I would also love to see this. It is a pain to switch inbound NAT between devices. My Xbox and PC both use 3074 when gaming. I hate having to go in a switch the mapping.

Maybe you could implement an allowed host list and even a list of allowed port for each allowed host. This way I could allow my xbox to open/map 3074 when needed or have my PC do it when needed

the idea of allowing something on the network to punch holes in the firewall without the network admin's knowledge is a bad idea in the extreme.

One thing I've noticed is that uPNP Broadcasts don't work through a bridged interface pair.

Well, then make it an option that is disabled by default.

Ack no! uPNP = security problem. In theory trojans could open ports from the inside of the network then!

I realize that this is a security issue with adding uPNP, but would be extremely nice to identify needed rules. Maybe the rules added by uPNP can be added to the packet filter/NAT with a yellow flag requiring the admin to authorize them before they are enabled.