RV042G UPnP rules being added without consent?

[Dan Lalonde]

Hello

I noticed there are UPnP rules that were added without me having anything to do with it... I'm the only one with the admin password.

Is that supposed to happen? From what I know no but is there anything I don't know

I've changed the password yesterday yet 4 rules were added since!

Thank you!

[mpyhala · Accepted solution]

Daniel,

Please see the following from the Admin Guide:

Setting Up Universal Plug and Play (UPnP)

Use the Setup > UPnP page to enable Universal Plug and Play (UPnP). This feature

allows Windows to automatically configure the router to open and close ports for

Internet applications such as gaming and videoconferencing.

NOTE: As a security precaution, disable UPnP unless you require it for your applications.

http://www.cisco.com/en/US/docs/routers/csbr/rv0xx/administration/guide/rv0xx_AG_78-19576.pdf

- Marty

[Dan Lalonde]

Hello Mpyhala

Thank you so much for your reply! That's a relief!

I have a question though. I set all my port forwardings in UPnP because for some strange reason in Forwarding it didn't work and I read on a forum that I should use UPnP instead.

Do you know why that is?

Thank you!

[mpyhala]

Daniel,

You're welcome, I'm glad I was able to provide some useful information.

Forwarding should work fine on the RV042. You should try it again with the latest firmware.

I recall using UPnP once or twice when the External Port needed to be different than the Internal Port. (i.e. translate external port 4000 to 3389 for RDP)

Please keep us updated.

- Marty

[Dan Lalonde]

Hello Marty,

Thank you for your reply.

Now I remember what the problem was. I need to have certain ports go to the same port but on different internal IP and in Port Forwarding it doesn't allow me to do that. It says that the port is already there and cannot be added again.

Example:

I need domain.com:83 go to 192.168.0.53:80, domain.com:84 go to 192.168.0.54:80 and so on.

The only way I could make it work was in UPnP.

Do you have a solution for me?

Thank you

[mpyhala]

Daniel,

The "correct" way to have access to multiple internal servers on the same port (i.e. 80) is to get a block of static WAN IP addresses from your ISP and use One-to-One NAT to translate them to the LAN IP addresses of the servers.

Using UPnP is a solid workaround if you don't want to pay for the static IPs and don't mind adding port numbers to the FQDN. I am not aware of another solution using the RV042.

- Marty

[SamirD · Accepted solution]

Once the rules are added by upnp, will disabling upnp remove the rules?  If it doesn't, then that is a workaround to getting the correct rules set up.

Huntsville's Premiere Car and Bike e-magazine: www.huntsvillecarscene.com

[Dan Lalonde]

Marty: Could something like DynDNS be a good replacement for this? Because I do not like the idea of application adding their own rules.

Samir: I'm going to try it but I have to print them out first and wait for the office to be closed before. I'll keep you updated.

Thank you!

[mpyhala]

Daniel,

Services like dyndns.com are useful if you do not have a static WAN IP address.

"I need domain.com:83 go to 192.168.0.53:80, domain.com:84 go to 192.168.0.54:80 and so on."

Since you are adding a port number to your URL already, why not simply change the listening port on the server and forward that port instead of 80?

i.e. domain.com:83 comes in on port 83. Forward port 83 in the router to the internal server at 192.168.1.100 which is configured to listen for http traffic on port 83 instead of 80.

You could do the same for the other servers and create Forwarding rules instead of allowing UPnP.

If you cannot change the listening port from 80 to something else on the servers, then the only option I know of is a block of static WAN IPs translated to LAN IPs.

- Marty

[Dan Lalonde]

So you mean using the Windows Server firewall instead of the router and let it manage the forwarding?

[Dan Lalonde]

But another thing. Why can't I just say:

ANYIP:83 forward to 192.168.0.53:80

[mpyhala]

Daniel,

The problem is that the only way to translate an external port to a different internal port on the RV042 is through UPnP. Forwarding only allows the same port to be used.

Regarding the previous question, I was implying that you should change the http listening port on the server to match the external port that you are using. In other words make it so that when you access the http server on the LAN it looks like: http://192.168.0.53:83 instead of http://192.168.0.53. I don't know if this is feasible or even possible in your case, we do this a lot with IP cameras that listen for http connections.

- Marty

[Dan Lalonde]

Well that is an interesting idea but I'd have to go through all the servers one by one (there are in excess of 20).

But disabling it seemed to do the trick! The rules still work but nothing got added in the last 24 hours. Before, everytime I'd delete Skype, it would come back.

Thank you for all your help!

[SamirD]

Sweet!  That was a pretty simple fix.   Glad I could help.

Huntsville's Premiere Car and Bike e-magazine: www.huntsvillecarscene.com

[Dan Lalonde]

Thank you!