Home Network Security
There is a feature on almost every home router that most people have never heard of and almost certainly have enabled right now. It is called UPnP, Universal Plug and Play, and its entire purpose is to let devices on your network automatically open holes in your firewall without asking you first.
When you understand what that means, it becomes pretty clear why security professionals have been recommending that people turn it off for the better part of two decades.
UPnP was created to make home networking easier. The idea was simple: when you connect a device to your network, a game console, a smart TV, a video chat app, it often needs to receive incoming connections from the internet to work properly. Normally, allowing incoming connections requires manually configuring port forwarding on your router, which is not something most people know how to do.
UPnP solves this by allowing devices and applications to automatically request that the router open the necessary ports. No manual configuration required. Plug in your Xbox, it connects to the network, requests the ports it needs, and online gaming works.
The fundamental issue with UPnP is that it has no authentication. Any device on your network, including malware, can send a UPnP request to your router and ask it to open ports. The router will comply without asking whether the request is legitimate.
This is not a theoretical vulnerability. It has been actively exploited in the real world in several significant ways:
In 2019, researchers at Akamai documented a campaign called "UPnProxy" where attackers used UPnP on vulnerable home routers to create proxy networks used for ad fraud and credential stuffing attacks. Over 65,000 routers were confirmed affected.
This is usually the first question people ask, and the honest answer is: it depends on what you use your network for.
For the majority of home users, people who browse the web, stream video, and use social media, disabling UPnP will not affect anything noticeably. Outbound connections (which make up almost all normal internet use) are not affected by UPnP at all.
The things that might stop working or require manual configuration after disabling UPnP:
For most people the tradeoff is straightforward: the security benefit of disabling UPnP is significant and concrete, while the inconvenience is minimal or nonexistent.
Log into your router's admin interface by typing your Default Gateway address into a browser. Then look for UPnP settings, they are usually found under:
The location varies by router brand. If you cannot find it, search for your router model followed by "UPnP settings" to find the specific location for your device.
Once you find the UPnP settings, turn it off. The toggle will usually be a simple enable/disable checkbox or toggle switch. Save the settings and your router will restart or apply the change.
After disabling UPnP: If something stops working, you can re-enable UPnP temporarily to confirm it was the cause, then disable it again and set up manual port forwarding for that specific application instead. This gives you the same functionality without the open-ended security risk.
While UPnP is the most well-known issue, there are two related settings worth checking at the same time:
SentinelHome101 checks for active UPnP as part of its standard network security scan. It uses SSDP (Simple Service Discovery Protocol) discovery to detect whether UPnP is responding on your network, reports the status, and flags it as a warning if UPnP is active. The finding includes the specific steps to disable it on your router type.
It also checks WPS status, remote management exposure, and a dozen other router-level settings in the same scan, so you get a complete picture of your router's security posture without having to dig through settings menus manually.
SentinelHome101 detects UPnP, WPS, and 99 other home network security issues. Free for Windows.
Download FreeUPnP is a convenience feature that trades security for ease of setup. For most home users, disabling it costs very little in terms of functionality and removes a meaningful and well-documented attack surface from your network.
The fact that it is enabled by default on almost every consumer router, and that most people never change it, is exactly why it remains one of the most commonly exploited features in home network attacks. Turning it off takes about two minutes and its something almost nobody does. That alone makes it worth doing. While you are in your router settings, also check that you have changed the default admin credentials, which is the other setting most commonly left at factory defaults.