23 comments

Add a comment…

Sign in

prestine

Your email address

Check!

invalid email

(thinking…)

Reset

or sign in with

• 
• 

UserVoice password

Forgot password?

Create a password

Your name

I agree to the terms of service

Signed in as (Sign out)

Close

Close

Post comment Submitting...

• Alphavil commented  ·  April 12, 2013 5:40 a.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  For home use it is a must have, all devices (NAS, TV....) have uPNP. So it would be nice but for company's I am not sure if they need that or if it is really secure

• Joe commented  ·  April 5, 2013 5:22 p.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  Until (if ever) ASG gains *optional* UPnP support, home users could optionally use a higher-end "home" wifi/router and install an aftermarket OS on it, such as DD-WRT. That will provide VPN and many other more professional features, but still give you popular home-oriented features like UPnP.

• Eric R. commented  ·  February 25, 2013 11:15 p.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  As Chester Wisniewski commented, I think it defeats the purpose of the firewall as well. So please don't!

  But! as 'Anonymous' said, "This would be a great feature to add. I would even be open to paying for this feature as a licensed add-on!"
  If people want to pay money to disregard their firewall, be my guest. At least if you paid you háve to know you bought insecurity, right?

• Ross commented  ·  January 31, 2013 12:34 a.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  I think you have missed the point. These devices are increasingly being deployed at end user's homes. When a $40 Belkin special works better with their Xbox/Apple/Sony device then it's a problem. I don't want to spend my entire life putting in port forwards to make personal devices work at their home but I do wan't be able to offer them a firewall which can do IPSec/SSL VPN and control what access they get back to my work network. Not to mention traffic inspection, web filtering etc.

  I'm not saying it isn't a security risk and I'm not saying enable it by default. I am saying offer it as an option to be enabled but with some controls about it. E.g. let only certain IP's request UPnP port mappings, or only certain ports. As some have mentioned identify the requests and admin approve which would be great instead of having to trawl forums to figure out what ports an Xbox uses or the next new device a client has brought home uses.

• Chester Wisniewski - Sophos commented  ·  January 30, 2013 9:22 p.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  Implementing something that automatically defeats the purpose of the firewall makes no sense. If you want to allow everything, don't use a firewall.

• Michael3245 commented  ·  January 21, 2013 9:32 a.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  Would like to see this one as well

• Anonymous commented  ·  September 17, 2012 1:33 p.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  UPnP is required fro server 2012 essentials and while you can make it work without it breaks the wizards pretty bad.

• Martin commented  ·  August 15, 2012 3:06 a.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  Wow, this FMR exists since 2004:

  http://www.astaro.org/astaro-gateway-products/general-discussion/8614-upnp-2.html

  Too sad, there is still no progress...

• Anonymous commented  ·  July 24, 2012 11:50 p.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  This would be a great feature to add.

• Anonymous commented  ·  April 6, 2012 3:43 p.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  This would be a great feature to add. I would even be open to paying for this feature as a licensed add-on!

• Ross commented  ·  February 15, 2012 8:24 p.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  For anyone saying that it is a security risk, well it is. However for those saying that it's a reason not to have the feature, well that's poor form.

  UPnP is great for home use and ideally you'd have your astaro still setup to do packet filtering and pickup if any trojans were going out based on the signatures.

  To put things in perspective, this wouldn't be enabled at a business but for home users. Those who are running Astaro to support remote VPN access it would be handy. A few times now I have had clients tell me their little home billion/netgear router worked better, and it was due to UPnP and automatic mappings for things like game consoles, chat applications and video streaming. Granted most of this can be sorted by adding manual NAT rules, this isn't really feasible when there is a cost associated for someone to go set these rules up, which is then worse when it just "worked" on their home router.

  In any case it should be disabled by default but there are options from these comments which could be done to mitigate some of the risks of having it on.

• Nathan commented  ·  November 19, 2011 11:21 p.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  this would be great

• Florent commented  ·  October 30, 2011 7:16 a.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  having this feature for home users will be perfect and disabled by default

• Christian Stubberud commented  ·  January 17, 2011 4:28 p.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  This would be nice to have for homeusers. :) And as others have said, it should be disabled by default.
  Other firewalls like astaro supports this.

• Chris commented  ·  November 18, 2010 11:07 a.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  I agree that upnp would be a good addition, especially for those of us who use astaro at home, and also agree it should be disabled by default.

• Exqua commented  ·  October 30, 2010 7:49 p.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  upnp would be great

• Jason Kaechler commented  ·  August 23, 2010 9:31 a.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  this would be good, but i think it should be disabled by default, and the admin who wants it can turn it on.

• totalhavoc commented  ·  June 20, 2009 6:51 a.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  I would also love to see this. It is a pain to switch inbound NAT between devices. My Xbox and PC both use 3074 when gaming. I hate having to go in a switch the mapping.

  Maybe you could implement an allowed host list and even a list of allowed port for each allowed host. This way I could allow my xbox to open/map 3074 when needed or have my PC do it when needed

• William Warren commented  ·  June 14, 2009 10:05 a.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  the idea of allowing something on the network to punch holes in the firewall without the network admin's knowledge is a bad idea in the extreme.

• BarryG commented  ·  April 30, 2009 1:02 p.m.  ·  Flag as inappropriateFlag as inappropriate  ·  Delete

  One thing I've noticed is that uPNP Broadcasts don't work through a bridged interface pair.