UPnP with EdgeRouter: Don't do it! Ubiquiti. ER-4.

upnper4dont.md

Want to configure UPnP on EdgeRouter-4?

Don't do it!

Introduction

As a former sysadmin that once helped ride herd over around 1,000 servers, of which around 10% were Internet-facing, I've never been a fan of autoconfiguation when it comes to punching holes through the firewall. I've seen the tripwire logs, and it's sobering.

The Problem

So enabling UPnP on my EdgeRouter-4 wasn't something I had on the roadmap, but when I ran into difficulty getting DLNA to work on the default VLAN, I thought it was worth looking into (never mind that, as I later learned, having UPnP turned on wasn't going make a bit of difference on my local network: another reason that mastering theory should always come before practice).

Documentation

I was surprised that there wasn't a clearly written, up-to-date, guide among the official doc on ui.com, thus requiring me (and every other user) to wade into the Internet swamp of bad advice for answers.

I did eventually consult the official EdgeOS User Guide, but as usual the info there was woefully incomplete: basically content to provide a walk through of the router's UPnP Wizard, without ever mentioning EdgeOS's support for the newer (and preferred) UPnP2 protocol that cannot be enabled with the wizard.

These are the most useful articles from the UI Community that I found:

UPnP vs UPnP2: What's the difference?

upnp2 documentation

Enable upnp2 on Edgemax lite

Procedure

This is the basic procedure to follow for enabling UPnP2 on an EdgeRouter. The example commands below assume the EdgeRouter-4 defaults where eth0 is the WAN port, and eth1 is for the LAN.

1. If you have already set up upnp with the wizard, get onto the router and delete that first:

$ configure
# delete service upnp
# commit
# save
# exit

2. Now enable and configure UPnP2 for the default LAN:

$ configure
# set service upnp2 listen-on eth1
# set service upnp2 wan eth0
# set service upnp2 secure-mode enable
# set service upnp2 nat-pmp enable
# commit
# save
# exit

If you have multiple LAN (or VLAN) interfaces, you can add them using additional listen-on commands.

3. Confirm all the things with:

$ show upnp2 rules

4. Read these articles and think again about whether it might be better to disable UPnP2 (and UPnP) altogether:

Dan Goodin. "UPnP flaw exposes millions of network devices to attacks over the Internet". Ars Technica, 11 June 2020.

Jenny List. "UPnP, Vulnerability as a Feature that just won't die". Hackaday, 14 January 2019.

5. If you decide, as I did, that the risks associated with UPnP significantly outweigh the benefits, then you can easily disable it by deleting:

$ configure
# delete service upnp2
# commit
# save
# exit

Probably. I'm not an Edge OS expert by any means. This would be a good question for the Ubiquiti Community or r/ubiquiti subreddit.

Thank you for this article. I have been struggling with the memory leak on my Edgerouter X for half a year. The memory just got to ~13% free each night and the router became pingable but unresponsive. After disabling UPnP in favor of UPnP2 the memory leak was instantly gone.

Sorry. I'm afraid that's way beyond my competence. I recommend you ask this question on the UI Community forum, https://community.ui.com/.

I've replaced the default OS with OpenWRT now and never looked back. Much better feature set and constantly updated.

It might surprise some, but I'd much rather be running something simpler and cheaper like the TP-Link TL-R605, whose hardware is adequate for 1 Gb/s and does 802.1Q VLANS, which is all I really need outside the lab.

I've replaced the default OS with OpenWRT now and never looked back. Much better feature set and constantly updated.

do you have a link to guides or documentation on that? I don't plan to do it atm but it's an interesting option

Thank you! This is what worked for me on an EdgeRouter X (non-SFP) that had been set up with the WAN+2LAN2 wizard (all the ports are on switch0) and was using PPPoE via a modem to connect to the internet. The UI forums are a hot garbage mess of threads and guessing.

    upnp2 {
        listen-on switch0
        nat-pmp enable
        secure-mode enable
        wan pppoe0
    }

show upnp2 rules 
Firewall pin holes
 pkts bytes target     prot opt in     out     source               destination         
   12  1644 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.243        udp dpt:3074

NAT port forwards
 pkts bytes target     prot opt in     out     source               destination         
    1   137 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:3074 to:192.168.1.243:3074
 pkts bytes target     prot opt in     out     source               destination

Hi! how do you implement this?
I have the same as you ppoe and switch0.
I wish I could jump to openwrt same as you but my router is the 10x and I can't.

Nevermind I'll do it step by step like this:

$ configure
# set service upnp2 listen-on switch0
# set service upnp2 wan pppoe0
# set service upnp2 secure-mode enable
# set service upnp2 nat-pmp enable
# commit
# save
# exit