Isn't manual port forwarding actually less safe than UPnP?

Question

A common opinion seems to be that manual port forwarding is "safer" than UPnP, because with UPnP enabled a device can expose ports to the internet at a whim. That's why so many security guides advise you to disable UPnP ASAP. 1 2

However, it is my understanding, that UPnP devices are designed to open the ports only temporarily, with a time lease, that expires as soon as not needed anymore.

Manual port forwarding rules are usually enabled 24/7. Why would anyone think that a manual port forwarding rule is safer than UPnP? It actually exposes your ports for durations longer than needed, and therefore provides a larger attack surface. If anything, UPnP seems to be a safer option, because it doesn't force you to open up all the ports all the time.

Answer 1

It's a matter of convenience versus control. As you noted, UPnP is free to open and close ports at will. That means any device in your network can open a port.

• Your video game console (good, it lets you team chat with other gamers)
• Your Brand X webcam (good, it lets you access your video stream from your phone)
• Your Brand Y webcam (bad, you didn't change the default password and it's now being watched by someone who found the video stream listed on shodan.io)
• Your refrigerator (bad, you didn't even know it opened a UPnP port and now some guy is using your fridge to mine for Monero.)
• Your ancient DVD player (very bad, it has a flaw that allows someone to use it to remotely access the rest of your network, and they implanted ransomware on your PC.)

Most importantly, UPnP also allows you to use easily DHCP addressing for all devices on your network. If you unplug your webcam today and plug it in a month later, DHCP will likely give it a different address. UPnP won't care, it'll just work. That's very important for people who are not network technicians and don't want to learn how to configure a network. It's a huge convenience factor.

Disabling UPnP prevents all of the above scenarios, requiring you to manage your network responsibly. And as you're capable of using static addressing to configure your video game and your webcam and opening those ports, you're also responsible. You would evaluate each decision, and say "hey, I don't need this old DVD player to open a port!" and reduced your risk.

For a very small personal home network, the risks of UPnP might be worth the convenience. But for even a modest sized home network, you probably don't want the risk of ancient, unsecured devices randomly granting access into your network.

The general idea is if you are qualified to manually configure your router's pass-through ports, you're also qualified to understand the risks of letting any random device open a firewall hole anytime it wants, therefore you should take that responsibility. The real decision, however, is up to you.

Answer 2

The other answers are perfectly right about the main argument being "control" - you don't want just any device or software being able to open ports.

In addition to that, it is worth noting that the mentioned "advantage" about the temporary nature of forwarded ports with UPnP won't matter most of the time. For example, how does your UPnP-enabled security cam know, when you want to access it from the outside? It doesn't, it just opens a port and waits for a connection. The only time it does not need port forwarding is when the camera is switched off. However, in that case the port forwarding wouldn't hurt because it would go nowhere (it's forwarded to a non-responding device, making it roughly equivalent to a "filtered" port rather than an "open" port).

There may be exceptions to this, like sophisticated software that has an outgoing connection as control channel and therefore knows, when an additional incoming connection is required. However, those cases are rare. If you need an outgoing connection anyway, in many cases you just use it for all communication.

Answer 3

Manual port forwarding rules are usually enabled 24/7. Why would anyone think that a manual port forwarding rule is safer than UPnP?

Because it requires a manual action from the user, thus exposing only intended service. UPnP on the other hand requires no user interaction.

Generally I'd say the difference is minor in most scenarios, but UPnP may escalate the severity of some scenarios where an user runs malware.

Answer 4

If a system has a remotely exploitable vulnerability, arguably any amount of time exposed to the Internet is too long, though temporary and random port openings perhaps decrease the chances of it being found in a scan and exploited at any given time.

I would also note that this issue isn't terribly relevant anymore from what I've seen. Unless someone is intentionally self-hosting a service that requires it (e.g. web server or game server), there is usually very little reason for an average user to open ports into their network, either on a permanent or temporary basis. Every "smart" product I have dealt with in the past few years uses some kind of cloud service as an intermediary, so direct connections into your network are not needed for remote management. That, and other types of P2P applications (multiplayer gaming, voice/video) rely on hole punching techniques to reach into networks instead of port forwarding, falling back to using an intermediary.