UPnP is enabled: any device in your LAN can open ports from the internet

What the audit found

UPnP (Universal Plug and Play) is enabled on your router (IP → UPnP). With it switched on, any device on the internal network can instruct the router to create a port forward from the internet to itself — no password, no confirmation, no log entry that most people ever read.

The audit reports this as medium severity whenever UPnP is enabled. RouterOS ships with it disabled, so somebody switched it on, usually to make a game console, a torrent client or a video-calling application work.

Why it matters

Port forwards are holes in your firewall. Normally you create them deliberately, one at a time, for a service you understand. UPnP hands that decision to every device on the LAN.

Picture an office PC that picks up malware from an e-mail attachment. The malware asks the router, over UPnP, to forward a port to the PC. The router agrees. The attacker now has a direct path from the internet to that machine that bypasses the firewall entirely, and the request looked exactly like a games console asking for the same thing. This is not theoretical: botnets have used UPnP on home and small-office routers for years to expose infected hosts and to turn routers into proxies.

Two further problems are specific to how UPnP works. First, the protocol has no authentication at all, so a poorly written IoT device (a camera, a smart TV, a printer) can open ports by accident and leave them open. Second, RouterOS applies the forward exactly as requested, so a device can ask for ports that expose your NAS, your printer or its own admin page.

Because RouterOS only listens for UPnP requests on interfaces you mark as internal, the risk comes from your own LAN rather than the internet. That is why it is rated medium rather than high — but "any device on my LAN can open the firewall" is still a decision most people would not make on purpose.

What it looks like in Winbox

Open IP → UPnP. If Enabled is ticked, this is the finding. The Interfaces tab shows which interfaces are marked internal (where requests are accepted) and external (where the forwards are created).

The port forwards UPnP has already created show up in IP → Firewall → NAT as dynamic dst-nat rules — greyed and marked with a D flag.

How to fix it

The fix is to untick Enabled under IP → UPnP. Existing dynamic forwards disappear the moment the service is disabled. Disabling it does not affect your own management access, so Safe Mode is not needed here.

If a specific application genuinely needs an inbound port — a game server, for example — create a static port forward for it instead: a dst-nat rule under IP → Firewall → NAT that matches the WAN interface list, the protocol and the destination port, and sends the traffic to the host's internal address. That way you know exactly which port goes to which host. Static forwards are visible, documented, and survive a reboot the way you expect.

If you must keep UPnP for a particular device, at least confine it: under IP → UPnP → Interfaces, mark only the VLAN or bridge that device sits on as internal, and keep the rest of the LAN out of it. That limits the exposure to a single segment.

Afterwards, open IP → Firewall → NAT and check that no dynamic (D) dst-nat rules remain; from outside your network, a port scan of your public IP should show only the ports you forwarded deliberately. Then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

Will my games console or video calls stop working?

Most modern services work fine without UPnP because they connect outward and use relay servers. Consoles may report a stricter NAT type. If that matters, add a static port forward for the console's address and the ports its vendor documents, which gives the same result under your control.

Is UPnP safe if my LAN only has devices I trust?

Trust is not the issue — every one of those devices can be compromised, and then it opens the door for the attacker. UPnP also lets buggy software open ports by mistake. The safe default is off.

Does UPnP expose the router itself?

No; it creates forwards to devices behind the router. The danger is to your internal hosts, which is why this finding is classified under system settings rather than as an exposed router service.