A Small-Office Router Audit: UPnP, Port Forwarding, Exposed Services and Safe Defaults

Why the router matters

Everything the office uses to reach the internet passes the router. It also decides what the internet can reach back. A misconfigured router can expose a camera recorder, a file share, a remote desktop port or its own admin page to anyone who looks. Attackers do look: scanning the whole IPv4 space for open services is cheap and constant.

What UPnP does and why it is risky

UPnP lets a device on the local network ask the router to open a port to the internet on its behalf, with no password and no human approval. Games consoles, cameras and some software use it. Discovery runs over SSDP on UDP port 1900, and the port-opening requests are a request to the router's Internet Gateway Device service. CISA's home network guidance says to disable UPnP when it is not needed, because malware on your network can use it to bypass the router's firewall, give attackers remote control of devices and spread. A small office rarely has a business need for it.

Step 1: Look at the router

Log in on the local network with an admin account. Write down the model and firmware version, then check each of these:

• Port forwarding or virtual server list: every entry, its external port, internal address and protocol.
• UPnP status and the list of current UPnP mappings. A mapping you did not create is a finding.
• DMZ host: a setting that sends all unmatched traffic to one device. It should be empty.
• Remote management or remote administration: whether the router's admin page is reachable from the internet.
• Other services on the router: Telnet, SSH, SNMP, FTP or file sharing, dynamic DNS, a built-in VPN server.
• Wi-Fi: WPA3 or WPA2 with a strong passphrase, WPS off, a separate guest network on its own segment.
• Firmware: whether the vendor still issues updates for the model. A router that no longer gets updates should be replaced.

Take a screenshot or export the configuration to the file where you keep the office's network records.

Step 2: Find what the internet can actually reach

The router's screens show intent. A scan from outside shows result. Using a connection that is not on the office network, such as a mobile hotspot, scan the office's public IP address for the TCP ports you expect to be closed. A simple port scanner with a service-detection option is enough. Add a UDP check for port 1900 and for other discovery services. Anything open that is not on your approved list is a finding.

Two cautions. First, only scan addresses you own or are authorized to test. Second, if your provider uses carrier-grade NAT, your office may not have a reachable public address at all, and forwards will not work from outside no matter what the router says. That is a risk reducer, not a control to rely on.

Services that should never face the internet directly: remote desktop, database ports, file sharing, camera and recorder web pages, printers, building controllers and the router's own admin page.

Step 3: Decide each forward

For every forward or mapping you found, record what it is for, who owns it, whether it can be replaced, and the next review date. Then choose:

• Remove it, if nobody can name the owner or the need.
• Replace it with a VPN or a remote access service that requires sign-in with MFA, so that nothing is exposed on a fixed port.
• Restrict it to a known source address if it has to stay and the source is stable.
• Keep it only for a service that is meant to be public, such as a website, and put that service in its own network segment with a firewall rule limited to what it needs.

Safe defaults to leave behind

• UPnP off, and NAT-PMP or similar automatic port mapping off too.
• No DMZ host.
• Remote administration off. Administer from the inside, or over the VPN.
• A unique admin password that is not the default, stored in the company's password manager, with a second admin account for continuity.
• Automatic firmware updates on where the vendor supports them, and a quarterly check where it does not.
• Guest Wi-Fi isolated from the office network. Cameras, printers and building systems on their own segment.
• Logging turned on and sent somewhere other than the router, if the model supports it.
• A note in the network records listing every forward, with owner and date.

When to repeat it

Repeat after any new device is installed, after a provider changes the modem, after a vendor visit and at least twice a year. NIST's guidelines on firewalls, SP 800-41 Rev. 1, are the older but still useful reference for the idea behind all of this: allow only the traffic you can justify and document it.

We run router and perimeter reviews for small offices as scoped, authorized work, including the outside scan, and leave you a short list of what changed.

Sources

• Home Network Security (CISA)
• Securing Network Infrastructure Devices (CISA)
• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy (NIST)

This article is general information, not legal or technical advice for your environment. Product menus, license names and provider rules change; check the vendor's current documentation before you act. Last reviewed November 9, 2026.

Next article

Next · SecurityReading DMARC Aggregate Reports in Practice: XML Fields, Alignment vs Pass, Unknown Senders, Forwarding and ARCA DMARC aggregate report is an XML file from a mailbox provider listing who sent mail as your domain and what happened to it. It looks dense, but only a few fields matter. This guide walks through them, explains why SPF or DKIM can pass while DMARC fails, and how to deal with forwarded mail and mailing lists.8 min read

Related reading

• SecurityMicrosoft Entra Privileged Identity Management for Small Tenants: Just-in-Time Roles, Approval and Break-Glass Accounts8 min
• SecurityA Teams and SharePoint Sharing-Links Audit: Anyone Links, Guest Access, Expiry and Sensitivity Labels7 min