What UPnP Is on Your Router, and What the Risks Are

A new console is plugged in, goes online, and is playing with friends straight away. A Wi-Fi camera is installed, and the phone app shows its picture from outside the house. Nobody touched the router settings.

What's quietly working behind that is usually UPnP. It's convenient, and most of the time causes no trouble. But how it works has one property worth understanding before deciding to leave it on.

How it works

Home routers use NAT: every device in the house shares one public address, and unsolicited connections from outside are refused by default. That's why a device that needs to receive connections from outside, such as a console hosting a match, needs a port opened. NAT itself is explained in what NAT and CGNAT are.

Opening a port manually means logging into the router and adding a port forwarding rule. UPnP (Universal Plug and Play) skips that step: a device on the network simply asks the router to open a given port for it, and the router grants it without question.

The key phrase is that last part. The router doesn't check who is asking or why.

Why it exists

Because without UPnP, plenty of things people expect to "just work" don't:

• Game consoles report Strict or Moderate NAT, can't host, and voice chat sometimes fails to connect.
• Calling and file-sharing apps fall back to slower relay paths.
• Some cameras and recorders can't be reached from outside without the manufacturer's cloud service.

Asking every household to write port forwarding rules isn't realistic. UPnP is the industry's answer to that, which is why most routers ship with it switched on.

Where the risk is

The problem isn't UPnP itself, it's who can use it. Every device on the network can ask for a port to be opened, including devices you don't fully trust:

• A device that's already compromised. Malware on a laptop or phone can ask the router to open a port so an intruder can come in from outside. You get no warning at all. Other signs are covered in signs your Wi-Fi has been compromised.
• Cheap smart devices. Cameras, doorbells, or recorders that open a port to the internet often carry a login page with a default password and firmware that's never updated. Opening a port puts them right in front of the automated scanners that sweep the internet every day. See Wi-Fi CCTV camera security and smart home device security.
• Ports that never close. UPnP openings are meant to be temporary, but many linger until the router restarts, and nobody reviews them.
• Old routers with UPnP flaws. Some routers have accepted UPnP requests from the internet side, not just from inside the home. Updated firmware closes holes like this; the reasons are in updating router firmware.

Should it be turned off?

The answer depends on what's in the house, not on a general rule:

For a network many people use, that last point isn't negotiable. Every guest phone on the same network can ask for a port to be opened. It's one reason guest Wi-Fi is always kept separate; how to do that is in a guest network on a home router and separating the guest network.

Seeing which ports are already open

Before switching anything off, look at what's happening. In the router's admin page, find a menu called UPnP, Port Mapping, or a section under NAT or Advanced. The list usually contains:

• A name or description sent by the requesting app.
• External and internal ports, plus the protocol (TCP or UDP).
• The IP address of the device that asked.

Match that address against the list of connected devices. A port opened by a game console is normal. A port opened by a device you don't recognise, or by a laptop that isn't running anything that needs it, deserves a closer look. Identifying devices is covered in finding out who's on your Wi-Fi, and common port numbers in ports and protocols worth knowing.

ISP-supplied routers don't always show this list. If the UPnP menu only has an on/off switch, assume you can't inspect it, and decide based on the table above.

The alternative: open only what's needed, by hand

If one device genuinely needs an open port, the more controlled approach is:

1. Give that device a fixed IP address via a DHCP reservation, so the rule doesn't miss when its address changes.
2. Open only the ports listed in the console's or app's official documentation, not wide ranges.
3. Turn UPnP off, then test again. Most consoles will show Open or Moderate NAT with correct manual rules.

The full steps are in port forwarding on your router. For gaming, how NAT affects latency is covered in high ping while gaming.

When UPnP is on but still doesn't work

A common complaint: UPnP is on, the port shows as open on the router, yet the console still says Strict and the camera still can't be reached from outside.

The most common cause in Indonesia is CGNAT. Many home plans don't give the customer's router a public address. Your router sits behind the provider's own NAT, and ports opened by UPnP stop at your home router and never reach the internet. No setting at home gets past it.

To confirm: compare the WAN address on the router's status page with the address an IP-checking site reports. If they differ, or the WAN address falls between 100.64 and 100.127, you're behind CGNAT. The options are asking the provider for a public IP, sometimes at extra cost, or using services that don't need an open port at all. The comparison for businesses is in static vs dynamic IP for business.

For some people, CGNAT actually makes UPnP less risky, since opened ports aren't visible from the internet. But that's luck, not protection: the moment the provider assigns a public IP, every port UPnP opened becomes genuinely open. Other router hardening steps are summarised in securing your home router.

Frequently asked questions