WAN and UPnP?

[Builder71]

The default out of the box setting is "Yes".

To my understanding this is a huge security risk.
Also I have no clue why anyone want to use this on the WAN port.
Anyone with a real life example?

I switched it off and asked myself, is it wise to change the default firmware setting to "No"?

 

[rlcronin]

The default out of the box setting is "Yes".

To my understanding this is a huge security risk.
Also I have no clue why anyone want to use this on the WAN port.
Anyone with a real life example?

I switched it off and asked myself, is it wise to change the default firmware setting to "No"?

Well, it can make setting up remote access to a Windows Home Server box easier, but of course it is safer to leave it off and manually put in the port forwards.
--
bc

 

[Builder71]

Ah, OK.

Sounds like it's wise to make the default "No".
Maybe RMerlin can make that happen if he feels like it.

 

[RMerlin]

The default out of the box setting is "Yes".

To my understanding this is a huge security risk.
Also I have no clue why anyone want to use this on the WAN port.
Anyone with a real life example?

I switched it off and asked myself, is it wise to change the default firmware setting to "No"?

The uPNP security implications have been overblown in my personal opinion. If a computer on your network has already been compromised to the point of being able to open an inbound port through uPNP, then you are already toast, since it does not need uPNP to be able to establish outbound connection to any outside server.

uPNP can in fact be a security asset if you look at it differently. For example if you use a Bittorrent client, it means you can have the BT client use a different random port every time you start it, and it will be automatically forwarded. This can be more secure (in a way) than always forwarding the same port. When the BT client isn't running, any client could use that same forwarded port to hijack the connection.

 

[bigcid10]

Bravo!! I must say

 

[Builder71]

Thx for your opinion on this RMerlin.

I switched it off because I don't use it.