upnp entries go on top of FORWARD chain.....
|Reported by:||frater||Owned by:|
uPnP entries insert themselves at the top of the FORWARD chain. That's understandable, because you need to make sure it doesn't come after a deny, but this also means each and every packages is checked. Those uPnP entries are typically made by p2p-programs and exactly these programs put an extra burden on your router.
Can't you create a seperate chain for uPnP-entries and call that chain just after the "ESTABLISHED RELATED". Once the connection is established and related the packages go through that entry and normal traffic will pass less rules.
-A FORWARD -j lan2wan -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -i br0 -o br0 -j ACCEPT -A FORWARD -j upnp