_bool use_stun 0 ext_perform_stun
-		upnpd_write_bool ipv6_disable $ipv6_disable
 
-		[ "$use_stun" -eq 0 ] || {
-			[ -n "$stun_host" ] && echo "ext_stun_host=$stun_host"
-			[ -n "$stun_port" ] && echo "ext_stun_port=$stun_port"
+		[ -n "$upnp_lease_file" ] && \
+			echo "lease_file=$upnp_lease_file" >>$tmpconf
+
+		[ -n "$upload" -a -n "$download" ] && {
+			echo "bitrate_down=$(($download * 1024 * 8))" >>$tmpconf
+			echo "bitrate_up=$(($upload * 1024 * 8))" >>$tmpconf
 		}
 
-		[ -n "$upload" ] && [ -n "$download" ] && {
-			echo "bitrate_down=$((download * 1024 * 8))"
-			echo "bitrate_up=$((upload * 1024 * 8))"
-		}
+		[ -n "${presentation_url}" ] && \
+			echo "presentation_url=${presentation_url}" >>$tmpconf
 
-		[ -n "$upnp_lease_file" ] && touch "$upnp_lease_file" && echo "lease_file=$upnp_lease_file"
-		[ -n "$presentation_url" ] && echo "presentation_url=$presentation_url"
-		[ -n "$notify_interval" ] && echo "notify_interval=$notify_interval"
-		[ -n "$clean_ruleset_threshold" ] && echo "clean_ruleset_threshold=$clean_ruleset_threshold"
-		[ -n "$clean_ruleset_interval" ] && echo "clean_ruleset_interval=$clean_ruleset_interval"
-		[ -n "$serial_number" ] && echo "serial=$serial_number"
-		[ -n "$model_number" ] && echo "model_number=$model_number"
-		[ -n "$port" ] && echo "port=$port"
+		[ -n "${notify_interval}" ] && \
+			echo "notify_interval=${notify_interval}" >>$tmpconf
+
+		[ -n "${clean_ruleset_threshold}" ] && \
+			echo "clean_ruleset_threshold=${clean_ruleset_threshold}" >>$tmpconf
+
+		[ -n "${clean_ruleset_interval}" ] && \
+			echo "clean_ruleset_interval=${clean_ruleset_interval}" >>$tmpconf
+
+		[ -n "${ipv6_listening_ip}" ] && \
+			echo "ipv6_listening_ip=${ipv6_listening_ip}" >>$tmpconf
 
 		[ -z "$uuid" ] && {
 			uuid="$(cat /proc/sys/kernel/random/uuid)"
-			uci set upnpd.config.uuid="$uuid"
+			uci set upnpd.config.uuid=$uuid
 			uci commit upnpd
 		}
 
-		[ "$uuid" = "nocli" ] || echo "uuid=$uuid"
+		[ "$uuid" = "nocli" ] || \
+			echo "uuid=$uuid" >>$tmpconf
 
-		config_foreach conf_rule_add perm_rule
+		[ -n "${serial_number}" ] && \
+			echo "serial=${serial_number}" >>$tmpconf
 
-		} > "$tmpconf"
+		[ -n "${model_number}" ] && \
+			echo "model_number=${model_number}" >>$tmpconf
+
+	    config_foreach conf_rule_add perm_rule "$tmpconf"
 	fi
 
+
 	if [ -n "$ifname" ]; then
 		# start firewall
-		iptables -L MINIUPNPD >/dev/null 2>&1 || fw3 reload
+		iptables -L MINIUPNPD >/dev/null 2>/dev/null || fw3 reload
+
+		if [ "$logging" = "1" ]; then
+			SERVICE_DAEMONIZE=1 \
+			service_start /usr/sbin/miniupnpd $args -d
+		else
+			SERVICE_DAEMONIZE= \
+			service_start /usr/sbin/miniupnpd $args
+		fi
 	else
 		logger -t "upnp daemon" "external interface not found, not starting"
 	fi
-
-	procd_open_instance
-	procd_set_param command "$PROG"
-	procd_append_param command -f "$conf"
-	[ "$log_output" = "1" ] && procd_append_param command -d
-	procd_close_instance
 }
 
-stop_service() {
+stop() {
+	service_stop /usr/sbin/miniupnpd
+
 	iptables -t nat -F MINIUPNPD 2>/dev/null
-	iptables -t nat -F MINIUPNPD-POSTROUTING 2>/dev/null
 	iptables -t filter -F MINIUPNPD 2>/dev/null
 
-	[ -x /usr/sbin/ip6tables ] && ip6tables -t filter -F MINIUPNPD 2>/dev/null
-}
-
-start_service() {
-	config_load "upnpd"
-	config_foreach upnpd "upnpd"
-}
-
-service_triggers() {
-	procd_add_reload_trigger "upnpd"
+        [ -x /usr/sbin/ip6tables ] && {
+	    ip6tables -t filter -F MINIUPNPD 2>/dev/null
+        }
 }
diff --git a/net/miniupnpd/files/upnpd.config b/net/miniupnpd/files/upnpd.config
index 37b81d89..9a65bfa6 100644
--- a/net/miniupnpd/files/upnpd.config
+++ b/net/miniupnpd/files/upnpd.config
@@ -1,18 +1,17 @@
 config upnpd config
-	option enabled		1
+	option enabled		0
 	option enable_natpmp	1
 	option enable_upnp	1
 	option secure_mode	1
 	option log_output	0
-	option download		1024
-	option upload		512
-#by default, looked up dynamically from ubus
-#	option external_iface	wan
+	option download 	1024
+	option upload   	512
+        #by default, looked up dynamically from ubus
+	#option external_iface	wan
 	option internal_iface	lan
 	option port		5000
-	option upnp_lease_file	/var/run/miniupnpd.leases
-	option igdv1		1
-
+	option upnp_lease_file	/var/upnp.leases
+	
 config perm_rule
 	option action		allow
 	option ext_ports	1024-65535
@@ -21,8 +20,8 @@ config perm_rule
 	option comment		"Allow high ports"
 
 config perm_rule
-	option action		deny
-	option ext_ports	0-65535
-	option int_addr		0.0.0.0/0
-	option int_ports	0-65535
-	option comment		"Default deny"
+       option action		deny
+       option ext_ports		0-65535
+       option int_addr		0.0.0.0/0
+       option int_ports		0-65535
+       option comment		"Default deny"
diff --git a/net/miniupnpd/patches/100-no-daemon.patch b/net/miniupnpd/patches/100-no-daemon.patch
deleted file mode 100644
index 9b9c26da..00000000
--- a/net/miniupnpd/patches/100-no-daemon.patch
+++ /dev/null
@@ -1,25 +0,0 @@
---- a/miniupnpd.c
-+++ b/miniupnpd.c
-@@ -1769,21 +1769,7 @@ init(int argc, char * * argv, struct run
- 		}
- 	}
- 
--	if(debug_flag)
--	{
--		pid = getpid();
--	}
--	else
--	{
--#ifdef USE_DAEMON
--		if(daemon(0, 0)<0) {
--			perror("daemon()");
--		}
--		pid = getpid();
--#else
--		pid = daemonize();
--#endif
--	}
-+	pid = getpid();
- 
- 	openlog_option = LOG_PID|LOG_CONS;
- 	if(debug_flag)
diff --git a/net/miniupnpd/patches/101-no-ssl-uuid.patch b/net/miniupnpd/patches/101-no-ssl-uuid.patch
new file mode 100644
index 00000000..81cea104
--- /dev/null
+++ b/net/miniupnpd/patches/101-no-ssl-uuid.patch
@@ -0,0 +1,23 @@
+We do not need to autodetect SSL/UUID; SSL we do not support, UUID we always do.
+
+--- a/Makefile.linux
++++ b/Makefile.linux
+@@ -153,14 +153,18 @@ LDLIBS += $(shell $(PKG_CONFIG) --static
+ LDLIBS += $(shell $(PKG_CONFIG) --static --libs-only-l libnetfilter_conntrack)
+ endif # ($(TEST),1)
+ 
++ifeq ($(TARGET_OPENWRT),)
++# n/a - we don't enable https server for IGD v2 anyway in OpenWrt
+ LDLIBS += $(shell $(PKG_CONFIG) --static --libs-only-l libssl)
+ 
++# n/a - we hardcodedly support libuuid
+ TEST := $(shell $(PKG_CONFIG) --exists uuid && echo 1)
+ ifeq ($(TEST),1)
+ LDLIBS += $(shell $(PKG_CONFIG) --static --libs-only-l uuid)
+ else
+ $(info please install uuid-dev package / libuuid)
+ endif # ($(TEST),1)
++endif
+ 
+ TESTUPNPDESCGENOBJS = testupnpdescgen.o upnpdescgen.o
+ 
diff --git a/net/miniupnpd/patches/102-ipv6-ext-port.patch b/net/miniupnpd/patches/102-ipv6-ext-port.patch
new file mode 100644
index 00000000..806c7fd5
--- /dev/null
+++ b/net/miniupnpd/patches/102-ipv6-ext-port.patch
@@ -0,0 +1,10 @@
+--- a/pcpserver.c
++++ b/pcpserver.c
+@@ -982,6 +982,7 @@ static int CreatePCPMap_NAT(pcp_info_t *
+ 				   timestamp);
+ 	if (r < 0)
+ 		return PCP_ERR_NO_RESOURCES;
++	pcp_msg_info->ext_port = pcp_msg_info->int_port;
+ 	return PCP_SUCCESS;
+ }
+ 
diff --git a/net/miniupnpd/patches/103-no-ipv6-autodetection.patch b/net/miniupnpd/patches/103-no-ipv6-autodetection.patch
new file mode 100644
index 00000000..50d5a392
--- /dev/null
+++ b/net/miniupnpd/patches/103-no-ipv6-autodetection.patch
@@ -0,0 +1,27 @@
+The miniupnpd makefile tries to autodetect iptables capabilities.
+This will incorrectly detect capabilities such as ipv6 support even though it is disabled for the target build.
+
+As the OpenWRT buildsystem already passes the right compile flags, we can skip the autodetection.
+
+
+--- a/netfilter/Makefile
++++ b/netfilter/Makefile
+@@ -38,8 +38,6 @@ endif
+ endif
+ endif
+ 
+-LIBS +=  /lib/libip4tc.so /lib/libip6tc.so
+-
+ all:	iptcrdr.o testiptcrdr iptpinhole.o \
+         testiptcrdr_peer testiptcrdr_dscp test_nfct_get
+ #        testiptpinhole
+--- a/Makefile.linux
++++ b/Makefile.linux
+@@ -73,7 +73,6 @@ CPPFLAGS += -DIPTABLES_143
+ endif
+ 
+ CFLAGS  += $(shell $(PKG_CONFIG) --cflags libiptc)
+-LDLIBS  += $(shell $(PKG_CONFIG) --static --libs-only-l libiptc)
+ LDFLAGS += $(shell $(PKG_CONFIG) --libs-only-L libiptc)
+ LDFLAGS += $(shell $(PKG_CONFIG) --libs-only-other libiptc)
+ else
diff --git a/net/miniupnpd/patches/104-always-libuuid.patch b/net/miniupnpd/patches/104-always-libuuid.patch
new file mode 100644
index 00000000..d6c07704
--- /dev/null
+++ b/net/miniupnpd/patches/104-always-libuuid.patch
@@ -0,0 +1,20 @@
+As it turns out, the 'magic' libuuid/bsd uuid check just checks
+outside buildtree altogether for the uuid_generate. So we just
+hardcode it.
+
+--- a/genconfig.sh
++++ b/genconfig.sh
+@@ -367,12 +367,7 @@ case $FW in
+ esac
+ 
+ # UUID API
+-if grep uuid_create /usr/include/uuid.h > /dev/null 2>&1 ; then
+-	echo "#define BSD_UUID" >> ${CONFIGFILE}
+-fi
+-if grep uuid_generate /usr/include/uuid/uuid.h > /dev/null 2>&1 ; then
+-	echo "#define LIB_UUID" >> ${CONFIGFILE}
+-fi
++echo "#define LIB_UUID" >> ${CONFIGFILE}
+ 
+ # set V6SOCKETS_ARE_V6ONLY to 0 if it was not set above
+ if [ -z "$V6SOCKETS_ARE_V6ONLY" ] ; then
diff --git a/net/miniupnpd/patches/105-build-with-kernel-5.4.patch b/net/miniupnpd/patches/105-build-with-kernel-5.4.patch
new file mode 100644
index 00000000..48ea1ee7
--- /dev/null
+++ b/net/miniupnpd/patches/105-build-with-kernel-5.4.patch
@@ -0,0 +1,92 @@
+Index: miniupnpd-2.0.20170421/netfilter/iptcrdr.c
+===================================================================
+--- miniupnpd-2.0.20170421.orig/netfilter/iptcrdr.c
++++ miniupnpd-2.0.20170421/netfilter/iptcrdr.c
+@@ -1116,9 +1116,13 @@ addnatrule(int proto, unsigned short epo
+ 	} else {
+ 		match = get_udp_match(eport, 0);
+ 	}
+-	e->nfcache = NFC_IP_DST_PT;
++#ifdef NFC_UNKNOWN
++	e->nfcache = NFC_UNKNOWN;
++#endif
+ 	target = get_dnat_target(iaddr, iport);
+-	e->nfcache |= NFC_UNKNOWN;
++#ifdef NFC_IP_DST_PT
++	e->nfcache |= NFC_IP_DST_PT;
++#endif
+ 	tmp = realloc(e, sizeof(struct ipt_entry)
+ 	               + match->u.match_size
+ 				   + target->u.target_size);
+@@ -1186,9 +1190,13 @@ addmasqueraderule(int proto,
+ 	} else {
+ 		match = get_udp_match(0, iport);
+ 	}
+-	e->nfcache = NFC_IP_DST_PT;
++#ifdef NFC_UNKNOWN
++        e->nfcache = NFC_UNKNOWN;
++#endif
+ 	target = get_masquerade_target(eport);
+-	e->nfcache |= NFC_UNKNOWN;
++#ifdef NFC_IP_DST_PT
++	e->nfcache |= NFC_IP_DST_PT;
++#endif
+ 	tmp = realloc(e, sizeof(struct ipt_entry)
+ 	               + match->u.match_size
+ 				   + target->u.target_size);
+@@ -1266,9 +1274,16 @@ addpeernatrule(int proto,
+ 	} else {
+ 		match = get_udp_match(rport, iport);
+ 	}
+-	e->nfcache = NFC_IP_DST_PT | NFC_IP_SRC_PT;
++#ifdef NFC_UNKNOWN
++        e->nfcache = NFC_UNKNOWN;
++#endif
+ 	target = get_snat_target(eaddr, eport);
+-	e->nfcache |= NFC_UNKNOWN;
++#ifdef NFC_IP_DST_PT
++	e->nfcache |= NFC_IP_DST_PT;
++#endif
++#ifdef NFC_IP_SRC_PT
++	e->nfcache |= NFC_IP_SRC_PT;
++#endif
+ 	tmp = realloc(e, sizeof(struct ipt_entry)
+ 	               + match->u.match_size
+ 				   + target->u.target_size);
+@@ -1337,9 +1352,16 @@ addpeerdscprule(int proto, unsigned char
+ 	} else {
+ 		match = get_udp_match(rport, iport);
+ 	}
+-	e->nfcache = NFC_IP_DST_PT | NFC_IP_SRC_PT;
++#ifdef NFC_UNKNOWN
++	e->nfcache = NFC_UNKNOWN;
++#endif
+ 	target = get_dscp_target(dscp);
+-	e->nfcache |= NFC_UNKNOWN;
++#ifdef NFC_IP_DST_PT
++	e->nfcache |= NFC_IP_DST_PT;
++#endif
++#ifdef NFC_IP_SRC_PT
++	e->nfcache |= NFC_IP_SRC_PT;
++#endif
+ 	tmp = realloc(e, sizeof(struct ipt_entry)
+ 	               + match->u.match_size
+ 				   + target->u.target_size);
+@@ -1420,11 +1442,15 @@ add_filter_rule(int proto, const char *
+ 	} else {
+ 		match = get_udp_match(iport,0);
+ 	}
+-	e->nfcache = NFC_IP_DST_PT;
+ 	e->ip.dst.s_addr = inet_addr(iaddr);
+ 	e->ip.dmsk.s_addr = INADDR_NONE;
++#ifdef NFC_UNKNOWN
++	e->nfcache = NFC_UNKNOWN;
++#endif
+ 	target = get_accept_target();
+-	e->nfcache |= NFC_UNKNOWN;
++#ifdef NFC_IP_DST_PT
++	e->nfcache |= NFC_IP_DST_PT;
++#endif
+ 	tmp = realloc(e, sizeof(struct ipt_entry)
+ 	               + match->u.match_size
+ 				   + target->u.target_size);
diff --git a/net/miniupnpd/patches/200-remove-default-cflags.patch b/net/miniupnpd/patches/200-remove-default-cflags.patch
deleted file mode 100644
index 46206045..00000000
--- a/net/miniupnpd/patches/200-remove-default-cflags.patch
+++ /dev/null
@@ -1,24 +0,0 @@
---- a/Makefile.linux
-+++ b/Makefile.linux
-@@ -24,16 +24,16 @@
- CONFIG_OPTIONS += --firewall=iptables
- #CFLAGS = -O -g -DDEBUG
- CFLAGS ?= -Os
--CFLAGS += -fno-strict-aliasing
--CFLAGS += -fno-common
--CFLAGS += -fstack-protector -fPIE
--CFLAGS += -D_FORTIFY_SOURCE=2
-+#CFLAGS += -fno-strict-aliasing
-+#CFLAGS += -fno-common
-+#CFLAGS += -fstack-protector -fPIE
-+#CFLAGS += -D_FORTIFY_SOURCE=2
- CPPFLAGS += -D_GNU_SOURCE
- CFLAGS += -Wall
- CFLAGS += -Wextra -Wstrict-prototypes -Wdeclaration-after-statement
- #CFLAGS += -Wno-missing-field-initializers
- #CFLAGS += -ansi	# iptables headers does use typeof which is a gcc extension
--LDFLAGS += -Wl,-z,now -Wl,-z,relro -pie
-+LDFLAGS ?= -Wl,-z,now -Wl,-z,relro -pie
- CC ?= gcc
- RM = rm -f
- INSTALL = install
diff --git a/net/miniupnpd/patches/300-macos-compat.patch b/net/miniupnpd/patches/300-macos-compat.patch
deleted file mode 100644
index ccd5de99..00000000
--- a/net/miniupnpd/patches/300-macos-compat.patch
+++ /dev/null
@@ -1,36 +0,0 @@
---- a/Makefile.linux
-+++ b/Makefile.linux
-@@ -94,13 +94,13 @@ $(info please install uuid-dev package /
- endif # ($(TEST),1)
- endif # ($(TARGET_OPENWRT,)
- 
--GLIBC_VERSION := $(shell ldd --version | head -n 1 | sed 's/^.* //')
--GLIBC_VERSION_MAJOR = $(shell echo $(GLIBC_VERSION) | cut -f 1 -d . )
--GLIBC_VERSION_MINOR = $(shell echo $(GLIBC_VERSION) | cut -f 2 -d . )
-+#GLIBC_VERSION := $(shell ldd --version | head -n 1 | sed 's/^.* //')
-+#GLIBC_VERSION_MAJOR = $(shell echo $(GLIBC_VERSION) | cut -f 1 -d . )
-+#GLIBC_VERSION_MINOR = $(shell echo $(GLIBC_VERSION) | cut -f 2 -d . )
- # clock_gettime() needs -lrt when glibc version < 2.17
--LDLIBS += $(shell if [ $(GLIBC_VERSION_MAJOR) -lt 2 ] \
--  || [ \( $(GLIBC_VERSION_MAJOR) -eq 2 \) -a \( $(GLIBC_VERSION_MINOR) -lt 17 \) ] ; \
--  then echo "-lrt" ; fi )
-+#LDLIBS += $(shell if [ $(GLIBC_VERSION_MAJOR) -lt 2 ] \
-+#  || [ \( $(GLIBC_VERSION_MAJOR) -eq 2 \) -a \( $(GLIBC_VERSION_MINOR) -lt 17 \) ] ; \
-+#  then echo "-lrt" ; fi )
- 
- TESTUPNPDESCGENOBJS = testupnpdescgen.o upnpdescgen.o
- 
-@@ -140,11 +140,11 @@ install:	miniupnpd $(SRCDIR)/miniupnpd.8
- 	$(INSTALL) $(SRCDIR)/netfilter/ip6tables_init.sh $(DESTDIR)$(ETCINSTALLDIR)
- 	$(INSTALL) $(SRCDIR)/netfilter/ip6tables_removeall.sh $(DESTDIR)$(ETCINSTALLDIR)
- 	$(INSTALL) $(SRCDIR)/netfilter/miniupnpd_functions.sh $(DESTDIR)$(ETCINSTALLDIR)
--	$(INSTALL) --mode=0644 -b $(SRCDIR)/miniupnpd.conf $(DESTDIR)$(ETCINSTALLDIR)
-+	$(INSTALL) -m 0644 -b $(SRCDIR)/miniupnpd.conf $(DESTDIR)$(ETCINSTALLDIR)
- 	$(INSTALL) -d $(DESTDIR)$(PREFIX)/etc/init.d
- 	$(INSTALL) $(SRCDIR)/linux/miniupnpd.init.d.script $(DESTDIR)$(PREFIX)/etc/init.d/miniupnpd
- 	$(INSTALL) -d $(DESTDIR)$(MANINSTALLDIR)
--	$(INSTALL) --mode=0644 $(SRCDIR)/miniupnpd.8 $(DESTDIR)$(MANINSTALLDIR)
-+	$(INSTALL) -m 0644 $(SRCDIR)/miniupnpd.8 $(DESTDIR)$(MANINSTALLDIR)
- 	gzip -f $(DESTDIR)$(MANINSTALLDIR)/miniupnpd.8
- 
- # genuuid is using the uuidgen CLI tool which is part of libuuid