I also have the USG, a 4 to be exact. And, your rule appears correct to me.
The USG doesn’t yet support configuration of UPNP via the guy so as @tmm1 suggested you can uncheck the remote access box after enabling your rule.
Alternatively, you can enable UPNP on the USG via the command line by writing the following to a file named config.gateway.json stored in the directory as outlined in this article for your controller OS.
{
“service”: {
“upnp2”: {
“listen-on”: [
“eth0”
],
“nat-pmp”: “enable”,
“secure-mode”: “enable”,
“wan”: “eth2”
}
}
}
**Note: If you have the USG2 then you may have to adjust eth0 / eth2 to match the hardware on the USG2
If you go this route then delete your rule and re-check the remote access box. This approach has the advantage of enabling UPNP for other applications in your environment as opposed to only Channels-DVR.