Firewall Filter, NAT and Mangle · Topic 4 of 6
NAT Helpers and UPnP
Learn how RouterOS NAT helpers fix protocols such as FTP and SIP behind NAT, and how UPnP lets LAN applications open ports on the router by themselves.
- 5 min
- NAT helpers rewrite data inside the payload and expect related connections.
- Helpers are managed in
/ip firewall service-port, and each can be disabled. - Helper traffic arrives in the related state, so the firewall must allow related.
What it is
NAT helpers and UPnP are two ways to make applications work through NAT.
Plain NAT only rewrites the IP and port fields in the packet header.
Some protocols also carry addresses or ports inside the data, or open extra connections that the router cannot predict. A helper reads that data and fixes it. UPnP lets an application ask the router to open a port for it.
The two are separate features, but they share a goal and a risk. Both change how traffic crosses the router without a rule that you wrote by hand.
How it works
Helpers act on traffic automatically, while UPnP acts on requests from hosts.
NAT helpers
A helper is also called a connection tracking helper or a service port. It looks inside the payload of one protocol, rewrites any embedded address or port, and tells connection tracking that a second connection is expected. That second connection then arrives in the related state.
Typical cases are FTP in active mode, where the server connects back to a port the client announced inside the control channel, and SIP, where addresses appear inside the signalling messages. The helpers are listed in the service port menu.
/ip firewall service-port print
/ip firewall service-port set ftp disabled=yesThe list includes protocols such as ftp, tftp, sip, h323 and pptp. The exact list depends on the RouterOS version. Each entry can be enabled or disabled, and some have a ports parameter that sets which ports the helper watches.
Helpers work because the firewall allows related traffic. A forward rule that accepts connection-state=established,related lets the helper-driven connection pass.
| Situation | What the helper does |
|---|---|
| FTP active mode behind srcnat | Rewrites the address in the control message and lets the data connection in as related |
| SIP behind srcnat | Rewrites addresses in the signalling so the call setup is correct |
| Helper not needed | Disable it to save work and to avoid side effects |
A helper sometimes breaks a protocol instead of fixing it, for example when the application already handles NAT itself. If voice or file transfers misbehave, test with the relevant helper disabled.
UPnP
UPnP is a protocol that lets a LAN application discover the router and ask for a port mapping. Games, chat tools and media software use it to become reachable from outside without manual port forwarding. The router side is the Internet Gateway Device role.
The service is off by default and is enabled in the UPnP menu. You must also say which interface is inside and which is outside.
/ip upnp set enabled=yes
/ip upnp interfaces add interface=ether2 type=internal
/ip upnp interfaces add interface=ether1 type=externalThe internal interface faces the LAN, where applications send their requests. The external interface faces the internet, where the mappings are applied.
What UPnP creates
When an application asks for a mapping, the router adds a dynamic NAT rule. It is a dstnat rule that forwards traffic from the external side to the host and port that asked. You can see these rules with /ip firewall nat print, where dynamic rules carry a flag.
The rules are removed when the application cancels the mapping. You cannot normally edit them, because the router manages them.
Security
UPnP trusts any host on the internal side. A compromised PC or an IoT device can open ports on the router without your knowledge. Many administrators keep it disabled on business networks and write fixed dstnat rules instead.
A forward filter rule is still needed if your firewall drops by default. Check that the rule order allows the translated traffic that UPnP sets up.
Enable UPnP only where you need it, and always set the external interface to the real WAN interface, never to a LAN port.
What to remember for the exam
Seven facts cover most questions on this topic.
- NAT helpers rewrite data inside the payload and expect related connections.
- Helpers are managed in
/ip firewall service-port, and each can be disabled. - Helper traffic arrives in the related state, so the firewall must allow related.
- UPnP lets a host ask the router to open a port, and it is configured under
/ip upnp. - UPnP needs one internal and one external interface defined with
/ip upnp interfaces. - UPnP adds dynamic dstnat rules to the NAT table.
- UPnP is convenient but trusts every internal host, so it carries a security risk.
Common mistakes
These four mistakes appear often.
Blocking related traffic. The helper then cannot deliver its second connection.
Leaving every helper enabled. An unused or faulty helper can break traffic, so disable the ones you do not need.
Setting the interface types the wrong way round. UPnP then listens on the wrong side, or applies mappings on the LAN.
Enabling UPnP on a router that is behind another NAT. Its external address is private, so the mappings are useless to the internet.
Check yourself
Work through these three questions.
Why does FTP active mode need a NAT helper?
The server connects back to a port announced inside the control data, and the helper rewrites it and allows the new connection as related.
Where do you disable a NAT helper?
In
/ip firewall service-port, by disabling the entry for that protocol.What does UPnP add to the NAT table when an application asks for a port?
A dynamic dstnat rule that forwards traffic from the external side to that host and port.
Topic 4 of 6 in Firewall Filter, NAT and Mangle
Test yourself on Firewall Filter, NAT and Mangle
The full MikroTik MTCTCE question bank has 479 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.