W6300使用UPnP协议访问路由器进行端口映射

本篇总结

W6300 实现 UPnP 协议，通过 SSDP（Simple Service Discovery Protocol）搜索 IGD 网关并以 SOAP 消息调用 AddPortMapping / DeletePortMapping / GetGenericPortMappingEntry 接口，实现路由器端口的动态映射、删除与查询。

硬件平台：本例程基于 W6300-EVB-M4 开发板运行。

采购推荐：点击前往 WIZnet 官方淘宝店铺 选购 W6300-EVB-M4 开发板

应用场景

通过 UPnP 端口转发功能，可以实现远程访问（将外部请求转发到局域网设备如 NAS、监控摄像头）和设备发现与即插即用（通过 UPnP 广播发现新设备，获取设备描述文件来获取服务和接口）。

1. 设备发现：W6300 通过 SSDP 向局域网发送组播请求（HTTP M-SEARCH），搜索支持 IGD 的网关设备。
2. 获取服务描述：W6300 访问网关设备获取服务描述文件，了解支持的服务和接口。
3. 订阅 IGD 事件：通过事件订阅，W6300 可在不主动轮询的情况下接收实时通知。
4. 调用服务接口：使用 UPnP 的 SOAP 消息调用 IGD 提供的端口映射接口。
5. 数据交互测试：外部通过访问映射的端口及路由器地址和局域网内部设备进行通信。

M-SEARCH * HTTP/1.1
Host:239.255.255.250:1900
ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1
Man:"ssdp:discover"
MX:3

M-SEARCH * HTTP/1.1：表明是一个搜索请求。
Host：多播地址和端口。
ST：搜索目标类型，这里是 IGD 设备。
MX：最大响应时间，设备需要在 3 秒内返回响应。
Man：搜索请求类型，固定值。

HTTP/1.1 200 OK
ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1
USN:uuid:34ca819a-9d18-34ca-819a-9d180098c02d::urn:schemas-upnp-org:device:InternetGatewayDevice:1
Location: http://192.168.2.1:5431/dyndev/uuid:34ca819a-9d18-34ca-819a-9d180098c02d
Server: Custom/1.0 UPnP/1.0 Proc/Ver
EXT:
Cache-Control:max-age=30
DATE: Fri, 16 Oct 2026 08:45:56 GMT

HTTP/1.1 200 OK：表示响应成功。
CACHE-CONTROL：响应有效时间为 30 秒。
LOCATION：设备描述文件的 URL。
SERVER：设备的操作系统、UPnP 版本和设备名称。
USN：唯一设备标识符。

GET /dyndev/uuid:34ca819a-9d18-34ca-819a-9d180098c02d HTTP/1.1
Accept: text/xml, application/xml
User-Agent: Mozilla/4.0 (compatible; UPnP/1.0; Windows NT/5.1)
Host: 192.168.2.1:5431
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache

HTTP/1.0 200 OK
SERVER: LINUX/2.6 UPnP/1.0
DATE: Fri, 16 Oct 2026 08:45:56 GMT
CONTENT-TYPE: application/octet-stream
Connection: Close

<?xml version="1.0"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">
...
<device>
<deviceType>urn:schemas-upnp-org:device:WANConnectionDevice:1</deviceType>
<serviceList>
<service>
<serviceType>urn:schemas-upnp-org:service:WANIPConnection:1</serviceType>
<serviceId>urn:upnp-org:serviceId:WANIPConn1</serviceId>
<controlURL>/uuid:34ca819a-9d18-34ca-819a-9d180298c02d/WANIPConnection:1</controlURL>
<eventSubURL>/uuid:34ca819a-9d18-34ca-819a-9d180298c02d/WANIPConnection:1</eventSubURL>
<SCPDURL>/dynsvc/WANIPConnection:1.xml</SCPDURL>
</service>
</serviceList>
</device>
...
</root>

SUBSCRIBE /uuid:34ca819a-9d18-34ca-819a-9d180298c02d/WANIPConnection:1 HTTP/1.1
Host: 192.168.2.1:5431
USER-AGENT: Mozilla/4.0 (compatible; UPnP/1.1; Windows NT/5.1)
CALLBACK: <http://192.168.2.26:5002/>
NT: upnp:event
TIMEOUT: Second-1800

HTTP/1.1 200 OK
Content-Type: text/xml;charset=UTF-8
Content-Length: 0
Connection: close
Server: Custom/1.0 UPnP/1.0 Proc/Ver
Timeout: Second-1800
SID: uuid:...

POST /uuid:34ca819a-9d18-34ca-819a-9d180298c02d/WANIPConnection:1 HTTP/1.1
Content-Type: text/xml; charset="utf-8"
SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping"
Host: 192.168.2.1:5431
Content-Length: 1131
Connection: Keep-Alive

<?xml version="1.0"?>
<SOAP-ENV:Envelope ...>
<SOAP-ENV:Body>
<m:AddPortMapping xmlns:m="urn:schemas-upnp-org:service:WANIPConnection:1">
<NewRemoteHost></NewRemoteHost>
<NewExternalPort>12345</NewExternalPort>
<NewProtocol>TCP</NewProtocol>
<NewInternalPort>8000</NewInternalPort>
<NewInternalClient>192.168.2.26</NewInternalClient>
<NewEnabled>1</NewEnabled>
<NewPortMappingDescription>W6300_uPnPGetway</NewPortMappingDescription>
<NewLeaseDuration>0</NewLeaseDuration>
</m:AddPortMapping>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

m:AddPortMapping：添加端口映射
NewExternalPort：外部端口号
NewProtocol：协议类型（TCP/UDP）
NewInternalPort：内部端口号
NewInternalClient：内部地址

POST /uuid:34ca819a-9d18-34ca-819a-9d180298c02d/WANIPConnection:1 HTTP/1.1
Content-Type: text/xml; charset="utf-8"
SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#DeletePortMapping"
Host: 192.168.2.1:5431
Content-Length: 604
Connection: Keep-Alive

<?xml version="1.0"?>
<SOAP-ENV:Envelope ...>
<SOAP-ENV:Body>
<m:DeletePortMapping xmlns:m="urn:schemas-upnp-org:service:WANIPConnection:1">
<NewRemoteHost></NewRemoteHost>
<NewExternalPort>12345</NewExternalPort>
<NewProtocol>TCP</NewProtocol>
</m:DeletePortMapping>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

m:DeletePortMapping：删除端口映射
NewExternalPort：外部端口号
NewProtocol：协议类型
NewRemoteHost：外部访问来源，可以为空

wizchip_initialize();
network_init(ethernet_buf, &default_net_info);

UserLED_Control_Init(set_user_led_status);

do
{
    printf("Send SSDP.. \r\n");
} while (SSDPProcess(SOCKET_ID) != 0); /* SSDP Search discovery */

/* SSDP Header */
unsigned char SSDP[] = "\
M-SEARCH * HTTP/1.1\r\n\
Host:239.255.255.250:1900\r\n\
ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1\r\n\
Man:\"ssdp:discover\"\r\n\
MX:3\r\n\
\r\n\
";

signed char SSDPProcess(SOCKET sockfd)
{
    ...
    unsigned char mcast_addr[4] = {239, 255, 255, 250};
    unsigned char mcast_mac[6]  = {0x01, 0x00, 0x5E, 0x7F, 0xFF, 0xFA};

    close(sockfd);

    setSn_DHAR(sockfd, mcast_mac);
    setSn_DIPR(sockfd, mcast_addr);
    setSn_DPORT(sockfd, PORT_SSDP);
    setSn_MR(sockfd, Sn_MR_UDP);
    setSn_PORTR(sockfd, PORT_SSDP);
    setSn_CR(sockfd, Sn_CR_OPEN);
    while (getSn_CR(sockfd));

    if (getSn_SR(sockfd) != SOCK_UDP) return -1;

    /* Send SSDP M-SEARCH */
    if (sendto(sockfd, SSDP, strlen((char *)SSDP), mcast_addr, PORT_SSDP, 4) <= 0)
        printf("SSDP Send error!!!!!!!\r\n");

    /* Receive Reply: skip NOTIFY, only accept 200 OK */
    endTime = my_time + 3;
    while (my_time < endTime)
    {
        recv_len = recvfrom(sockfd, (unsigned char *)recv_buffer, RECV_BUFFER_SIZE,
                            recv_addr, &recv_port, &addr_len);
        if (recv_len <= 0) continue;
        if (strstr(recv_buffer, "HTTP/1.1 200 OK") == NULL) continue;
        if ((ret_value = parseSSDP(recv_buffer)) == 0)
        {
            UPnP_Step = 1;
            close(sockfd);
            return 0;
        }
    }
    close(sockfd);
    return -1;
}

W6300 多播发送

SSDP 的 M-SEARCH 必须发到多播地址 239.255.255.250:1900。W6300 的 sendto() 对多播地址需要手动指定目的 MAC，否则芯片会走 ARP 解析导致超时。这里通过 setSn_DHAR() 设置多播 MAC 01:00:5E:7F:FF:FA（239.255.255.250 对应的多播 MAC），让芯片直接按这个 MAC 发帧。

if (GetDescriptionProcess(SOCKET_ID) == 0)  /* GET IGD description */
{
    printf("GetDescription Success!!\r\n");
}
else
{
    printf("GetDescription Fail!!\r\n");
}

W6300 分块接收

W6300 默认每个 socket 的 RX 缓存为 2KB，单次 recv() 最多只能读 2KB。IGD 设备描述 XML 可能超过 2KB，一次读不完会导致 controlURL / eventSubURL 解析失败。因此源码里新增 upnp_recv_response() 函数，循环分块读取并拼接，直到读到结束标记（如 </root>）或超时。

if (SetEventing(SOCKET_ID) == 0)  /* Subscribes IGD event messages */
{
    printf("SetEventing Success!!\r\n");
}
else
{
    printf("SetEventing Fail!!\r\n");
}

Main_Menu(SOCKET_ID, SOCKET_ID + 1, SOCKET_ID + 2,
          ethernet_buf, tcps_port, udps_port);  /* Main menu */

if (strcmp(choice, "7") == 0)
{
  printf("\r\nType a Protocol(TCP/UDP) : ");
  GetInputString(msg);
  strncpy(protocol, msg, 3);
  protocol[3] = '\0';

  printf("\r\nType a External Port Number : ");
  GetInputString(msg);
  external_port = ATOI(msg, 10);

  printf("\r\nType a Internal Port Number : ");
  GetInputString(msg);
  internal_port = ATOI(msg, 10);
  tcps_port = internal_port;
  close(sn2);

  wizchip_getnetinfo(&net_info);
  memcpy(Sip, net_info.ip, sizeof(Sip));
  sprintf(ipaddr, "%d.%d.%d.%d", Sip[0], Sip[1], Sip[2], Sip[3]);

  ret = AddPortProcess(sn, protocol, external_port, ipaddr, internal_port, "W6300_uPnPGetway");
  if (ret == 0)
      printf("AddPort Success!!\r\n");
  else
      printf("AddPort Error Code is %d\r\n", ret);
}

if (strcmp(choice, "8") == 0)
{
  printf("\r\nType a Protocol(TCP/UDP) : ");
  GetInputString(msg);
  strncpy(protocol, msg, 3);
  protocol[3] = '\0';

  printf("\r\nType a External Port Number : ");
  GetInputString(msg);
  external_port = ATOI(msg, 10);

  ret = DeletePortProcess(sn, protocol, external_port);
  if (ret == 0)
      printf("DeletePort Success!!\r\n");
  else
      printf("DeletePort Error Code is %d\r\n", ret);
}

if (strcmp(choice, "9") == 0)
{
    bTreat = SET;

    ret = GetGenericPortMappingEntriesProcess(sn);
    if (ret == 0)
        printf("\r\nListPortMappings Success!!\r\n");
    else
        printf("\r\nListPortMappings Error Code is %d\r\n", ret);
}

请注意

测试实例需要 W6300 接入在支持 UPnP 端口转发的路由器下。