#readwise # UPnP & NAT-PMP  ## Metadata - Author: [[netgate.com]] - Full Title: UPnP & NAT-PMP - URL: https://docs.netgate.com/pfsense/en/latest/services/upnp.html ## Highlights UPnP and NAT-PMP are a classic example of the “Security vs. Convenience” trade-off. By their very nature, these services are insecure. Any program on the network can allow in and forward any traffic – a potential security nightmare. On the other side, it can be a chore to enter and maintain NAT port forwards and their associated rules, especially when it comes to game consoles. There is a lot of guesswork and research involved to find the proper ports and settings, but UPnP *just works* and requires little administrative effort. Manual port forwards to accommodate these scenarios tend to be overly permissive, potentially exposing services that should not be open from the Internet. The port forwards are also always on, where UPnP may be temporary. ^fc21vg Access controls in the UPnP service configuration can lock down which devices are allowed to make alterations. Over and above the built-in access controls, further control may be exerted with firewall rules. When properly controlled, UPnP can also be a little more secure by allowing programs to pick and listen on random ports, instead of always having the same port open and forwarded. ([View Highlight](https://read.readwise.io/read/01hfgv246yvthbqtfahtfnxh27)) ---