RT-AC68U inbound firewall rules

[BRW]

Background: I have an Asus RT-AC68U router running the stock Asus firmware (currently version 3.0.0.4.386_51729). I have two IP cameras which I have set up for WAN access via DDNS and port forwarding (I'm aware of the negative security implications of port forwarding, but so be it). This setup has worked flawlessly for years--I can view the cameras' livestream feeds, manage the cameras, etc. from anywhere. However, about 2-3 months ago I lost WAN access to the cameras, although they still work fine via my LAN. Moreover, I can't even ping my WAN IP address, which suggests to me that the router is blocking all inbound traffic.

Questions:

1. Does the RT-AC68U router have some sort of global setting that blocks all inbound traffic? Conceivably I may have inadvertently turned that setting on, although I have no recollection of making any changes to the router's setup for a long time.
2. Is it possible to do a detailed inspection of the router's inbound firewall rules (e.g. can I dump iptables)?
3. Is it possible to reset the router's inbound firewall rules without affecting the router's other settings (except any port forwarding rules)? This would enable me to start over with a clean slate.

[Aureliannn_ASUS]

Hi @BRW ,

Thank you for your inquiry. 

To better understand the connection issue you are experiencing, please provide us with the following information:

1. ISP restriction: Have you confirmed with your Internet Service Provider (ISP) whether they have restricted inbound connections?
2. Firmware version issue: Does this issue occur on a specific firmware version? What is your current firmware version?
3. Port forwarding settings: Have you carefully checked that your port forwarding settings are correct?
4. Router reset: If you perform a hard reset on the router and reconfigure it, can the problem be resolved? [Wireless Router] When Standard Reset Isn’t Working: Hard Factory Reset - Models list | Official Sup...

Please kindly confirm the above information. Thank you.

[BRW]

I think I may have figured it out: without prior notice, my ISP has switched me to CG-NAT, so the solution will involve convincing the ISP to put me back on a plan that will give me a direct public IP address--which may require me to spend $$$ or find another ISP.