How do you check your router’s port forwards?
UPnP can open a door from the internet to your PC with no password — and malware knows it. Here’s how to list every door your router has opened.
You check your router’s port forwards by asking the router to list them — either from its admin page or straight from Windows. Every inbound forward is a door from the public internet to a device inside your house. Most were opened automatically by UPnP, and any device on your network — including malware — can open one with no password. The job is to find any door leading to a sensitive service and shut it.
A door to the internet is only safe if you know it’s there.
What a port forward actually is
Your router sits between the internet and your home, and by default it blocks unsolicited connections coming in from outside. A port forward pokes a hole in that wall: it tells the router that traffic arriving on a given port should be sent to a specific device inside. That’s what lets a game server, a security camera, or a home lab be reachable from away.
UPnP automates this. Instead of you setting a forward by hand, a device asks the router to open the port for it. Convenient — but routers grant those requests to anyone on the network with no authentication, which is exactly why UPnP port-forward abuse is a real threat, not a theoretical one.
That’s the whole trick malware uses — one line, no password, no prompt. Tools like miniupnpc ask the router’s gateway to open a door and aim it at the infected PC:
# malware on the LAN asks the router to expose Remote Desktop to the internet upnpc -a 192.168.1.50 3389 3389 TCP # no admin login, no confirmation — the router just adds the forward
What a dangerous forward looks like
Not every port forward is bad — the question is which port and which device. A forward to a high, random port for a console or a media server is normal. A forward that exposes a remote-access or file-sharing service to the whole internet is not. Watch for:
- Remote Desktop (3389) forwarded to a PC — a favorite malware target.
- File sharing / SMB (445, 139, 135) reachable from the internet.
- SSH (22), Telnet (23) or WinRM (5985/5986) mapped to an inside machine.
- A forward you don’t recognize, pointing at a device you never set up.
Any of these is a door you almost certainly didn’t mean to open — and the kind malware opens on purpose to expose a machine for remote takeover.
List the forwards from Windows
The most reliable read is the router’s own port-map table — the live list of forwards it is advertising over UPnP. You can pull it directly from Windows with PowerShell, no extra software required:
# ask the router's UPnP gateway for every port-forward it is advertising
$nat = New-Object -ComObject HNetCfg.NATUPnP
$nat.StaticPortMappingCollection | ForEach-Object {
'{0} -> {1}:{2} ({3})' -f $_.ExternalPort, $_.InternalClient, $_.InternalPort, $_.Protocol
}
# read the ExternalPort column and flag any of these sensitive services:
# 3389 RDP · 445/139/135 SMB · 22 SSH · 23 Telnet · 5985/5986 WinRM · 5900 VNC
# nothing printed usually means UPnP is off or the router has no IGD — good.
If PowerShell returns nothing, your router either has UPnP disabled or exposes no gateway to query — both are safe outcomes. If you’d rather not use PowerShell, the free miniupnpc tool prints the same table with upnpc -l, and every router admin page has a “Port Forwarding” or “UPnP” screen that lists the forwards visually.
Nothing is spoofed, so nothing looks wrong
UPnP abuse is nasty precisely because it breaks nothing. There’s no forged ARP, no poisoned DNS, no rerouted traffic — the router is doing exactly what it was designed to do. That makes it invisible to ARP, DNS and traffic-based detectors: they’re watching for lies on the wire, and there aren’t any. The attack lives in a legitimate feature.
It’s also easy to miss by hand. A busy router can carry a dozen forwards, most of them harmless, and a single hostile 3389 mapping blends right in. The only dependable way to catch it is to read the whole table and compare every mapping against the list of ports that should never face the internet.
Catching it automatically
WifiThreatWatch audits your router’s UPnP port-map table for you and flags any enabled mapping that exposes a sensitive service port to the internet — telling you which inside device the door leads to and which service is on the other side. Legitimate forwards to high, random ports never trip it, so a flag means a door worth closing.
Go deeper: how UPnP port-forward abuse works · rogue devices on your network · the threats library
Port forwards: quick answers
How do I check what ports my router has forwarded?
Log into your router’s admin page and open the “Port Forwarding” or “UPnP” section — it lists every open inbound port and the device it points to. On Windows you can also ask the router directly with a short PowerShell command using the HNetCfg.NATUPnP COM object, which prints the router’s current UPnP port-map table. Anything mapping a sensitive service port (RDP 3389, SMB 445, SSH 22) from the internet to a PC is a red flag.
Is UPnP dangerous?
UPnP itself is a convenience feature, not malware — it lets consoles and apps open the ports they need automatically. The danger is that routers grant UPnP requests to any device on the network with no password, so malware can use it to open a door from the public internet to your PC. That’s why security-conscious users turn UPnP off unless they specifically need it.
Can malware open a port on my router without my password?
Yes. If UPnP is enabled, any program running on your network — including malware — can ask the router to forward an inbound port to a machine inside your house, and the router complies without prompting anyone. This is how some malware exposes Remote Desktop or file sharing straight to the internet, then connects from anywhere to take over the PC.
What ports should never be exposed to the internet?
For a home network, remote-access and file-sharing services should stay inside: RDP (3389), SMB/file sharing (445, 139, 135), SSH (22), Telnet (23), WinRM (5985, 5986) and VNC (5900). If any of these show up as an inbound port forward on your router, remove it and investigate what asked for it. Legitimate UPnP forwards use high, random ports instead.
How do I turn off UPnP?
Log into your router’s admin page (usually 192.168.1.1 or 192.168.0.1), find the UPnP setting — often under Advanced, NAT Forwarding, or WAN — and disable it, then save and reboot. Existing UPnP forwards may need to be cleared manually from the port-forwarding list. After that, forward ports by hand only for services you actually run.