Internet Gateway Device Protocol

From HandWiki
Short description: Network protocol for mapping ports
Diagram of the UPnP's discovery phase

Internet Gateway Device (UPnP IGD) Protocol is a protocol based on UPnP for mapping ports in network address translation (NAT) setups, supported by some NAT-enabled routers. It is a common communications protocol for automatically configuring port forwarding, and is part of an ISO/IEC Standard[1][2][3][4][5][6][7] rather than an Internet Engineering Task Force standard.

Usage

Applications using peer-to-peer networks, multiplayer gaming, and remote assistance programs need a way to communicate through home and business gateways. Without IGD one has to manually configure the gateway to allow traffic through, a process which is error-prone and time-consuming. UPnP comes with a solution for network address translation traversal (NAT traversal) that implements IGD.

IGD makes it easy to do the following:

  • Add and remove port mappings
  • Assign lease times to mappings
  • Enumerate existing port mappings
  • Learn the public (external) IP address

UPnP IGDv2

UPnP IGDv2, published in 2010, added IPv6 support and corrected the misconception of an infinite lease time with a value of 0. The specifications are backward compatible, but there are compatibility issues e.g. with the Microsoft client.

Compatibility issues

There are numerous compatibility issues due the different interpretations of the very large actually backward compatible IGDv1 and IGDv2 specifications. One of them is the UPnP IGD client integrated with current Microsoft Windows and Xbox systems with certified IGDv2 routers. The compatibility issue still exist since the introduced of the IGDv1 client in Windows XP in 2001, and a IGDv2 router without a workaround that makes router port mapping impossible.[8]

If UPnP is only used to control router port mappings and pinholes, there are alternative, newer much simpler and lightweight protocols such as the PCP and the NAT-PMP, both of which have been standardized as RFCs by the IETF. These alternatives are not yet known to have compatibility issues between different clients and servers, but adoption is still low. For consumer routers, only AVM and the open source router software projects OpenWrt, OPNsense, and pfSense are currently known to support PCP as an alternative to UPnP. AVM's Fritz!Box UPnP IGDv2 and PCP implementation has been very buggy since its introduction. In many cases it does not work.[9][10][11][12][13]

Security risks

Malware can exploit the IGD protocol to bring connected devices under the control of a foreign user.[14][15] The Conficker worm is an example of a botnet created using this vector.[14]

Internals

The host can discover available IGDv1/IGDv2 devices with only one M-SEARCH for IGDv1 on the network via Simple Service Discovery Protocol (SSDP) which can be controlled then with the help of a network protocol such as SOAP. A discover request is sent via HTTP and port 1900 to the IPv4 multicast address 239.255.255.250 (for the IPv6 addresses see the Simple Service Discovery Protocol (SSDP)): 

M-SEARCH * HTTP/1.1
HOST: 239.255.255.250:1900
MAN: "ssdp:discover"
MX: 2
ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1

See also

References

  1. ↑ "UPnP InternetGatewayDevice v1.0/v2.0". UPnP Forum. 2010-12-10. https://openconnectivity.org/developer/specifications/upnp-resources/upnp/internet-gateway-device-igd-v-2-0/. 
  2. ↑ "UPnP InternetGatewayDevice v1.0". UPnP Forum. 2001-11-12. http://upnp.org/specs/gw/UPnP-gw-InternetGatewayDevice-v1-Device.pdf. 
  3. ↑ "UPnP InternetGatewayDevice v2.0". UPnP Forum. 2010-12-10. http://upnp.org/specs/gw/UPnP-gw-InternetGatewayDevice-v2-Device.pdf. 
  4. ↑ "UPnP Device Architecture v1.0". UPnP Forum. 2008-10-15. http://upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.0.pdf. 
  5. ↑ "UPnP Device Architecture v1.1". UPnP Forum. 2008-10-15. https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v1.1.pdf. 
  6. ↑ "UPnP Device Architecture v2.0". OCF. 2020-04-17. https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf. 
  7. ↑ ISO/IEC 29341, http://www.iso.org/iso/home/news_index/news_archive/news.htm?refid=Ref1185
  8. ↑ MiniUPnPd's workaround: Detect FDSSDP as a microsoft client
  9. ↑ 12 Fehler in der AVM UPnP IGD- und PCP-Implementation (aller FritzBoxen)
  10. ↑ UPnP not working with my FRITX!Box
  11. ↑ UPNP_GetValidIGD returns Temporary IPv6 Address, causing UPNP_AddPinHole to fail with 606 #600
  12. ↑ upnpc shows wrong duration for port forward longer than 120 seconds #222
  13. ↑ Setting up portforward doesn't work
  14. ↑ 14.0 14.1 Danny Palmer (2017-07-19). "This sneaky malware will cause headaches even after it is deleted from your PC". ZDNet. Archived from the original on 26 January 2021. https://web.archive.org/web/20210126173325/http://www.zdnet.com/article/this-sneaky-malware-will-cause-headaches-even-after-it-is-deleted-from-your-pc/. Retrieved 2021-02-02. 
  15. ↑ Mike Barwise (2008-01-15). "Unwanted remote configuration for home routers". Heise Media UK Ltd.. Archived from the original on 8 December 2013. https://web.archive.org/web/20131208154706/http://www.h-online.com/security/news/item/Unwanted-remote-configuration-for-home-routers-Update-735817.html. Retrieved 2012-07-21. 

External links



Retrieved from "https://handwiki.org/wiki/index.php?title=Internet_Gateway_Device_Protocol&oldid=3433087"