I'm using a tplink router for my home LAN and just noticed that in the UPnP section in its control panel there are two entries with App description: Teredo of tipe: UDP and ports: 55566 and 49868

How can I analyze what application is using those forwarding? Does it seem suspicious? (There is no remove button in the web interface of the router so I cannot just remove those entries...)

  • Why downvote? Seems like a valid question that others might run into. – agtoever Aug 11 '14 at 7:28

The purpose of UPnP is that devices within the network can discover and connect to each other without further configuration by the end-user. That's why UPnP connections are registered by your router, but aren't editable. The only option you have (with your router) is to disable or enable UPnP entirely.

The description of the application might refer to the Teredo tunneling protocol, wich is used to enable ipv6 communication within a ipv4 network. It is suspicious that the ports you mention aren't de default Teredo ports (3544). You might want to check with devices within your network if they have ipv6/Teredo enabled, or if your ISP is providing ipv6 services through Teredo tunneling. As long as your ISP doesn't require ipv6 (most of them don't), then it is safe (and maybe even safer) to disable any ipv6 services within your network.

It is generally regarded a bad practice to leave UPnP open towards the internet, because it can be used to gain access to your internal network. You can test if UPnP is exposed to the internet with this site.

Consider if you have any devices or applications that need UPnP or if you can do without it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.