Wait I think I see the problem.
upnp2 {
listen-on eth1
listen-on eth2
nat-pmp disable
secure-mode disable
wan eth0
}You need to "listen-on switch0" because you've bridged them together. I think.
But you still should considering enabling nat-pmp