EMZETT.UPnP: Automatic port forwards and their risks
In short: A method with which programs in the home network ask the router on their own to open ports to the internet.
In more detail: Whoever wants to host a game or use a console with online functions often needs incoming connections from the internet. Normally you must set up a port forward in the router for that. UPnP (Universal Plug and Play, more precisely the IGD function) automates this: the program requests the forward itself and the router sets it up.
In Depth
Flow
- The device finds the router by multicast (SSDP, UDP 1900).
- It sends a request such as “Forward external port 25565 TCP to me (192.168.1.20:25565)”.
- The router creates the rule and returns the external address. Alternative methods with the same goal are NAT-PMP and PCP.
Why it is convenient
Users do not have to understand anything about ports and forwards. Games, video conferencing, peer-to-peer programs and media servers work “just like that”.
Why it is risky
Every device in the home network may open holes in the firewall without a password. Malware on a computer or IoT device can thereby expose services to the outside without users noticing. There have repeatedly been vulnerabilities in routers’ UPnP implementations that were even reachable from the internet. That is why many experts advise switching UPnP off.
Recommendation
Look in the router menu at which UPnP forwards are active and delete unknown entries. It is better to forward only the really necessary ports by hand and give the device a fixed IP address. For games, NAT type “open” through a fixed forward is often enough. Behind CGNAT UPnP does not help, since the forward only reaches the provider’s router.