What is UPnP, and should you turn it off?

UPnP, short for Universal Plug and Play, is a group of networking protocols that lets devices on a local network discover each other and use each other’s services without any manual setup. The part most people meet is on the router: a setting labeled UPnP that lets any device on your network ask the router to open a port from the internet to itself, automatically and without a password. That one feature makes game consoles and some older cameras work out of the box, and it is also why security guides, including the IoT device security basics on this site, usually recommend switching it off. This article explains what UPnP does, how the automatic port forwarding works, why it matters for smart home and IoT devices, and what changes when you turn it off. The IoT security hub has the rest of the guides on securing connected devices.

What UPnP is

UPnP was developed by an industry group, the UPnP Forum, from 1999 onwards, with the aim of making networked devices as easy to connect as a USB peripheral: plug it in and it works. In 2016 the forum’s specifications passed to the Open Connectivity Foundation, which maintains them now.

The protocols cover four jobs:

• Discovery. A device announces itself, or searches for others, using the Simple Service Discovery Protocol (SSDP). SSDP messages are sent over UDP to the multicast address 239.255.255.250 on port 1900, so every UPnP device on the local network hears them.
• Description. Each device publishes an XML document, fetched over HTTP, listing what it is and which services it offers.
• Control. Other devices call those services with SOAP messages, which are XML sent over HTTP.
• Eventing. A device can subscribe to another’s state changes and be notified when they happen.

None of this involves a username or a password. UPnP was designed on the assumption that everything on the local network is trusted. That assumption is the root of every security problem described below.

UPnP turns up in more places than the router. Media streaming between a network drive and a smart TV usually runs over DLNA, which is built on UPnP’s discovery and description. Printers, speakers and media players announce themselves with SSDP. Those uses stay inside the home network, and the router’s UPnP switch does not normally affect them.

The part that matters: automatic port forwarding

Home routers use network address translation (NAT). Every device inside shares one public address, and the router lets in only the replies to connections that inside devices started. A device that needs to accept a connection started from the internet, such as a game console hosting a match or a camera serving a live view, needs a port forward: a rule that sends traffic arriving on a given public port to a given device.

UPnP includes a service for exactly that, the Internet Gateway Device protocol (IGD). A router that supports it advertises the service on the local network, and any device can call it to add a port mapping: “send traffic for public port 8080 to me, port 80”. The router opens the port and the device is reachable from the internet. Nobody is asked, and on most routers nothing is shown unless you go looking.

Mappings can be permanent or carry a lease time, and well-behaved software removes its mapping when it is done. Plenty does not, so a router that has had UPnP on for a few years often holds mappings for devices that are long gone.

Why UPnP is a risk on a network with IoT devices

The protocol does what it was designed to do. The problem is who gets to use it.

Any device can expose itself. A camera, a video recorder or a network drive that opens a port for “remote access” puts its own login page on the internet. If that device still has its default password or runs old firmware, it can now be found by the automated scanners that sweep the internet looking for exactly that. The owner never chose to publish it and often does not know it happened.

Malware can use it too. UPnP cannot tell a legitimate request from a malicious one. Software running on any compromised device inside the network, a laptop or a cheap smart plug, can ask the router to open a port back to itself, which gives an attacker a way in that bypasses the router’s normal protection.

Some routers answer from the wrong side. UPnP is meant to be reachable only from the local network. Security researchers have repeatedly found routers whose UPnP services also answer requests arriving from the internet, which lets anyone outside add port mappings or read the router’s details. That is a bug in the router, and the only fix is a firmware update or switching the feature off.

Discovery has been abused for attacks on others. SSDP answers a small request with a larger reply, and on UDP the sender’s address can be forged. Devices that expose SSDP to the internet have been used to amplify denial-of-service floods against third parties, which is why the US cybersecurity agency lists SSDP among the UDP amplification vectors it warns about. In 2020 a further flaw in UPnP’s eventing, named CallStranger and recorded as CVE-2020-12695, showed that the subscription mechanism could be misused to send data or traffic to an address of the attacker’s choosing.

None of these needs a sophisticated attacker, and they sit alongside the other common IoT vulnerabilities. They rely on devices that are never looked at again once they work, which describes most of the connected devices in a typical home.

What stops working if you turn UPnP off

Switching UPnP off on the router removes the automatic port-mapping service. Local discovery between devices usually carries on as before. In practice the changes are smaller than people fear.

Most modern smart home devices, including cloud-connected cameras, doorbells, speakers and plugs, connect outward to their maker’s servers and keep that connection open, so the router lets the traffic back in without any port forward. They work the same with UPnP on or off.

The things that may change:

• Game consoles may report a stricter NAT type, which can affect hosting matches and voice chat with some players. A manual port forward to the console, using the ports the console maker publishes, restores it.
• Older cameras and network video recorders that offer direct remote viewing by opening a port will stop being reachable from outside. That is usually the point. Use the maker’s cloud app if it has one, or a VPN into the home network.
• Self-hosted services such as a media server reached from outside the home need a manual forward or, better, a VPN.

How to check what UPnP has already opened

Before switching it off, look at what it has done. Most routers list current UPnP port mappings on the same page as the setting, often under advanced, NAT or port forwarding. Each entry shows a public port, the internal address it points to and usually a description written by the device that asked for it.

Work through the list. Match each internal address to a device using the router’s list of connected clients. Anything you do not recognize, any camera or recorder, and any mapping to a device you no longer own deserves attention. Switching UPnP off and restarting the router clears the dynamic mappings on many models; check the list again afterward.

While you are on the router, update its firmware. Several of the UPnP flaws found over the years were fixed by updates that many routers never received because nobody installed them.

Safer ways to get the same result

Manual port forwarding. If one device genuinely needs incoming connections, add a single forward for that device and those ports by hand. It is visible, deliberate and only covers what you chose. Give the device a fixed address in the router’s DHCP settings so the forward keeps pointing at it.

A VPN for remote access. To reach a camera, a recorder or a home controller from outside, connect to the home network through a VPN rather than exposing each device. Many routers include a VPN server, and the local-only smart home guide covers remote access without opening ports to every device.

Keep IoT devices on their own network. Putting smart devices on a separate VLAN with firewall rules limits what a misbehaving device can reach. If the router allows it, stop the IoT network from reaching the router’s UPnP service at all, so even with UPnP on for a console on the main network, the camera on the IoT network cannot open ports.

Newer port-control protocols. NAT-PMP (RFC 6886) and its successor, the Port Control Protocol (RFC 6887), do the same job as UPnP IGD with a simpler design. They still let devices open ports without asking you, so the same judgment applies: on if something needs it, off otherwise.

Should you turn UPnP off?

On a network that holds smart home or other IoT devices, the usual answer is yes. The devices most likely to use UPnP to expose themselves are the ones least likely to be kept up to date, and the convenience it offers is needed by few of them today. Turn it off, note anything that complains, and give that one device a manual forward or a VPN instead.

If a household has a games console that struggles without it, a middle path is to leave UPnP on only for the main network and keep the cameras, plugs and sensors on a separate IoT network that cannot use it. Whatever you choose, review the router’s port-forward and UPnP lists now and then, and keep the router’s firmware current. For the other habits that keep connected devices safe, start with the IoT device security basics and the rest of the IoT security guides.