Skip to content

Instantly share code, notes, and snippets.

@plembo
Last active August 29, 2024 16:11
Show Gist options
  • Save plembo/c7f596ce6e690c6c022a6153c674f471 to your computer and use it in GitHub Desktop.
Save plembo/c7f596ce6e690c6c022a6153c674f471 to your computer and use it in GitHub Desktop.
UPnP with EdgeRouter: Don't do it! Ubiquiti. ER-4.

Want to configure UPnP on EdgeRouter-4?

Don't do it!

Introduction

As a former sysadmin that once helped ride herd over around 1,000 servers, of which around 10% were Internet-facing, I've never been a fan of autoconfiguation when it comes to punching holes through the firewall. I've seen the tripwire logs, and it's sobering.

The Problem

So enabling UPnP on my EdgeRouter-4 wasn't something I had on the roadmap, but when I ran into difficulty getting DLNA to work on the default VLAN, I thought it was worth looking into (never mind that, as I later learned, having UPnP turned on wasn't going make a bit of difference on my local network: another reason that mastering theory should always come before practice).

Documentation

I was surprised that there wasn't a clearly written, up-to-date, guide among the official doc on ui.com, thus requiring me (and every other user) to wade into the Internet swamp of bad advice for answers.

I did eventually consult the official EdgeOS User Guide, but as usual the info there was woefully incomplete: basically content to provide a walk through of the router's UPnP Wizard, without ever mentioning EdgeOS's support for the newer (and preferred) UPnP2 protocol that cannot be enabled with the wizard.

These are the most useful articles from the UI Community that I found:

UPnP vs UPnP2: What's the difference?

upnp2 documentation

Enable upnp2 on Edgemax lite

Procedure

This is the basic procedure to follow for enabling UPnP2 on an EdgeRouter. The example commands below assume the EdgeRouter-4 defaults where eth0 is the WAN port, and eth1 is for the LAN.

  1. If you have already set up upnp with the wizard, get onto the router and delete that first:
$ configure
# delete service upnp
# commit
# save
# exit
  1. Now enable and configure UPnP2 for the default LAN:
$ configure
# set service upnp2 listen-on eth1
# set service upnp2 wan eth0
# set service upnp2 secure-mode enable
# set service upnp2 nat-pmp enable
# commit
# save
# exit

If you have multiple LAN (or VLAN) interfaces, you can add them using additional listen-on commands.

  1. Confirm all the things with:
$ show upnp2 rules
  1. Read these articles and think again about whether it might be better to disable UPnP2 (and UPnP) altogether:

Dan Goodin. "UPnP flaw exposes millions of network devices to attacks over the Internet". Ars Technica, 11 June 2020.

Jenny List. "UPnP, Vulnerability as a Feature that just won't die". Hackaday, 14 January 2019.

  1. If you decide, as I did, that the risks associated with UPnP significantly outweigh the benefits, then you can easily disable it by deleting:
$ configure
# delete service upnp2
# commit
# save
# exit
@plembo
Copy link
Author

plembo commented Jul 21, 2023

It might surprise some, but I'd much rather be running something simpler and cheaper like the TP-Link TL-R605, whose hardware is adequate for 1 Gb/s and does 802.1Q VLANS, which is all I really need outside the lab.

@lcorsini
Copy link

I've replaced the default OS with OpenWRT now and never looked back. Much better feature set and constantly updated.

do you have a link to guides or documentation on that? I don't plan to do it atm but it's an interesting option

@jbeltran73-2
Copy link

jbeltran73-2 commented Dec 7, 2023

Thank you! This is what worked for me on an EdgeRouter X (non-SFP) that had been set up with the WAN+2LAN2 wizard (all the ports are on switch0) and was using PPPoE via a modem to connect to the internet. The UI forums are a hot garbage mess of threads and guessing.

    upnp2 {
        listen-on switch0
        nat-pmp enable
        secure-mode enable
        wan pppoe0
    }
show upnp2 rules 
Firewall pin holes
 pkts bytes target     prot opt in     out     source               destination         
   12  1644 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.243        udp dpt:3074

NAT port forwards
 pkts bytes target     prot opt in     out     source               destination         
    1   137 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:3074 to:192.168.1.243:3074
 pkts bytes target     prot opt in     out     source               destination

Hi! how do you implement this?
I have the same as you ppoe and switch0.
I wish I could jump to openwrt same as you but my router is the 10x and I can't.

Nevermind I'll do it step by step like this:

$ configure
# set service upnp2 listen-on switch0
# set service upnp2 wan pppoe0
# set service upnp2 secure-mode enable
# set service upnp2 nat-pmp enable
# commit
# save
# exit

@GilBatzri
Copy link

This seems to have sorted out my Edgerouter 4 and it's discontent with Wifi Calling on at least our initial testing. I hadn't been able to find ports to open and we were seeing issues with different carriers when on the house network. I'll be back if this does not sort it long term, but this feels like it may be the solution I was looking for.

Cheers to OP and thanks to everyone!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment