Introduction
Your console asks for UPnP, and security guides tell you to turn it off. UPnP is the router feature that lets a console, a game or any other program open a port on its own, so players on the internet can reach it. That fixes a Strict NAT without any setup. It is also why security agencies call UPnP a risk: the router does not ask who is opening the port, or why.
Below: what UPnP does, the three ways it goes wrong, whether to keep it on or off for gaming on Xbox, PlayStation, Nintendo Switch and PC, what changes when you turn it off, whether it affects lag, what the Xbox message "UPnP Not Successful" means, and how to see which ports UPnP has already opened on your router.
What is UPnP?
UPnP, Universal Plug and Play, is a set of protocols that let devices on a home network find each other and use each other's services without manual setup. Printers, smart TVs and media servers use it to show up on the network by themselves.
The part that matters for gaming and for security is UPnP IGD, Internet Gateway Device. It is a service your router runs for the home network. A device sends the router a request like "forward UDP port 3074 from the internet to 192.168.1.20", and the router adds that rule to its port forwarding table. When the device no longer needs it, the device can ask for the rule to be removed. Router settings call the feature UPnP or UPnP IGD, or put it under NAT forwarding. Some routers also offer NAT-PMP or its successor, the Port Control Protocol (PCP), which do the same job of opening ports on request.
Without any forwarding rule, a router lets traffic from the internet in only as replies to connections a device started itself. When a friend's console tries to reach yours first, the router drops it, and that is what consoles report as a Strict NAT. A forwarding rule, added by hand or by UPnP, opens one door for that traffic. The NAT type guide explains how routers decide between Open, Moderate and Strict.
Is UPnP safe?
UPnP is about as safe as the least trustworthy device on your network and the quality of your router's firmware. The original UPnP IGD standard has no password and no confirmation step. Its second version recommends an access control service, Device Protection, but CERT/CC, the vulnerability coordination center at Carnegie Mellon, notes that it was not widely adopted. Even under Device Protection, a device may open ports for itself without signing in. The three risks below all come from that.
Risk 1: any device on your network can open a port
A router running UPnP opens a port for whoever asks from inside the home network. It cannot tell your console from a compromised laptop, a cheap camera with old firmware, or a malicious program that came with a download. Malware uses this to make an infected device reachable from the internet, so an attacker can control it remotely and use it to spread to other devices. CISA, the US cybersecurity agency, describes exactly this: malware inside a network can use UPnP to bypass the router's firewall.
No console, phone or computer shows a prompt when another device opens a port, so the only place it shows up is the router's own list of UPnP rules.
Risk 2: a router that answers UPnP from the internet
UPnP is meant for the home side of the router. The standard itself advises against allowing access to these services from outside the home network unless the device has proper authentication. Some routers answered UPnP requests from the internet anyway, a firmware fault. In 2018 Akamai's researchers described attackers who used such routers to add forwarding rules from outside, and in one campaign opened the Windows file sharing ports of computers behind them to the internet.
CallStranger, a flaw in the UPnP protocol published in 2020 as CVE-2020-12695, is a different abuse of the same exposure. It makes a UPnP device send traffic to an address the attacker chooses, which can be used to flood other sites or to carry data out. CERT/CC calls UPnP that is reachable from the internet a misconfiguration and recommends disabling UPnP on internet-facing interfaces.
Here the fault is in the router itself, so a firmware update fixes it, and a router that no longer gets updates keeps whatever bug it shipped with.
Risk 3: forgotten rules
A rule that UPnP added stays open as long as the router keeps it. Rules for a game you tried once or a device you gave away can outlive the reason they were added, and every open port is one more service an outsider can talk to.
What security agencies advise
CISA recommends disabling UPnP unless you have a specific need for it. The Canadian Centre for Cyber Security recommends turning it off, especially on home routers, and notes that some devices need it to work properly. Game publishers lean the other way. Bungie recommends UPnP when possible while calling manual port forwarding generally safer, and Microsoft puts refreshing UPnP first in its Xbox NAT steps.
In practice, if a console needs open ports and UPnP is the only practical way to give them, UPnP is a reasonable trade. If nothing on your network needs inbound connections, UPnP brings risk and nothing in return.
Should UPnP be on or off for gaming?
It depends on what plays on your network. A console that hosts parties, voice chat or peer-to-peer matches needs inbound connections, and UPnP is the easiest way to get them. A PC that plays on dedicated servers usually does not.
| Setup | Console NAT type | Who can open ports | Effort | Good for |
|---|---|---|---|---|
| UPnP on | Usually Open | Any device on the network | None | Several consoles, guests, games that change often |
| UPnP off, ports forwarded by hand | Open for the forwarded console | Only you | A fixed address and a port list per console | One console, a network you want locked down |
| UPnP off, nothing forwarded | Often Strict | Nobody | None | PC games on dedicated servers, no console |
| DMZ for the console | Open | Every port of that device is exposed | One setting | Not recommended |
Use one of them at a time. Microsoft's Xbox guidance says not to combine port forwarding, UPnP and the DMZ (perimeter network) settings.
Do you need UPnP for Xbox?
Not strictly, but it is the setup Xbox expects. Microsoft says UPnP is what the console uses to set up the router for multiplayer gaming and chat. Party chat and many games connect players directly to each other, so without open ports the console shows Strict NAT and some players cannot join you. If you prefer to keep UPnP off, forward the Xbox ports to the console by hand. Microsoft's list is UDP 88, UDP and TCP 3074, UDP and TCP 53, TCP 80, UDP 500, UDP 3544 and UDP 4500, and some games need more.
Should UPnP be on for PS5 and Nintendo Switch?
Sony's PS5 help pages for connection errors do not ask for UPnP. They suggest opening ports on the router instead: TCP 80, 443, 3478, 3479 and 3480, and UDP 3478, 3479 and 49152 to 65535. Nintendo's NAT troubleshooting for Switch and Switch 2 does not mention UPnP either. Both consoles still benefit from an open path in, because party chat and peer-to-peer matches work the same way as on Xbox. Neither maker says whether its console asks the router through UPnP, so the dependable route is the one both describe: forward the listed ports to a console with a fixed address.
PC games and Steam
Most competitive PC games connect every player to a dedicated server, and that works with any NAT type. UPnP matters on a PC for games with peer-to-peer lobbies, for hosting your own game server, and for voice or streaming features that accept direct connections. Valve's page of Steam ports lists what to open and does not ask for UPnP. On a PC that only plays on dedicated servers, UPnP can stay off.
What happens if you turn UPnP off?
Turning UPnP off does not cut your internet, slow your downloads or break web pages, streaming and dedicated-server games. Everything a device starts itself keeps working.
What changes is inbound traffic. Devices can no longer ask the router for ports. A console that relied on UPnP may drop from Open to Moderate or Strict NAT, party chat with some players can fail, and hosting a lobby may stop working. Gadgets that depend on UPnP for access from outside, such as some cameras and media servers, may stop being reachable from the internet while their local features keep working. Restart the router after the change and run the console's network test to see where you stand.
Forward the ports your console needs by hand and give the console a fixed address on the network (a DHCP reservation in the router), and it keeps an Open NAT with UPnP off.
Does UPnP affect lag or slow down the internet?
No. UPnP only adds and removes forwarding rules. It does not touch the speed of the connection, and once a port is open, game packets take the same path through the router as they would with a rule added by hand.
UPnP can change lag indirectly, through NAT type. When two consoles cannot connect directly, the game or the platform may relay their traffic through a server, and a relay can add delay. Opening ports, by UPnP or by hand, makes the direct connection possible. Ping to a game's own server does not change either way.
"UPnP Not Successful" on Xbox: what it means and how to fix it
The message in the Xbox network settings means the console asked the router to open its ports through UPnP and did not get them. Microsoft's own order of steps is short: check whether the router needs a firmware update, make sure UPnP is on, then turn it off, restart the console, the modem and the router, turn UPnP back on (and a setting called Zero Config, if the router has one), restart again and check the network settings. If UPnP still fails or the router does not support it, Microsoft points to port forwarding, port triggering or the DMZ.
When those steps do not help, the cause is usually outside the router's UPnP switch:
- Double NAT. Two routers in a row, such as an internet provider's gateway in front of your own router or a mesh system plugged into a router, each do NAT. UPnP on the inner router opens a port only on that router, and the outer one still drops the traffic. Putting one of them into bridge or access point mode leaves a single NAT.
- Carrier-grade NAT (CGNAT). Some providers, Starlink on its default plans among them, share one public IPv4 address between many customers. Your router never gets a public address of its own, so nothing it opens is reachable from the internet. Only the provider can change that.
- A router whose UPnP does not work with the console. Old or provider-locked firmware sometimes accepts the request and does nothing. Manual port forwarding is the fallback.
The NAT Type Test on packet.guru checks the NAT behavior from a browser on the same network and has a router WAN check that spots double NAT and CGNAT, the two causes no console setting can fix.
How to see which ports UPnP opened
Most routers show the rules UPnP has added, usually on the same settings page as the UPnP switch, as a table with the description the device gave, the protocol, the outside port and the inside address. Some mesh systems and provider gateways show it in their app instead. TP-Link's own security advice is to look there for port openings you do not recognize. A small tool called miniupnpc can also list the rules from a computer on the same network.
Read the table by the inside address. Every address should belong to a device you know, and the router's list of connected devices shows which one has which address. A rule you cannot explain, especially one pointing at a laptop, a camera or a TV, deserves a closer look: which program asked for it, and whether that device is up to date.
To check the outside view, test your own public IP address from the internet. The Port Scan tool checks up to ten TCP ports on an address you give it and shows which ones answer. It cannot test UDP, which most console ports use, and behind CGNAT it reaches the provider's address, not yours.
A safer way to keep UPnP on
If a console needs UPnP and you would rather not forward ports by hand, a few habits remove most of the risk:
- Keep the router's firmware current. The internet-side UPnP bugs were firmware bugs, and a router that no longer receives updates is a risk with UPnP or without it.
- Keep untrusted gadgets off the main network. Many routers offer a guest network: put smart plugs, cameras and TV boxes there, and they cannot reach the consoles and computers on the main network.
- Turn UPnP off on devices that do not need it. Printers, TVs and media servers often have their own UPnP or network discovery setting.
- Look at the UPnP table now and then, as described above.
- Turn UPnP off on the router when the console is gone. If nothing on the network hosts games or calls any more, UPnP has no job left.
How to turn UPnP on or off
Open your router's settings page in a browser, or the router maker's app for mesh systems, and look for the UPnP settings in the advanced, NAT forwarding or network section. It is usually a single switch, sometimes named UPnP IGD. After changing it, restart the console so it asks for its ports again, then run the console's own network test.
If your internet provider supplied the router, the setting may be in the provider's app. And if the provider's gateway sits in front of your own router, the UPnP that matters is on the router the console is connected to, with the other one in bridge mode.
FAQ
Is UPnP safe for gaming?
For a console on a home network with up-to-date router firmware and devices you trust, UPnP is a common and reasonable setup. The risk comes from the other devices on the same network, which can open ports just as easily, and from routers that stopped getting updates.
Is UPnP enabled by default?
It depends on the router. TP-Link writes that most routers enable it by default, and that some of its own models ship with it off for security reasons. Check the setting instead of assuming either.
Is UPnP the same as port forwarding?
UPnP is automatic port forwarding. A manual rule is one you add once for one device and keep. UPnP lets every device add and remove its own rules whenever it wants.
Is it safe to open port 3074 for Xbox?
Forwarding 3074 to your console exposes only what the console itself listens on, and the console gets regular system updates from its maker. The risk of a forwarded port depends on the device behind it, not on the port number.
Does a VPN need UPnP?
No. A VPN connection is started from inside your network, so the router lets the replies in without any open port.
Sources
- Home Network Security (CISA)
- "UPnP Not Successful" appears in your network settings (Xbox Support, Microsoft)
- VU#339275: UPnP SUBSCRIBE can be abused to send traffic to arbitrary destinations (CERT/CC)
To see what else your connection shows to the sites you visit, run the Privacy & Trust Index check.