Recently found out that mDNS uses 5353 in the Multicast network subnet space, so...
Added some FW rules for:
224.0.0.0/4
ff00::/8
- and -
The appropriate LAN networks, IMPORTANT --> Ahead of the custom 5353 redirection to a local DNS+ stack...
Voila, UPnP works as expected - and yes you must follow guides and create the Outbound NAT rules and IP/subnet set for the devices you want UPnP to use and the ranges set in the UPnP settings.
Hope this helps someone out that has been wondering why UPnP/Multicast/Broadcast hasn't been working and they might have had some extra rules in the mix they didn't realize/remember would be a conflict.
AFAICT the proper way of doing this is installing os-mdns-repeater and enabling it on required interfaces.
Firewall rules you make redirecting 5353 to local DNS Crypt and otherwise would get in the way
So, making rules that allow Broadcast/Multicast to pass ensure the forwarding don't get in the way ^_^