Hi Ramon,
I don't have an answer to your questions (I don't have an AP11D to test), but may I suggest that, instead of "punching holes" in your firewall, it would be much safer to use a VPN - using a Raspberry Pi (
PiVPN), or an old PC (
instructions for Ubuntu), you can get WireGuard up and running in under an hour.
UPnP opens the gate to your internal (LAN) devices, which are likely to have vulnerabilities not yet patched, so prone to being hijacked by black-hat hackers. In my opinion (
and not only), this protocol should be disabled.
------------------------------
Valentin Voica
------------------------------