Code: function check_upnp(){ var wan0_upnp_enable = document.form.wan0_upnp_enable.value; var wans_dualwan_orig = document.form.wans_dualwan.value; if(wans_dualwan_orig.search(" ") == -1) var wans_flag = 0; else var wans_flag = (wans_dualwan_orig.search("none") == -1) ? 1:0; if (wans_flag == 1) var wan1_upnp_enable = document.form.wan1_upnp_enable.value; else var wan1_upnp_enable = 0; if(wan0_upnp_enable == 0 && wan1_upnp_enable == 0){ $('upnp_service').innerHTML = "Yes"; $('upnp_service').className = "status_yes"; } else{ $('upnp_service').innerHTML = "<a href='Advanced_WAN_Content.asp' target='_blank'>No</a>"; $('upnp_service').className = "status_no"; $('upnp_service').onmouseover = function(){overHint(13);} $('upnp_service').onmouseout = function(){nd();} } }

Code: <input type="radio" name="wan_upnp_enable" class="input" value="1" onclick="display_upnp_range();return change_common_radio(this, 'LANHostConfig', 'wan_upnp_enable', '1')" <% nvram_match("wan_upnp_enable", "1", "checked"); %>><#checkbox_Yes#> <input type="radio" name="wan_upnp_enable" class="input" value="0" onclick="display_upnp_range();return change_common_radio(this, 'LANHostConfig', 'wan_upnp_enable', '0')" <% nvram_match("wan_upnp_enable", "0", "checked"); %>><#checkbox_No#>

Error in the javascript on http://192.168.1.1/AiProtection_HomeProtection.asp Line 318: if(wan0_unpn_enable == 0 && wan1_unpn_enable == 0){should be:if(wan0_unpn_enable == 0 && wan1_upnp_enable == 0){Also looks like you might want to go back and change all instances of wan0_unpn_enable to wan0_upnp_enableEDIT: It appears that even though I've disabled UPnP, document.form.wan1_upnp_enable.value still returns 1. 'm assuming the server call isn't returning the correct value here, but I'll do some more testing, maybe look at the source code.EDIT2: The javascript must be set dynamically when it sees a change to UPnP toggle. When UPnP is turned on the javascript is correct.EDIT 3: line 867-868 of Advanced_WAN_Content.aspDo the nvram values set both wan0 and wan1? I couldn't find anywhere that changed the source code of the javascript, maybe I'm not looking hard enough.EDIT 4: dsl.c seems to imply that the setting was only pushed to the wan0's nvram.