UPnP automatic port mapping

UPnP is a helpful house guest: it moves the furniture so your game can get in, and it never asks first. Handy, until a less friendly guest learns the same trick.

The short answer

UPnP (Universal Plug and Play) lets devices on a home network find each other and set things up automatically. Its Internet Gateway Device profile (IGD) lets a program on your network ask the router to open a port, so that connections from the internet reach that program [3][5]. That saves you from manual port forwarding. The protocol is designed for a trusted LAN and has no authentication [5]. Our assessment: use UPnP where convenience matters and the devices are yours. For a server that stays on, a fixed port forward is easier to audit.

How it works

1. The profile. In the IGD profile the router offers a WANIPConnection service. Through it a client creates a mapping between an external port and an internal address and port, for TCP or UDP, optionally limited to one remote host [3].
2. The actions. AddPortMapping creates one mapping. Since release 2.0 the specification recommends AddAnyPortMapping, which lets the router pick an alternative if the port is taken. DeletePortMapping removes one [3]. Mappings can also come from other mechanisms, so conflicts are possible, and error 729 lets the router refuse [3].
3. Versions. The OCF deprecated the IGD V1.0 device types on 30 Mar 2015. IGD V2.0 is required for UPnP+ certification and adds security features such as a DeviceProtection service and IPv6 support [1]. IGD:2 is also published as ISO/IEC 29341-24-1 [2]. CERT/CC notes that the Device Protection service was not widely adopted [5].
4. PCP as the sibling. The Port Control Protocol does a similar job. RFC 6970 describes an interworking function for home routers that speak UPnP IGD on the LAN side and PCP towards the provider [4].
5. The security catch. CERT/CC states that UPnP is designed for a trusted LAN and implements no form of authentication or verification [5]. AVM warns that malware on a device could also open ports and so bypass the router's firewall, and recommends a firewall on the device [8].
6. Past vulnerabilities. In 2020 CERT/CC and CISA reported CVE-2020-12695 ("CallStranger"), where the UPnP SUBSCRIBE function could be abused to send traffic to arbitrary destinations. Versions before 17 Apr 2020 are affected, and the OCF updated the specification [5][6]. In 2013, after vulnerabilities in the libupnp software development kit, US-CERT advised disabling UPnP where possible and restricting SSDP (1900/udp) and SOAP access from untrusted networks [7]. CERT/CC calls UPnP offered on the internet side generally a misconfiguration [5].
7. A per-device opt-in. In AVM's FRITZ!Box the firewall blocks all incoming connections by default. You allow automatic port sharing per device, the application needs UPnP IGD or PCP, and the ports stay open only while the application needs them [8].

A practical example

You host a small game server on a PC at home. Option A: tick the automatic port sharing for that PC in the router and let the server software use UPnP. Option B: forward the server's port to the PC's fixed address by hand. Option B means one visible rule you can read and remove. Option A means any program on that PC can open ports. If your application supports neither UPnP nor PCP, AVM suggests static port sharing [8]. Our inventory (as of 14 to 16 Oct 2026) lists a UniFi router and firewall; its UPnP setting is not recorded, so we say nothing about it here.

Checklist

• Check whether UPnP is on in your router, and write it down.
• Turn it off if no device you own needs it [5][7].
• If you keep it, allow it per device where the router supports that [8].
• Look at the router's list of open ports from time to time [8].
• Prefer a fixed port forward for servers that run all day.
• Install router updates; vendors were urged to implement the corrected specification [5][6].
• Never expose UPnP on the internet-facing side [5].