UPnP#

Services → UPnP lets devices on the network, such as game consoles, ask the router to open ports for themselves, over UPnP and NAT-PMP. Wheelhouse answers these requests itself. Each port it opens is a port forward and a matching firewall rule, applied to the router's configuration like any other change, so each one appears in the history.

The page is in the menu once UPnP / NAT-PMP is installed from Apps, and while UPnP is on.

UPnP is off until an administrator turns it on, and nothing listens until the WAN interface, the LAN interface and the client subnets are chosen. From then on, every device on those subnets can open ports for itself, unless requests are held for approval. UPnP needs a licence, and the agent has to run on the router.

Turning UPnP on#

Under Settings, turn on UPnP.
Choose the WAN interface, where ports are opened, and the LAN interface, whose devices are answered. Both lists are the router's own interfaces.
Under Client subnets, add the networks whose devices may ask for ports. A device can ask for ports only for itself.
Choose the Mode: Open ports automatically, or Hold requests for approval, which lists each request on this page until an operator approves or declines it.
Press Save changes.

The settings are saved at once; they do not go to the pending changes. Changing them needs the administrator role and a licence. Each field is checked before anything is saved, and says what is missing under it, such as "Choose the WAN interface." or "Add at least one client subnet." Discard changes puts the form back as it was.

Turning UPnP off stops new requests. Mappings that are already open stay open until they expire or are removed.

Limits#

Field	Default	What it does
Lowest external port, Highest external port	1024, 65535	The external ports a device may ask for.
Longest mapping	3600 seconds	A longer request is shortened to this. 60 to 604800 seconds.
Maximum mappings	200	Up to 200: one for each rule number from 4000 to 4199.
Changes per minute	6	Requests beyond this are refused. 1 to 60.
Control port	5000	The port UPnP clients connect to on the router's LAN address.
Reuse expired mappings	Off	When every mapping is in use, the oldest expired one is removed to make room.
Answer discovery on every address	Off	Off, discovery is answered on the LAN interface only.

The page#

The badge beside the title reads off, not running, on, or on, approval needed.
Messages at the top say who can open ports, such as "Devices on 192.0.2.0/24 can open ports through the firewall without approval.", and anything that needs attention: a mapping whose port could not be closed, every mapping in use, rules in UPnP's range that UPnP did not write, or a router with no usable licence ("This router has no usable licence, so port requests are refused. Discovery still answers.").
Tiles: Mappings, out of the maximum and with the number expired; Open ports; External address, the WAN interface's; and Changes this minute, against the limit.
Status: Discovery (SSDP), Port mapping (UPnP) and Port mapping (NAT-PMP), each listening or not listening, with its address, or the reason it could not listen. An agent that is not on the router says so here.
Mappings: one row for each port a device asked for.

Column	Shows
Rule	The mapping's number, from 4000 to 4199.
State	open, expired, awaiting approval, still open, retrying (closing it failed and is being retried), or still open (closing it failed; remove it to close the port).
External port	The port and protocol opened on the WAN interface.
Device	The address and port the traffic is forwarded to.
Description	What the device called the mapping. It is never written to the router's configuration.
Asked by	UPnP, NAT-PMP, or Earlier session for UPnP rules an earlier run of the agent left in the configuration, which this one lists as expired rather than overwrites.
Expires	The time left.

A row's buttons, which need the operator role:

Approve, for a request awaiting approval, adds its port forward and firewall rule to the pending changes. The port opens when they are applied with Apply changes.
Remove, pressed again when it reads Remove mapping 4007?, deletes the mapping's rules and closes its port at once: "Mapping 4007 was removed and its port is closed."
Decline, for a request, and Forget, for a mapping, take it off the list without changing the router's rules.

In Advanced mode, What one mapping adds shows the rules a mapping writes.

How mappings are kept#

UPnP uses rule numbers 4000 to 4199 in destination NAT and in the forward filter, and each rule's description names the device and when the mapping expires. Keep your own rules outside that range: a new mapping replaces a rule there. While UPnP is installed, the NAT and Firewall pages carry an offer that says so.
When a mapping expires, its rules are turned off rather than deleted. Remove deletes them.
A NAT-PMP request's sender cannot be verified, so the client subnets are the whole of the protection, and a mapping only ever points at the device that asked for it.
The port-mapping part of UPnP is supported, which is what game consoles and BitTorrent clients use. IPv6 firewall control is not: those requests are refused.

For automation#

Method	Path	Role	What it does
GET	`/api/upnp`	viewer	The settings, the listeners, the mappings, the tiles' figures and the messages.
PUT	`/api/upnp`	administrator, with a licence	Saves the settings.
DELETE	`/api/upnp/mappings/{id}`	operator, with a licence	Removes a mapping's rules and closes its port.
DELETE	`/api/upnp/mappings/{id}?forget=1`	operator, with a licence	Takes a mapping or a request off the list without changing the rules.