Analyzing my changes made to my router via syslog

[chongu]

In short, I would like to know the changes that my security guy made to my AC68 router (while I was at work) so I can figure out what he did to make my ip cameras work again. As I would love to be able to reconfigure my router myself the next time I have to reflash.

My Sys log:

Sep 3 16:53:38 rc_service: ntp 673:notify_rc restart_upnp
Sep 3 16:53:38 rc_service: ntp 673:notify_rc restart_diskmon
Sep 3 16:53:38 rc_service: waiting "restart_upnp" via ntp ...
Sep 3 16:53:38 miniupnpd[670]: shutting down MiniUPnPd
Sep 3 16:53:38 miniupnpd[680]: HTTP listening on port 46757
Sep 3 16:53:38 miniupnpd[680]: Listening for NAT-PMP/PCP traffic on port 5351
Sep 3 16:53:39 disk monitor: be idle
Sep 3 16:53:43 pppd[585]: System time change detected.
Sep 3 16:53:57 crond[545]: time disparity of 2457173 minutes detected
Sep 3 16:54:25 HTTP login: login 'admin' successful from 192.168.1.103
Sep 3 16:54:37 rc_service: httpd 543:notify_rc restart_firewall
Sep 3 16:54:37 start_nat_rules: apply the nat_rules (/tmp/nat_rules_ppp0_eth0)!
Sep 3 16:54:37 start_nat_rules: (/tmp/nat_rules_ppp0_eth0) success!
Sep 3 17:02:49 dnsmasq-dhcp[537]: DHCPDISCOVER(br0) 44:33:4c:8b:29:28
Sep 3 17:02:49 dnsmasq-dhcp[537]: DHCPOFFER(br0) 192.168.1.94 44:33:4c:8b:29:28
Sep 3 17:02:49 dnsmasq-dhcp[537]: DHCPDISCOVER(br0) 44:33:4c:8b:29:28
Sep 3 17:02:49 dnsmasq-dhcp[537]: DHCPOFFER(br0) 192.168.1.94 44:33:4c:8b:29:28
Sep 3 17:02:50 dnsmasq-dhcp[537]: DHCPREQUEST(br0) 192.168.1.94 44:33:4c:8b:29:28
Sep 3 17:02:50 dnsmasq-dhcp[537]: DHCPACK(br0) 192.168.1.94 44:33:4c:8b:29:28
Sep 3 17:04:43 dnsmasq-dhcp[537]: DHCPREQUEST(br0) 192.168.1.236 5c:f8:a1:5a:9e:47
Sep 3 17:04:43 dnsmasq-dhcp[537]: DHCPACK(br0) 192.168.1.236 5c:f8:a1:5a:9e:47 android-188d6179f1a2b1dd
Sep 3 17:10:55 dnsmasq-dhcp[537]: DHCPREQUEST(br0) 192.168.1.17 64:a3:cb:79:09:8e
Sep 3 17:10:55 dnsmasq-dhcp[537]: DHCPACK(br0) 192.168.1.17 64:a3:cb:79:09:8e KiPhone2
Sep 3 17:11:48 kernel: br0: received packet on eth1 with own address as source address
Sep 3 17:11:55 dnsmasq-dhcp[537]: DHCPDISCOVER(br0) 94:94:26:5b:7d:8b
Sep 3 17:11:55 dnsmasq-dhcp[537]: DHCPOFFER(br0) 192.168.1.218 94:94:26:5b:7d:8b
Sep 3 17:11:56 dnsmasq-dhcp[537]: DHCPREQUEST(br0) 192.168.1.218 94:94:26:5b:7d:8b
Sep 3 17:11:56 dnsmasq-dhcp[537]: DHCPACK(br0) 192.168.1.218 94:94:26:5b:7d:8b J-iPad​

If not mistaken, did he turn on upnp? I could have sworn my upnp was on and firewall was off

Thanks in advance <3