

Hmm. Is the upstream AP some kind of fancy deal or a run of the mill consumer router?
I’ve seen some Cisco APs configured to not allow multiple MAC addresses from the same station. Caused problems when trying to do VMs on my laptop that had the network in bridge mode.
Are you able to put your phone into hotspot, connect to that instead of the upstream AP, and see if it works?
I’ve always thought the firewall color codes were arbitrary, though I might just have not paid attention all these years lol.
Just to clarify: I meant connect your OpenWRT device to your hotspot instead of the AP you’ve been working with. Just to rule out multiple MACs being blocked on the AP.
Beyond that, I’m not really able to help troubleshoot further, but worst case and if all you need is internet, you can set your OpenWRT device up so that it just NATs your downstream connections. Double-NAT, in most cases, is fine.