diff --git a/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc b/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc
index 411c57f66b..fa546ce529 100644
--- a/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc
+++ b/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc
@@ -191,7 +191,8 @@ function miniupnpd_configure_do($verbose = false)
                 $config_text .= "bitrate_up={$upload}\n";
             }
 
-            $config_text .= "secure_mode=yes\n";
+            /* set secure mode, checkbox in ui is for disabling rather than enabling */
+            $config_text .= "secure_mode=" . (empty($upnp_config['secure_mode']) ? "yes" : "no") . "\n";
 
             /* enable logging of packets handled by miniupnpd rules */
             if (!empty($upnp_config['logpackets'])) {
diff --git a/net/upnp/src/www/services_upnp.php b/net/upnp/src/www/services_upnp.php
index 5ca0754f16..3f19d7e048 100644
--- a/net/upnp/src/www/services_upnp.php
+++ b/net/upnp/src/www/services_upnp.php
@@ -79,6 +79,7 @@ function miniupnpd_validate_port($port)
         'overridesubnet',
         'overridewanip',
         'permdefault',
+        'secure_mode',
         'stun_host',
         'stun_port',
         'sysuptime',
@@ -168,7 +169,7 @@ function miniupnpd_validate_port($port)
         // save form data
         $upnp = [];
         // boolean types
-        foreach (['enable', 'enable_upnp', 'enable_natpmp', 'logpackets', 'sysuptime', 'permdefault'] as $fieldname) {
+        foreach (['enable', 'enable_upnp', 'enable_natpmp', 'logpackets', 'sysuptime', 'permdefault', 'secure_mode'] as $fieldname) {
             $upnp[$fieldname] = !empty($pconfig[$fieldname]);
         }
         // text field types
@@ -364,6 +365,15 @@ function miniupnpd_validate_port($port)
                        </div>
                       </td>
                     </tr>
+                    <tr>
+                      <td><a id="help_for_secure_mode" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Disable secure mode");?></td>
+                      <td>
+                       <input name="secure_mode" type="checkbox" value="yes" <?=!empty($pconfig['secure_mode']) ? "checked=\"checked\"" : ""; ?> />
+                       <div class="hidden" data-for="help_for_secure_mode">
+                         <?=gettext("Secure mode means that a UPnP client can only add port mappings to its own IP address.");?>
+                       </div>
+                      </td>
+                    </tr>
                   </tbody>
                 </table>
               </div>