Mac® Security Bible

15.5. Using NAT-PMP or UPnP

So far in this chapter, I've explained two methods by which a computer outside your network can directly contact a computer inside the network, even when using NAT: port forwarding and a DMZ host. One problem with these two methods is that they require manual configuration of your router or gateway, which decreases your network's security in the process. Another problem is that they each make only one computer available for any given service. What if you want to (or have to) use NAT, but you also want to be able to reach more than one of your Macs from outside your network?

A number of methods exist to make this possible, at least in limited situations. Of these, the most popular are NAT-PMP (NAT Port Mapping Protocol), which was designed by Apple, and UPnP (Universal Plug and Play). If your gateway (the device that connects your network to the Internet and functions as a NAT router — which may also be a switch, modem, and/or wireless access point) supports one of these two protocols, you can usually enable it by clicking a check box. Thereafter, the gateway performs what amounts to an automated version of port forwarding whenever your Mac runs software that supports NAT traversal. Examples include BitTorrent and other file-sharing clients, some chat software, and Back to My Mac, a MobileMe feature that lets you do file and screen sharing with a Mac on a remote network. NAT-PMP and UPnP don't expose all your devices or every port on a given device to ...