first… upnp can be flakey and unstable regardless of the codebase
2 … I use merlin
3 using upnp takes you out of control on what your software is doing and how its doing it… its a lazy mans way of punching firewalls manufacturers had to use because their customers are not smart and they would have huge support call volume because their software cant reach the internet
4 … you have given software coders… like plex… one more thing to break and not work correctly… like this post showing that many people on 1.7.5 are suffering a bug introduced by plex on the latest release that drops the port to 0 and the sever can no longer communicate
ChuckPA Members, Plex Pass, Plex Ninja, Plex Team MemberPosts: 14,050 Plex Team Member July 7 Accepted Answer It's aggravating something but, since my last post, I've chatted with Engineering. They are investing what does appear to be a bug in 1.7.5. PMS maps a port and all is good. During the next refresh of that connection, somehow the port becomes 0 and drops the connection but thinks it's mapped (green). The known work around for now is to switch to manual mapping (manually specify port and do the port forwarding from your modem/router). It will fuss with you as you make it flip over (they are seeing this behavior now) . To quote them: There may be timing issues initially in transition from uPnP to manual selected port but a few browser refreshes and a PMS restart should get it to bed in and as long as you do not touch it - it should be ok
running a specified port would have alleviated this issue all together
5 upnp is weak and a known attack surface that allows programs (including malware) to punch bidirectional holes in your firewall… plain and simple
`Over a five-and-a-half-month period last year, the researchers scanned every routable IPv4 address about once a week. They identified 81 million unique addresses that responded to standard UPnP discovery requests, even though the standard isn’t supposed to communicate with devices that are outside a local network. Further scans revealed 17 million addresses exposed UPnP services built on the open standard known as SOAP, short for simple object access protocol. By broadcasting the service to the Internet at large, the devices can make it possible for attackers to bypass firewall protections.
another excellent excerpt…
OVER 4.1 MILLIONS DEVICES VULNERABLE According to the security researchers, about 38 percent of the 11 million Internet-facing UPnP devices, i.e. over 4.1 million devices, in use are potentially vulnerable to being used in this type of reflection DDoS attack. "The number of UPnP devices that will behave as open reflectors is vast, and many of them are home-based Internet-enabled devices that are difficult to patch," said Akamai security business unit senior vice president and general manager Stuart Scholly. "Action from firmware, application and hardware vendors must occur in order to mitigate and manage this threat."
In all, Rapid7 identified 6,900 products sold by 1,500 separate vendors that contained at least one UPnP vulnerability. Rapid7 CTO HD Moore told Ars home networks that connect UPnP-enabled devices are generally safe as long as the firewall included in the Internet-facing router is enabled and working properly. The problem is that many routers include vulnerable implementations of UPnP, in which case they provide an easy way for attackers to get around that protection.`
the last security cameras that I installed tried to make contact with more than 30 servers in china. I had the mac addresses fully firewalled before I plugged them in… because on top of upnp they can now use peer to peer to tunnel the network firewall even with upnp off.
if people know half of what was going on ‘out on the net’ they would never plug their routers in
you will find zero IT professionals that would allow upnp to run on an edge appliance … its just stupid
