diff --git a/firewall.yml b/firewall.yml
index 5fc95871..abda6a31 100644
--- a/firewall.yml
+++ b/firewall.yml
@@ -2,6 +2,12 @@ UPNP: false
 ipv4:
   TCP: [22, 25, 53, 80, 137, 138, 139, 443, 445, 5222, 5269, 5280, 6767, 7676]
   UDP: [53, 137, 138]
+  upnp:
+    TCP: [22, 25, 53, 80, 137, 138, 139, 443, 445, 5222, 5269, 5280, 6767, 7676]
+    UDP: [53, 137, 138]
 ipv6:
   TCP: [22]
   UDP: [53]
+  upnp:
+    TCP:
+    UDP:
diff --git a/yunohost_firewall.py b/yunohost_firewall.py
index 98b4dc3f..9df35802 100644
--- a/yunohost_firewall.py
+++ b/yunohost_firewall.py
@@ -39,7 +39,6 @@ except ImportError:
 from yunohost import YunoHostError, win_msg
 
 
-
 def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False):
     """
     Allow connection port/protocol
@@ -52,21 +51,21 @@ def firewall_allow(protocol=None, port=None, ipv6=None, upnp=False):
 
     """
     port = int(port)
-    if (upnp):
-        add_portmapping(protocol, upnp, ipv6,'a')
+    if upnp:
+        add_portmapping(protocol, upnp, ipv6, 'a')
 
     if 0 < port < 65536:
         if protocol == "Both":
-            update_yml(port, 'TCP', 'a', ipv6)
-            update_yml(port, 'UDP', 'a', ipv6)
+            update_yml(port, 'TCP', 'a', ipv6, upnp)
+            update_yml(port, 'UDP', 'a', ipv6, upnp)
 
         else:
-            update_yml(port, protocol, 'a', ipv6)
+            update_yml(port, protocol, 'a', ipv6, upnp)
 
         win_msg(_("Port successfully openned"))
 
     else:
-        raise YunoHostError(22, _("Port not between 1 and 65535 : ")+ str(port))
+        raise YunoHostError(22, _("Port not between 1 and 65535:") + str(port))
 
     return firewall_reload(upnp)
 
@@ -85,10 +84,10 @@ def firewall_disallow(protocol=None, port=None, ipv6=None, upnp=False):
 
     port = int(port)
     if protocol == "Both":
-        update_yml(port, 'TCP', 'r', ipv6)
-        update_yml(port, 'UDP', 'r', ipv6)
+        update_yml(port, 'TCP', 'r', ipv6, upnp)
+        update_yml(port, 'UDP', 'r', ipv6, upnp)
     else:
-        update_yml(port, protocol, 'r', ipv6)
+        update_yml(port, protocol, 'r', ipv6, upnp)
     win_msg(_("Port successfully closed"))
 
     return firewall_reload(upnp)
@@ -100,10 +99,11 @@ def firewall_list():
 
 
     """
-    with open ('firewall.yml') as f:
+    with open('/etc/yunohost/firewall.yml') as f:
         firewall = yaml.load(f)
     return firewall
 
+
 def firewall_reload(upnp=False):
     """
     Reload all firewall rules
@@ -112,22 +112,22 @@ def firewall_reload(upnp=False):
         upnp -- upnp
 
     """
-    with open('firewall.yml', 'r') as f:
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
-    os.system ("iptables -P INPUT ACCEPT")
-    os.system ("iptables -F")
-    os.system ("iptables -X")
-    os.system ("iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT")
+    os.system("iptables -P INPUT ACCEPT")
+    os.system("iptables -F")
+    os.system("iptables -X")
+    os.system("iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT")
 
     if 22 not in firewall['ipv4']['TCP']:
         update_yml(22, 'TCP', 'a', False)
 
-    if(os.path.exists("/proc/net/if_inet6")):
-        os.system ("ip6tables -P INPUT ACCEPT")
-        os.system ("ip6tables -F")
-        os.system ("ip6tables -X")
-        os.system ("ip6tables -A INPUT -m state --state ESTABLISHED -j ACCEPT")
+    if os.path.exists("/proc/net/if_inet6"):
+        os.system("ip6tables -P INPUT ACCEPT")
+        os.system("ip6tables -F")
+        os.system("ip6tables -X")
+        os.system("ip6tables -A INPUT -m state --state ESTABLISHED -j ACCEPT")
 
     if 22 not in firewall['ipv6']['TCP']:
         update_yml(22, 'TCP', 'a', False)
@@ -135,21 +135,21 @@ def firewall_reload(upnp=False):
     if upnp:
         remove_portmapping()
 
-    add_portmapping('TCP', upnp, False,'r');
-    add_portmapping('UDP', upnp, False,'r');
+    add_portmapping('TCP', upnp, False, 'r')
+    add_portmapping('UDP', upnp, False, 'r')
 
-    if(os.path.exists("/proc/net/if_inet6")):
-        add_portmapping('TCP', upnp, True,'r');
-        add_portmapping('UDP', upnp, True,'r');
+    if os.path.exists("/proc/net/if_inet6"):
+        add_portmapping('TCP', upnp, True, 'r')
+        add_portmapping('UDP', upnp, True, 'r')
 
-    os.system ("iptables -A INPUT -i lo -j ACCEPT")
-    os.system ("iptables -A INPUT -p icmp -j ACCEPT")
-    os.system ("iptables -P INPUT DROP")
+    os.system("iptables -A INPUT -i lo -j ACCEPT")
+    os.system("iptables -A INPUT -p icmp -j ACCEPT")
+    os.system("iptables -P INPUT DROP")
 
-    if(os.path.exists("/proc/net/if_inet6")):
-        os.system ("ip6tables -A INPUT -i lo -j ACCEPT")
-        os.system ("ip6tables -A INPUT -p icmp -j ACCEPT")
-        os.system ("ip6tables -P INPUT DROP")
+    if os.path.exists("/proc/net/if_inet6"):
+        os.system("ip6tables -A INPUT -i lo -j ACCEPT")
+        os.system("ip6tables -A INPUT -p icmp -j ACCEPT")
+        os.system("ip6tables -P INPUT DROP")
 
     os.system("service fail2ban restart")
     win_msg(_("Firewall successfully reloaded"))
@@ -157,7 +157,7 @@ def firewall_reload(upnp=False):
     return firewall_list()
 
 
-def update_yml(port=None, protocol=None, mode=None, ipv6=None):
+def update_yml(port=None, protocol=None, mode=None, ipv6=None, upnp=False):
     """
     Update firewall.yml
     Keyword arguments:
@@ -165,39 +165,60 @@ def update_yml(port=None, protocol=None, mode=None, ipv6=None):
         port -- Port to open
         mode -- a=append r=remove
         ipv6 -- Boolean ipv6
+        upnp -- Boolean upnp
 
     Return
         None
     """
-    if ipv6: ip = 'ipv6'
-    else:    ip = 'ipv4'
+    if ipv6:
+        ip = 'ipv6'
+    else:
+        ip = 'ipv4'
 
-    with open('firewall.yml', 'r') as f:
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
     if mode == 'a':
         if port not in firewall[ip][protocol]:
             firewall[ip][protocol].append(port)
 
+        elif upnp:
+            if port not in firewall[ip]['upnp'][protocol]:
+                firewall[ip]['upnp'][protocol].append(port)
+            else:
+                raise YunoHostError(22, _("Port already openned :") + str(port))
+
         else:
-            raise YunoHostError(22,_("Port already openned :")+ str(port))
+            raise YunoHostError(22, _("Port already openned :") + str(port))
 
     else:
-        if port in firewall[ip][protocol]:
-            firewall[ip][protocol].remove(port)
+        if upnp:
+            if port in firewall[ip]['upnp'][protocol]:
+                firewall[ip]['upnp'][protocol].remove(port)
 
+            else:
+                raise YunoHostError(22, _("Upnp redirection already deleted :") + str(port))
         else:
-            raise YunoHostError(22,_("Port already closed :")+ str(port))
+            if port in firewall[ip]['upnp'][protocol]:
+                firewall[ip]['upnp'][protocol].remove(port)
 
+            else:
+                raise YunoHostError(22, _("Upnp redirection alreadu deleted :") + str(port))
+
+            if port in firewall[ip][protocol]:
+                firewall[ip][protocol].remove(port)
+
+            else:
+                raise YunoHostError(22, _("Port already closed :") + str(port))
     firewall[ip][protocol].sort()
 
-    os.system("mv firewall.yml firewall.yml.old")
+    os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
 
-    with open('firewall.yml', 'w') as f:
+    with open('/etc/yunohost/firewall.yml', 'w') as f:
         yaml.dump(firewall, f)
 
 
-def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,):
+def add_portmapping(protocol=None, upnp=False, ipv6=None, mode=None,):
     """
     Send a port mapping rules to igd device
     Keyword arguments:
@@ -210,32 +231,36 @@ def add_portmapping(protocol=None, upnp=False, ipv6=None,mode=None,):
         None
     """
     if ipv6:
-        os.system ("ip6tables -P INPUT ACCEPT")
+        os.system("ip6tables -P INPUT ACCEPT")
     else:
-        os.system ("iptables -P INPUT ACCEPT")
+        os.system("iptables -P INPUT ACCEPT")
 
-    if upnp and mode=='a':
+    if upnp and mode == 'a':
         remove_portmapping()
 
-    if ipv6: ip = 'ipv6'
-    else:    ip = 'ipv4'
-    with open('firewall.yml', 'r') as f:
+    if ipv6:
+        ip = 'ipv6'
+    else:
+        ip = 'ipv4'
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
-    for i,port in enumerate (firewall[ip][protocol]):
+    for i, port in enumerate(firewall[ip][protocol]):
         if ipv6:
-            os.system ("ip6tables -A INPUT -p "+ protocol +" -i eth0 --dport "+ str(port) +" -j ACCEPT")
+            os.system("ip6tables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT")
         else:
-            os.system ("iptables -A INPUT -p "+ protocol +" -i eth0 --dport "+ str(port) +" -j ACCEPT")
+            os.system("iptables -A INPUT -p " + protocol + " -i eth0 --dport " + str(port) + " -j ACCEPT")
         if upnp:
-            upnpc = miniupnpc.UPnP()
-            upnpc.discoverdelay = 200
-            nbigd = upnpc.discover()
-            if nbigd:
-                upnpc.selectigd()
-                upnpc.addportmapping(port, protocol, upnpc.lanaddr, port, 'yunohost firewall : port %u' % port, '')
+            if port in firewall[ip]['upnp'][protocol]:
+                upnpc = miniupnpc.UPnP()
+                upnpc.discoverdelay = 200
+                nbigd = upnpc.discover()
+                if nbigd:
+                    upnpc.selectigd()
+                    upnpc.addportmapping(port, protocol, upnpc.lanaddr, port, 'yunohost firewall : port %u' % port, '')
+
+    os.system("iptables -P INPUT DROP")
 
-    os.system ("iptables -P INPUT DROP")
 
 def remove_portmapping():
     """
@@ -253,15 +278,16 @@ def remove_portmapping():
             upnp.selectigd()
         except:
             firewall_reload(False)
-            raise YunoHostError(167,_("No upnp devices found"))
+            raise YunoHostError(167, _("No upnp devices found"))
     else:
         firewall_reload(False)
-        raise YunoHostError(22,_("Can't connect to the igd device"))
+        raise YunoHostError(22, _("Can't connect to the igd device"))
 
     # list the redirections :
     for i in xrange(100):
         p = upnp.getgenericportmapping(i)
-        if p is None: break
+        if p is None:
+            break
         upnp.deleteportmapping(p[0], p[1])
 
 
@@ -272,18 +298,18 @@ def firewall_installupnp():
 
     """
 
-    with open('firewall.yml', 'r') as f:
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
-    firewall['UPNP']=True;
+    firewall['UPNP'] = True
 
     os.system("touch /etc/cron.d/yunohost-firewall")
     os.system("echo '*/50 * * * * root yunohost firewall reload -u>>/dev/null'>/etc/cron.d/yunohost-firewall")
     win_msg(_("UPNP cron installed"))
 
-    os.system("mv firewall.yml firewall.yml.old")
+    os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
 
-    with open('firewall.yml', 'w') as f:
+    with open('/etc/yunohost/firewall.yml', 'w') as f:
         yaml.dump(firewall, f)
 
 
@@ -293,36 +319,38 @@ def firewall_removeupnp():
 
 
     """
-    with open('firewall.yml', 'r') as f:
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
-    firewall['UPNP']=False;
+    firewall['UPNP'] = False
 
     try:
         os.remove("/etc/cron.d/yunohost-firewall")
     except:
-        raise YunoHostError(167,_("UPNP cron was not installed!"))
+        raise YunoHostError(167, _("UPNP cron was not installed!"))
 
     win_msg(_("UPNP cron removed"))
 
-    os.system("mv firewall.yml firewall.yml.old")
+    os.system("mv /etc/yunohost/firewall.yml /etc/yunohost/firewall.yml.old")
 
-    with open('firewall.yml', 'w') as f:
+    with open('/etc/yunohost/firewall.yml', 'w') as f:
         yaml.dump(firewall, f)
 
+
 def firewall_checkupnp():
     """
     check if UPNP is install or not (0 yes 1 no)
 
 
     """
-    with open('firewall.yml', 'r') as f:
+    with open('/etc/yunohost/firewall.yml', 'r') as f:
         firewall = yaml.load(f)
 
         if firewall['UPNP']:
             win_msg(_("UPNP is activated"))
         else:
-            raise YunoHostError(167,_("UPNP not activated!"))
+            raise YunoHostError(167, _("UPNP not activated!"))
+
 
 def firewall_stop():
     """
@@ -331,13 +359,12 @@ def firewall_stop():
 
     """
 
-    os.system ("iptables -P INPUT ACCEPT")
-    os.system ("iptables -F")
-    os.system ("iptables -X")
+    os.system("iptables -P INPUT ACCEPT")
+    os.system("iptables -F")
+    os.system("iptables -X")
 
-    os.system ("ip6tables -P INPUT ACCEPT")
-    os.system ("ip6tables -F")
-    os.system ("ip6tables -X")
+    os.system("ip6tables -P INPUT ACCEPT")
+    os.system("ip6tables -F")
+    os.system("ip6tables -X")
     if(os.path.exists("/etc/cron.d/yunohost-firewall")):
         firewall_removeupnp()
-