How to Disable UPnP for Better Network Security
Many Australian homes now run more connected gadgets than ever, from smart TVs and security cameras to gaming consoles and NAS drives. Universal Plug and Play was designed to make this gear talk to each other without the user touching router settings. That same convenience opens a quiet back door attackers are eager to exploit.
The feature ships enabled on modem-routers from Telstra, Optus, and TPG, and on mesh kits sold at JB Hi-Fi and Officeworks. Most households have no idea it is running. Once you understand the risks, switching it off becomes a quick weekend job.
Disabling UPnP takes about the same time as rebooting the modem, and the pay-off is a quieter, harder-to-attack home network. The steps below walk through the why and the how, with notes for the gear most Australian households actually own.
What UPnP actually does behind the scenes
UPnP lets devices on your local network ask the router to open ports automatically. When your Xbox joins a session, or your NAS sets up remote access, the device sends a request and the router obliges without you typing a single rule. Built for convenience, not security, the system is loved by worms and botnets.
The trouble is that any compromised device inside your network can also ask the router to open ports. Malware has been caught abusing UPnP to punch holes outward, and researchers have shown the protocol can be fooled into exposing services to the internet.
The real risks for Aussie households
Australian homes are exposed because of the rapid rollout of smart-home gear. Garage door controllers, air-con bridges, and pool pumps now ship with network ports and rely on UPnP. The Australian Cyber Security Centre has flagged consumer routers as a common entry point, and the ACCC's Scamwatch reminds households to review defaults.
Add the NBN into the picture, where many connections sit online 24/7 with a public IP, and any open port becomes a permanent invitation. Even renters in a Melbourne share house or a Queenslander in Brisbane can end up with a router acting as a proxy if UPnP is left wide open.
Logging into your router without the guesswork
Before turning UPnP off, reach the admin page. On most Australian setups, that means typing 192.168.0.1, 192.168.1.1, or for newer Telstra Smart Modems, the gateway address on the sticker underneath. Netgear, ASUS, and TP-Link boxes from local retailers use the same default ranges.
Default credentials are on the label, but most ISPs force a change at first login. Forgotten the password? A factory reset is the only way back in, so jot the new details down. Once inside, look for Advanced, NAT, or Forwarding, where UPnP settings hide.
Turning off UPnP step by step
On Netgear and D-Link units, head to Advanced > Advanced Setup and uncheck UPnP. ASUS routers place the toggle under WAN > Internet, while TP-Link hides it in Forwarding. For the Telstra Smart Modem Gen 3, the option sits in the Local Network menu, a bit hidden but only a click once found.
Save, reboot, and UPnP is gone. Mesh systems like Eero and Orbi do not expose UPnP as a user option, one less thing to worry about when buying new gear this arvo.
Life without UPnP: what breaks and what does not
Most everyday activities keep working fine. Web browsing, streaming, video calls, and gaming on Australian servers all use outbound connections that need no inbound ports. You will only notice a change if you host a service waiting for incoming traffic, like a Minecraft server, an old CCTV DVR, or remote NAS access.
For those cases, manual port forwarding is the proper replacement. Pick a high, unusual external port, point it at a fixed local IP, and restrict the rule to the device that needs it. This is a schedule automatic backups mindset: deliberate, documented, and reviewed occasionally.
Safer alternatives for gamers, streamers, and remote workers
Gamers worried about NAT type should consider a DMZ only as a last resort, or learn to forward specific game ports manually. Remote workers using a VPN rarely need UPnP, as the tunnel handles inbound traffic. For Plex or Jellyfin users, setting a static IP and forwarding one high port is far safer than auto-discovery.
Small businesses or home offices in Perth or Adelaide follow the same advice, with the bonus that manual rules make auditing easier. Keeping the latest updates on router firmware is part of the same routine.
When you might want to turn UPnP back on
A few edge cases remain where UPnP helps. Temporary file-sharing sessions, old peer-to-peer apps, and legacy smart-home hubs still assume the router will do the heavy lifting. Turn it on for a short project, finish, then switch it off. Treat it like leaving the front door unlocked while you carry in the groceries, then lock it once done.
A quarterly check from a laptop or phone is enough to make sure nobody has flipped the setting back on. Combined with a strong Wi-Fi password and firmware updates, disabling UPnP turns your network from a welcome mat into a harder target.
| Router brand | Where to find UPnP | Default state | Notes |
|---|---|---|---|
| Netgear | Advanced > Advanced Setup | Enabled | Disable after first login |
| ASUS | WAN > Internet | Enabled | Reboot required |
| TP-Link | Forwarding | Enabled | Toggle per interface |
| Telstra Smart Modem | Local Network | Enabled | Hidden in sub-menu |
| Eero / Orbi | Not exposed | N/A | Safer by design |
The single thing worth remembering is that UPnP trades security for convenience, and the trade has not aged well. Switch it off, forward only the ports you genuinely need, and you get the same functionality with a fraction of the risk. Your home network will be the locked-down system it was meant to be.