Port forwarding with UPnP

From http://www.codeproject.com/KB/IP/PortForward.aspx
—–

Universal Plug-n-Play (“UPnP”) is an attempt to extend the concept of ordinary plug-n-play, so that it applies to more than just your own machine: it applies to the whole network. For example, with ordinary plug-n-play, when a new peripheral is connected to your machine, it is automatically discovered and configured from your machine without access to the peripheral itself.UPnP extends this idea to the network: when a new network device is connected to the network, it can be automatically discovered over the network, and configured remotely from your machine over the network. The idea is that a device can dynamically join a wired or wireless network, obtain an IP address, convey its capabilities, and learn about the presence and capabilities of other devices all over the network. 

Nowadays, most routers have UPnP capability. This allows you to solve one of the more vexing problems for users of network programs that must accept an incoming connection from the Internet. Examples of these programs are P2P file sharing programs. To allow others on the Internet to connect to these programs, it is necessary to configure the router to accept incoming connections and to route the connection to a local machine on the LAN behind the router. This process is called “port forwarding”. For the ordinary user, this process can be a daunting challenge.

UPnP works perfectly in this situation. With it, you can map a port-forwarding programmatically without user interaction. To be able to remotely configure a router over a network from a local machine, you need the following:

    * UPnP on the local machine: it might also be necessary to enable UPnP, since a UPnP-capable OS does not necessarily have it turned on by default.

    * UPnP on your router: most routers will have UPnP capability. Again, it might be necessary to enable UPnP on the router, since it might not be turned on by default. 

In addition, if there is a firewall on the local machine, it must be configured to allow the underlying TCP and UDP communications on which UPnP relies.

It’s worthwhile to point out that there’s a significant security risk: routers insulate local networks from the wilds of the Internet, by blocking incoming connections that are almost always malicious. This insulation is at the hardware level, and as such, it is often more effective than software such as software firewalls. Most users rely on this added layer of insulation to protect machines on their local network. But since UPnP allows any program, even malicious programs, to create a port mapping through the router, this added layer of insulation disappears. Moreover, with UPnP, the port mapping can be created even without any knowledge of the administrative password to the router, and thus can be created without the knowledge or consent of the user.