4 ms·
There are 2 parts to UPnP. One is service discovery, in cooperation with zeroconf (aka bonjour/mDNS). This is handled 100% by devices themselves. The other is
by kalleboo 6y ago
There are 2 parts to UPnP.
One is service discovery, in cooperation with zeroconf (aka bonjour/mDNS). This is handled 100% by devices themselves.
The other is the port forwarding protocol, where devices can ask your router to open a port in the NAT to the wide internet forwarded to them. This is done in the router. It's also a potential massive security hole.
If you disable UPnP on your router, you only disable the second thing. The first thing keeps working.
- ryandrake 6y agoThe service discovery isn't really the security hole though, is it? I mean I have mDNS configured on my LAN. It's the port forwarding, and specifically, configuring it so that any rando device on the network can set up port forwarding, which is the security problem. If you really want the dubious convenience of UPnP port forwarding, at least limit it to the one or two devices on your LAN that need it.
- kalleboo 6y agoRight, service discovery is fine. It's just that two things with wildly different security profiles get referred to with the same name
- daniellarusso 6y agoNo, mDNS it is not really the issue. Even most VPNs won’t, by default, allow mDNS packets across, without adding a relay server and some additional configuration. But, yeah, letting any application basically go into ‘server’ mode on your home network at-will is not the most secure setup.
- LeanderK 6y agothanks, yeah i was only thinking about service discovery