weird thing is uPNP port forwards seemed to be transmitted upstream to the parent double-NAT'ed router too (!)