WireMeLess Network

So, What is UPnP?  Good ques­tion.  The rea­son you’re prob­a­bly here is that you have a game on your XBox that says it needs UPnP.  What­ever the rea­son why you’re ask­ing, this is a brief overview of what it is.

UPnP, accord­ing to the standard’s web­site: “The UPnP archi­tec­ture is a dis­trib­uted, open net­work­ing archi­tec­ture that lever­ages TCP/IP and the Web to enable seam­less prox­im­ity net­work­ing in addi­tion to con­trol and data trans­fer among net­worked devices in the home, office, and every­where in between.”

What that means is that it makes net­work con­fig­u­ra­tion a lot eas­ier for the home user.  The ques­tion is then:  Why isn’t every­one using it?

The answer is secu­rity.  UPnP inter­acts with a fire­wall and opens (and later closes) holes to make com­mu­ni­ca­tion eas­ier between devices.  While this is a great ben­e­fit to peo­ple want­ing things to just work, you lose some of the secu­rity of only allow­ing cer­tain net­work traf­fic in and out of your network.

Bot­tom line:  Cor­po­ra­tions don’t use UPnP, gen­er­ally, home users do.  If you are con­cerned about secu­rity, I would sug­gest learn­ing how to port for­ward, yourself.

Why use UPnP?

In order for a devices to com­mu­ni­cate over net­works, they have to get sev­eral dif­fer­ent pieces of infor­ma­tion from the router or server (or they need to be man­u­ally con­fig­ured… gross).  These pieces are:

• An IP address
• A name
• DNS set­tings
• Net­work infor­ma­tion (sub­net mask, etc)

You said that UPnP messes with the router/firewall

I did.  And it does.  I’ll explain.

The TCP/IP suite uses ports, along with IP addresses, to com­mu­ni­cate.  Let’s say 192.168.100 wants to talk to 192.168.1.101.  First!  192.168.1.101 must be lis­ten­ing on a spe­cific port (we’ll say port 80).  Sec­ond!  192.168.1.100 will open up one of its ports (this will be a ran­dom num­ber below 64,000 and above 1024).

Dia­gram:

That’s all well and dandy, but… we have hack­ers.  Hack­ers will exploit machines by attack­ing them on these ports that they lis­ten on (such as port 80).  PCs actu­ally lis­ten on sev­eral ports by default, and so this can be a huge prob­lem once we con­nect a com­puter to the internet.

If you hook up a PC with no fire­wall pro­tec­tion to the inter­net, it will be port scanned and exploited.  That is why routers and Oper­at­ing Sys­tems pro­vide fire­wall ser­vices.  It basi­cally will ONLY allow traf­fic on spe­cific autho­rized ports, not 1–64,o00.

Addi­tion­ally, your router also NAT’s your traf­fic (Port address Trans­la­tion, to be spe­cific), so, it makes it slightly more dif­fi­cult for traf­fic to come to your com­puter because your fire­wall is help­ing your com­puter share ONE IP address.  Wikipedia has fur­ther expla­na­tion on NAT/PAT.

So, what does UPnP do to your firewall/router?

UPnP will dynam­i­cally open up ports on your fire­wall when appli­ca­tions need them.  In other words, rather than hav­ing to allow cer­tain ports through your fire­wall when­ever your appli­ca­tion requests access, it will give this access auto­mat­i­cally.  This works amaz­ingly for appli­ca­tions that are net­work inten­sive, such as mul­ti­player games, or peer-to-peer appli­ca­tions (such as Steam, or Bit­Tor­rent).  All of these pro­grams lis­ten on spe­cific ports to com­mu­ni­cate, and they will not com­mu­ni­cate prop­erly unless the ports are “opened” or for­warded prop­erly on your fire­wall.   UPnP negates the need to man­u­ally port for­ward!  Let me say that again with a car­riage return as buffer for emphasis.

UPnP negates the need to man­u­ally port forward!

Excit­ing, right?

Okay, I’m con­verted, how do I enable UPnP?

You have to make sure your OS (or XBox) has it enabled.  In Win­dows 7, go to Net­work and Shar­ing Center–Advanced Shar­ing Settings–and Enable Net­work Dis­cov­ery.  In XP, it is a win­dows com­po­nent (acces­si­ble through add-remove programs—windows com­po­nent), and you have to install the UPnP net­work ser­vice. Fol­low Microsoft’s tuto­r­ial to see how to do this.

Addi­tion­ally, you have to enable UPnP on your router.  Hope­fully our router sup­ports it.  If it doesn’t, you might look at installing an open source firmware replace­ment (such as DD-WRT or Tomato) to do this.

In DD-WRT, it’s under NAT/QoS and UPnP:  See the picture:

Enable UPnP

When will UPnP not do me any good?

If you aren’t using mul­ti­player games or online con­soles, or if you don’t use Steam, Bit­Tor­rent, or any num­ber of peer-to-peer pro­grams, OR… if you want to share files over your home net­work with­out hav­ing to man­u­ally con­fig­ure your devices (although Win­dows does a great job of tak­ing a lot of work out of this, already), then… UPnP won’t do much for you.

Addi­tion­ally, if you have a Dou­ble NAT sit­u­a­tion, e.g. you live in an apart­ment com­plex and your WAN IP is a pri­vate IP (such as you can see from my dd-wrt pic­ture), then your router’s UPnP  will not do you much good.

Sum­mary

UPnP is a stan­dard to take out the work from net­work con­fig­u­ra­tion.  Your devices will detect each other auto­mat­i­cally, and com­mu­ni­cate with devices over the inter­net much smoother.  Although UPnP is poten­tially dan­ger­ous, and not rec­om­mended for cor­po­rate sit­u­a­tions, it is a lot eas­ier than hav­ing to make port for­ward­ing entries for every peer-to-peer pro­gram you will ever use.