UPnP with EdgeRouter: Don't do it! Ubiquiti. ER-4.

upnper4dont.md

Want to configure UPnP on EdgeRouter-4?

Don't do it!

Introduction

As a former sysadmin that once helped ride herd over around 1,000 servers, of which around 10% were Internet-facing, I've never been a fan of autoconfiguation when it comes to punching holes through the firewall. I've seen the tripwire logs, and it's sobering.

The Problem

So enabling UPnP on my EdgeRouter-4 wasn't something I had on the roadmap, but when I ran into difficulty getting DLNA to work on the default VLAN, I thought it was worth looking into (never mind that, as I later learned, having UPnP turned on wasn't going make a bit of difference on my local network: another reason that mastering theory should always come before practice).

Documentation

I was surprised that there wasn't a clearly written, up-to-date, guide among the official doc on ui.com, thus requiring me (and every other user) to wade into the Internet swamp of bad advice for answers.

I did eventually consult the official EdgeOS User Guide, but as usual the info there was woefully incomplete: basically content to provide a walk through of the router's UPnP Wizard, without ever mentioning EdgeOS's support for the newer (and preferred) UPnP2 protocol that cannot be enabled with the wizard.

These are the most useful articles from the UI Community that I found:

UPnP vs UPnP2: What's the difference?

upnp2 documentation

Enable upnp2 on Edgemax lite

Procedure

This is the basic procedure to follow for enabling UPnP2 on an EdgeRouter. The example commands below assume the EdgeRouter-4 defaults where eth0 is the WAN port, and eth1 is for the LAN.

1. If you have already set up upnp with the wizard, get onto the router and delete that first:

$ configure
# delete service upnp
# commit
# save
# exit

2. Now enable and configure UPnP2 for the default LAN:

$ configure
# set service upnp2 listen-on eth1
# set service upnp2 wan eth0
# set service upnp2 secure-mode enable
# set service upnp2 nat-pmp enable
# commit
# save
# exit

If you have multiple LAN (or VLAN) interfaces, you can add them using additional listen-on commands.

3. Confirm all the things with:

$ show upnp2 rules

4. Read these articles and think again about whether it might be better to disable UPnP2 (and UPnP) altogether:

Dan Goodin. "UPnP flaw exposes millions of network devices to attacks over the Internet". Ars Technica, 11 June 2020.

Jenny List. "UPnP, Vulnerability as a Feature that just won't die". Hackaday, 14 January 2019.

5. If you decide, as I did, that the risks associated with UPnP significantly outweigh the benefits, then you can easily disable it by deleting:

$ configure
# delete service upnp2
# commit
# save
# exit

Tnx this helped me to Fix (none) working UPnP on my Edgerouter X SFP!

Thank you! This is what worked for me on an EdgeRouter X (non-SFP) that had been set up with the WAN+2LAN2 wizard (all the ports are on switch0) and was using PPPoE via a modem to connect to the internet. The UI forums are a hot garbage mess of threads and guessing.

    upnp2 {
        listen-on switch0
        nat-pmp enable
        secure-mode enable
        wan pppoe0
    }

show upnp2 rules 
Firewall pin holes
 pkts bytes target     prot opt in     out     source               destination         
   12  1644 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.243        udp dpt:3074

NAT port forwards
 pkts bytes target     prot opt in     out     source               destination         
    1   137 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:3074 to:192.168.1.243:3074
 pkts bytes target     prot opt in     out     source               destination

Thanks a lot for this write up. I recently bought a Chromecast (third generation) and apparently UPNP isn't needed to use the device at all. So I just turned it off. Can still cast from mobile to TV without problems. Not sure why everyone on the internet says Chromecast relies on it.

Glad you found it useful. Why do the Interwebs say Chromecast needs UPnP? Pretty sure it's because of the bang-up job the UPnP Forum did in propagandizing the indispensability of UPnP back a decade and a half ago. Google hasn't helped with their less than illuminating documentation for the product. UPnP, like the now defunct DLNA, has its uses, but in my experience can be more a hindrance than a help.

me on an EdgeRouter X (non-SFP) that had been set up with the WAN+2LAN2 wizard (all the ports are on switch0) and was using PPPoE via a modem to connect to the internet. The UI forums are a hot garbage mess of threads and guessing.

Having given up on this multiple times I think that: wan pppoe0 was the key for me! Thanks @aioue!

Is there anyway to enable this on EdgeOS in bridge mode? where eth0 is wan and the rest of the ports are bridged ?

Nevermind....change to br0 works, sorry!

Ha! Good to hear.I'm not a network pro, but a rank amateur at this stuff. It seems that in the world of low-powered SOHO devices like the ER-4, there's always a better way. Like this article: https://heald.ca/dont-use-bridge-mode-edgerouter-use-switch/. As the ER-4 continues in short supply, and almost double its MSRP, I'm now considering a number of mulit-port solid fanless mini/micro PCs that can run pfSense as cost competitive (like these, https://www.servethehome.com/cheap-intel-pentium-n6005-4x-2-5gbe-fanless-firewall-and-router-review/).

Probably. I'm not an Edge OS expert by any means. This would be a good question for the Ubiquiti Community or r/ubiquiti subreddit.

Thank you for this article. I have been struggling with the memory leak on my Edgerouter X for half a year. The memory just got to ~13% free each night and the router became pingable but unresponsive. After disabling UPnP in favor of UPnP2 the memory leak was instantly gone.

Sorry. I'm afraid that's way beyond my competence. I recommend you ask this question on the UI Community forum, https://community.ui.com/.

I've replaced the default OS with OpenWRT now and never looked back. Much better feature set and constantly updated.

It might surprise some, but I'd much rather be running something simpler and cheaper like the TP-Link TL-R605, whose hardware is adequate for 1 Gb/s and does 802.1Q VLANS, which is all I really need outside the lab.

I've replaced the default OS with OpenWRT now and never looked back. Much better feature set and constantly updated.

do you have a link to guides or documentation on that? I don't plan to do it atm but it's an interesting option

Thank you! This is what worked for me on an EdgeRouter X (non-SFP) that had been set up with the WAN+2LAN2 wizard (all the ports are on switch0) and was using PPPoE via a modem to connect to the internet. The UI forums are a hot garbage mess of threads and guessing.

    upnp2 {
        listen-on switch0
        nat-pmp enable
        secure-mode enable
        wan pppoe0
    }

show upnp2 rules 
Firewall pin holes
 pkts bytes target     prot opt in     out     source               destination         
   12  1644 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.243        udp dpt:3074

NAT port forwards
 pkts bytes target     prot opt in     out     source               destination         
    1   137 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:3074 to:192.168.1.243:3074
 pkts bytes target     prot opt in     out     source               destination

Hi! how do you implement this?
I have the same as you ppoe and switch0.
I wish I could jump to openwrt same as you but my router is the 10x and I can't.

Nevermind I'll do it step by step like this:

$ configure
# set service upnp2 listen-on switch0
# set service upnp2 wan pppoe0
# set service upnp2 secure-mode enable
# set service upnp2 nat-pmp enable
# commit
# save
# exit