UPnP port mapping and gateway control

UPnP gateway port mapping asks a compatible gateway to maintain an inbound endpoint association, with granted mapping details and lifetime distinct from complete server reachability.

Automatic port mapping gives an application a way to request an inbound mapping from a compatible gateway. UPnP discovery first helps locate the gateway service; a later control operation requests the mapping.

Finding a gateway and changing its traffic association are different operations.

The request identifies a concrete service destination

The standardized WANIPConnection service describes port-mapping operations. Their roles include the external port, protocol, internal client/port and mapping lifetime.

Use this original reduced granted result:

{
  "gateway": "G1",
  "protocol": "TCP",
  "externalPort": 45000,
  "internalClient": "192.168.50.20",
  "internalPort": 8920,
  "acceptedAtSeconds": 100,
  "grantedLeaseSeconds": 600
}

It is explanatory JSON, not a SOAP request or native gateway reply. The exercise assumes the mapping was granted with the shown details.

That result says G1 maintains the declared TCP association. It does not say an internal listener was created or another external gateway accepted a corresponding rule.

A granted lifetime needs an owner

In this model, six hundred granted seconds from time one hundred gives expiry at seven hundred. Continued use requires the appropriate supported renewal or another valid lifetime arrangement.

Observation Meaning
Gateway service discovered A control candidate was located
Mapping request accepted The gateway accepted its declared mapping operation
Current entry/lifetime confirmed The association is presently represented there
Outside service request succeeds The complete connection path worked

A router restart, changed allocation or expired lease can invalidate a mapping while a client retains the old server URL.

Exact lifetime rules vary by service version and implementation. A request’s desired duration should not be substituted for the duration actually granted.

The gateway’s policy controls exposure

A port-mapping service changes the inbound reachability of a selected endpoint. Which clients can request it and which destinations it permits are gateway-control policy decisions.

UPnP device/service versions and their protection capabilities are documented in the OCF catalogue. A particular household device’s implemented policy is a separate fact.

A discovery advertisement alone does not authenticate every later control operation.

Emby can attempt this separate stage

Emby’s network documentation describes automatic mapping through UPnP when the gateway supports and permits it.

A successful local operation still leaves the internal firewall, service readiness and any upstream translation boundary to evaluate. Under double NAT, G1 can be only the inner router.

With CGNAT, the household’s mapping result does not establish a corresponding operator-controlled path.

See Also

References