What Is UPnP on a Router, and Should You Enable or Disable It?

UPnP is one of those router settings that most people never touch, yet it decides whether your game console gets an open NAT and whether a hacked smart plug can open holes in your firewall. Security agencies recommend turning it off; game consoles work best with it on. This guide explains what UPnP actually does, so you can decide for your own network.

What UPnP Does

UPnP (Universal Plug and Play) is a set of network protocols that let devices on your home network find each other and work together without manual setup. On a router, its most important job is this: a device inside your network can ask the router to open a port to the internet, and the router does it automatically — no password, no confirmation.

Without UPnP, incoming connections from the internet stop at your router, because of NAT and the router’s firewall. Applications that need incoming connections — online games, video calls, media servers — then either work in a limited mode or need you to open ports by hand.

How It Works

1. Discovery. Devices announce themselves and look for each other on the local network using SSDP (Simple Service Discovery Protocol).
2. Description. Each device describes what it can do.
3. Control. An application sends the router a request — in effect, “forward this port to me” — and the router adds that rule. The part of UPnP that handles this on routers is the Internet Gateway Device (IGD) protocol.

When the application closes, it can remove the rule again. You usually see these rules on the router’s UPnP page as a list of open ports with the device and app that requested them.

What Uses UPnP

• Game consoles and PC games. Xbox and PlayStation use UPnP for online multiplayer and party chat. With UPnP off and no manual rules, consoles often report a Strict or Moderate NAT type.
• Smart home devices. Cameras, doorbells and other gadgets may use it so their app can reach them from outside your home.
• Media servers and file sharing. Plex and peer-to-peer apps use it to accept connections from outside.
• Local discovery. Streaming to a TV or a speaker on the same network relies on the discovery part of UPnP, which does not open anything to the internet.

The Security Trade-Off

The convenience comes from the same place as the risk: UPnP has no authentication. Any device on your network can ask the router to open ports — including a device that has been hacked.

The Canadian Centre for Cyber Security lists the risks:

• Malware on a compromised device can use UPnP, and UPnP devices have been used in DDoS attacks.
• Unauthorized access, because UPnP devices often have minimal authentication or access controls.
• Network configuration abuse — attackers can use UPnP controls such as port forwarding to get around your firewall.

There is also a visibility problem: TP-Link notes that with UPnP you no longer know exactly which ports are open unless you check the router’s list. On the other hand, TP-Link considers the risk lower on a home network with current firmware, a strong Wi-Fi password and a few trusted devices.

Should You Turn It On or Off?

The official guidance is clear: the Canadian Centre for Cyber Security recommends disabling UPnP, especially on home routers, and TP-Link calls disabling it the safer default for most home users. Both add that some devices need it — so check before you switch it off.

A practical rule:

• Turn it off if nothing in your home needs incoming connections: no game console, no media server, no camera you watch from outside.
• Leave it on if you play online on a console and do not want to manage ports by hand — but keep the router’s firmware updated, use a strong Wi-Fi password and keep smart devices updated. See how to secure your home network.
• Best of both: turn UPnP off and forward the few ports your console or server needs manually. You get the open NAT without letting every device open ports.

If you keep it on, check the router’s UPnP list from time to time. An open port requested by a device you do not recognize is worth investigating; see who is connected to my Wi-Fi.

UPnP vs Port Forwarding

Manual forwarding needs the device to keep the same local IP address; see how to port forward and what is a static IP address. Putting a device in the DMZ is a third option, but it opens everything to that device and is rarely a good idea.

How to Turn UPnP On or Off

The switch is usually in the router’s advanced settings, often under NAT forwarding:

• TP-Link Archer: web interface → Advanced → NAT Forwarding → UPnP.
• TP-Link Deco: Deco app → More → Advanced → NAT Forwarding → UPnP.
• Other routers: log in to the router (see how to set up a new router), then look under Advanced, WAN, NAT or Firewall for a UPnP switch.

After changing it, restart the game console or app so it rechecks its connection. If you are behind two routers — a provider gateway and your own router — UPnP on one of them is not enough; see what is double NAT.