miniupnpd: add second CGNAT UCI option

As requested by AquanJSW, to test with Tailscale. Also adds the required
daemon fix. No public IPv4 address detection; issues with multiple
clients, e.g. PCP/NAT-PMP

(proposed for inclusion, to merge with prior)

Signed-off-by: Self-Hosting-Group <[email protected]>

Author: Self-Hosting-Group

net/miniupnpd/files/miniupnpd.init

@@ -130,7 +130,7 @@ upnpd_generate_config() {
 			[ "$allow_cgnat" = "1" ] && echo "ext_perform_stun=yes"
 			[ "$allow_cgnat" = "allow-filtered" ] && echo "ext_perform_stun=allow-filtered"
 			# Alternatively, as allow-filtered detects the public IPv4 required by multiple clients, e.g. PCP/NAT-PMP
-			# [ "$allow_cgnat" = "allow-private-ext-ipv4" ] && external_ip=203.1.2.3
+			[ "$allow_cgnat" = "allow-private-ext-ipv4" ] && echo "ext_allow_private_ipv4=yes"
 			echo "ext_stun_host=${stun_host%%:*}"
 			[ "${stun_host%%:*}" != "${stun_host##*:}" ] && echo "ext_stun_port=${stun_host##*:}"
 		fi

net/miniupnpd/patches/030-allow-private-fix.patch

@@ -0,0 +1,18 @@
+From 9ff3c71bfb6c7f7bf525d6bda447387de7257aff Mon Sep 17 00:00:00 2001
+From: Vlad Starodubtsev <[email protected]>
+Date: Wed, 6 Aug 2025 19:04:18 +0300
+Subject: [PATCH] miniupnpd: fix ALLOWPRIVATEIPV4MASK condition
+
+Fixed usage of private/reserved WAN addresses if they are allowed in the configuration.
+
+--- a/upnpsoap.c
++++ b/upnpsoap.c
+@@ -370,7 +370,7 @@ GetExternalIPAddress(struct upnphttp * h
+ 				ext_if_name);
+ 			ext_ip_addr[0] = '\0';
+ 		} else if (addr_is_reserved(&addr)) {
+-			if (!GETFLAG(ALLOWPRIVATEIPV4MASK)) {
++			if (GETFLAG(ALLOWPRIVATEIPV4MASK)) {
+ 				syslog(LOG_WARNING, "IGNORED : private/reserved address %s is not suitable for external IP", ext_ip_addr);
+ 			} else {
+ 				syslog(LOG_NOTICE, "private/reserved address %s is not suitable for external IP", ext_ip_addr);