Mappings should be bidirectional
Created by: zrm
Mappings created by miniupnpd add a DNAT rule but no SNAT rule.
The SNAT rule is needed so that an application relying on the mapping to avoid need for keepalives doesn't have an outgoing packet translated to some wrong external port, especially with UDP.
Bidirectional mappings are required by the NAT-PMP and PCP RFCs, see e.g. RFC6886 Section 3.9.
Adding the SNAT rule is unfortunately not a comprehensive solution. The SNAT rule prevents connection tracking conflicts from being resolved by translating the external port used by the mapping. Outgoing packets would be dropped and incoming packets would be sent to the wrong internal address/port. So it is also necessary to prevent traffic from any other internal address/port from being translated to the external port of a mapping.