Your router’s firewall does a pretty decent job at dropping unsolicited inbound traffic, and most people never have to think about it. Even fewer people ever think about UPnP, which is a setting almost every consumer router has that lets any device on the network punch a hole through that protection without telling anyone.
My ISP puts me behind carrier-grade NAT, which doesn’t allow for the wider internet to reach my IPv4 network directly, but UPnP can still punch holes through IPv6 if it’s enabled. My fix was to disable that instead of UPnP, but if you don’t have that option, and you don’t trust all the devices on your network, disabling UPnP itself is probably the right move.
Related
Stop trusting your ISP’s router blindly
Several grave dangers lurk
UPnP doesn’t ask who’s knocking at the door
It’s a discovery protocol, not a security one
UPnP, or Universal Plug and Play, sounds like something you’d want enabled, at least on the surface. It’s a family of discovery protocols that lets apps or devices on your network ask the router to forward an external port to it. This isn’t a problem on its own, but the router doesn’t bother to check whether the request is legitimate before doing so, and that’s the problem. There’s no password or prompt, and no confirmation sent anywhere. If the request comes from inside of your network, it gets honored.
You can see this for yourself if you have a Linux machine and a router where UPnP is enabled: the miniupnpc package includes a tool called upnpc. Running upnpc -l lists every mapping your router currently holds, along with the external address the router reports. Running upnpc -r 8080 TCP as an ordinary user, with no sudo, asks the router to forward port 8080 to your machine.
The craziest part is, the firewall never stopped functioning, and as far as it’s concerned, everything is peachy. Its default-deny behavior is still there, but UPnP layers exceptions on top of it, so your protection is really only as good as the least-careful app or device on the network.
In practice, the apps involved are pretty mundane. It can be something as simple as NetBird, which is the secure-access platform I use for my home lab. It recently added a NAT mapper that looks for UPnP gateways and signals the forwarded port to other peers. Even something like Jellyfin can punch a hole with its UPnP-initiated port forwarding.
Related
How I used VLANs to separate my smart home devices — and why you should too
Why I now always use VLANs to separate smart home devices.
Every device can use UPnP
Even the sketchy ones
The only true requirement to use UPnP is having a local IP address, so that means basically any device can use UPnP, including smart TVs and small IoT devices. Again, in a perfect world, this isn’t a problem, but it becomes one if any of those devices becomes compromised. If that happens, that device can forward a port to itself or another machine on your network, and now it’s open to the internet.
This kind of vulnerability has been exploited at scale as well: in 2018, Akamai reported that attackers had compromised 65,000 home routers through UPnP flaws, a campaign it tracked as UPnProxy. A follow-up campaign, which Akamai dubbed EternalSilence, used injected mappings to expose TCP ports 139 and 445 on devices sitting behind the router, the ports Windows file sharing uses.
These attacks relied on buggy routers that answered UPnP request from the internet side, which is obviously a huge oversight by the vendor and not the same kind of attack that would happen on a known-good firmware. However, it does show what an unauthenticated port-mapping service is capable of once the wrong party can take advantage of it.
Related
6 overlooked router settings that can improve your network security
You can make your home network much more secure with a few changes.
There is a case for leaving it on
There are scenarios where it makes sense
UPnP exists in part because NAT broke peer-to-peer networking. If you turn it off, consoles that rely on P2P for game lobbies will fail, and voice chat can follow suit. Mesh VPNs like Tailscale and NetBird can also be affected if you were to turn it off. In the case of Tailscale, there’s a UPnP fallback that makes a direct connection more likely instead of needing to fall back to a DERP relay, which can add latency.
There’s also a case to be made that UPnP isn’t the real threat, because if you already have malicious code running on your network, an open port is the least of your problems. Router vendors will commonly ship their units with UPnP enabled because it lowers stress on customer support. You’d be surprised at how much can break when UPnP gets turned off.
Related
4 reasons you should disable NAT-PMP on your router right now
This Apple-centric alternative to UPnP is no longer necessary.
Why I’d still turn it off
It’s a needless risk for most
A lot of that assumes that your LAN is entirely made up of totally secure, trustworthy devices, which isn’t necessarily true. In reality it’s a mix of devices from vendors with wildly different security track records, and with UPnP on, you’re trusting that they’ve secured their devices properly.
If you’re behind CGNAT like I am, none of this really applies to you, at least on IPv4. The ports opened by UPnP on my router will sit behind my ISP’s NAT and won’t be reachable from the open internet, and that’s just due to how CGNAT works. But if UPnP is left on and your ISP gives you a public IPv6, it’s possible that UPnP can poke holes in the IPv6 firewall, and the same kind of security risk applies to that address space. This is what happened to me—I thought that having UPnP on was only going to affect IPv4 devices, but it opened a bunch of doors for devices on my network that spoke IPv6. Instead of turning off UPnP, though, I just turned off IPv6 at the router level.
Related
4 reasons you should consider disabling UPnP in your router
You probably don’t need it anymore, and it’s a security nightmare.
Go look at your UPnP table
If you open your router’s admin page and open the UPnP settings, you can take a look and see if anything has punched a hole through your router’s firewall. I’d recommend turning it off and trying to live with it for a couple of weeks. If anything breaks, you can forward that port manually and move on.