Alright homeslice. First things first we need a mod to move this to gaming.

Secondly, I cannot let this go unhelped because you're clearly playing games originally released on the best system ever, and what kind of gamer would I be if I let this continue?!

OK, now that THATS out of the way, do you have UPnP enabled?  You mentioned wireshark, do you have packet caps for the host attempting the traversal mode? What is your current nat/firewall rule setup regarding this?

Hope to get you online asap so you can smash.

No issue here with my PS4. Try to assign to PS4 the outbound nat rule as "static".
https://forum.pfsense.org/index.php?topic=69319.0

Xbox only uses 3074 for inbound everything else is outbound only, if 3074 is not available it will pick a random high port to try and UPNP forward.

I'm also getting the same problem did anyone give any suggestion how solve this problem?

@jimp:

172.168?

Perhaps that's a typo in the source addresses?

And that first outbound NAT rule for a destination of the switch will never be hit. It isn't necessary, remove it.

…we use 172 first octet at work...derp. I crossed the wires. I'll change that.

Edit: Xboxs' NAT is now open so I'd imagine the switch is resolved as well. Thanks for your assistance.

As far as I know the UPnP service on pfSense does not set up static port outbound NAT for the connections which is a key piece for having open NAT on the games. The UPnP service does only the port forwarding part for you.

I reverted back to 2.2.6 and have 3 Xbox One's UPNP with static Nat, All 3 of us can play the same game in the same lobby with no problem. The problem seemed to happen when they went to 2.3 it broke something. Just downgrade to 2.2.6 setup like normal and your good to go.

@GettCouped:

Firewall rules were set up according to specified.

By this, do you mean that the Firewall rules for the LAN Interface that the PC is connected to were setup per Ubisoft AND the Firewall/NAT/Port Forwards were also setup to forward the unsolicited inbound to the PC and added the corresponding firewall rules?

Do you see any blocked packets in your firewall logs on your WAN interface when you start up the game?

Also, what uPnP port is your PC getting?

Probably be good to post some screen shots of your config.

Step 1. DHCP Static Mapping
Step 2. Outbound NAT rule & mapping order (put it at the top)
Step 3. NAT Port forwards
Step 4. UPnP Config
Step 5. Firewall rules

At a minimum, your firewall rules should allow traffic to port 1900 for the uPnP SSDP discovery broadcast, and to port 2189 to talk to the miniupnpd server

Also, to diagnose this, you can either do a Diagnostics - Packet Capture on your PC and comb through the capture to map out your traffic OR setup a Floating Match rule to log all traffic in & out of your PC into the firewall log.  Then correlate those to WAN block/pass events.

Here's what I found with ours;

The XB1 running CoD sets up a Demonware port in UPnP and makes a connection to the Demonware (Activision CoD) server using the server port 3074 as the destination.
However, Demonware then makes a separate connection from a different server on server port 3075 to port 3076 on your public IP address.  It only does this once.  pfSense CE's normal behaviour is to block this unsolicited traffic.

As soon as I created a NAT forward source: Any:3075 destination: WAN address:3076 to the XB1 & the associated firewall rule, I got open NAT in CoD. (Now of course I changed Any to the Demonware IPs for better security, but this was just for the test)

So it seems,
If you are not forwarding (nor permitting in the firewall rules) port 3076 to your XB1, you will get NAT type moderate in CoD.
If you are forwarding (and permitting in the firewall rules) port 3076 to your XB1, you should get NAT type open in CoD.

Of course, this Demonware/Activision server configuration/behavior means that only 1 XB1 can get an open NAT type in CoD due to the NAT forwarding of port 3076 to only 1 XB1.  We have multiple XBox's & PC's, so only 1 XB1 can get an open NAT type in CoD.

In your case, you might want to verify that you have a NAT forward & permit rule of inbound WAN destination port 3076 to your PC.  In fact, I would suggest logging this traffic so that you can see the inbound successful connection.  Because if you don't see the inbound packet at all,  it means it's being blocked farther up your WAN (like your ISP)

Also, feel free to post a screen shot of your Status / UPnP&NAT-PMP page while the game is running (which should show your Teredo port & your Demonware port).

I'm not really sure on how DS2 runs in relation to using the internet. But my understanding was that if you aren't doing any kind of PVP, there is no ping involved in how you interact with NPC's.

This doesn't seem like a ping issue?

Have you tried running ping on other websites to see what your numbers were?

If you have other games on steam I know some games will show you what your ping is in game. Might want to check that out if you can?

@Isegrim:

I have a moderate nat on my ps4 and every other system, it depends on the game though, some games report an open nat despite the ps4 saying NAT Type 2 in the network section.
I did what most of the other users did: enabled upnp, static port and set up the necessary nat outbound rules. it works fine for me, i have no issues with VIOP, chat or connecting to games.

I have all that in place now as well but I recieved an Open NAT (some problems with my NAT type with Call of Duty games) but I read that having a Moderate NAT type can be expected with how pfSense works, and in other cases people will say they have a harder time getting connected to games.

Hello am new here, i also encountered this issue.

Just an observation, static ports are for outbound source ports, not what you want, you want to port forward inbound destination ports. (which technically would be outbound source ports on the replies the destination port would be what they sent in on and if you start rewriting that you are going to break the traffic at the firewall their end)

Did you ever get this resolved?

We have similar goals. Here is a link to my post

https://forum.pfsense.org/index.php?topic=123086.msg679804#msg679804

Your help will be greatly appreciated.

All think allright, os server oldest.

Novice question:  If I'm setting up a MineCraft server (on a separate FreeNAS box) located on my local LAN and I want others (i.e. my kid's friends) to be able to access the server from WAN, then this is the setup to use, correct?

Thanks!

It only works for me with manual outbound nat with per device static port entries in the outbound nat rules for allow any udp to that device.  I could make it more secure but I have a "gaming" subnet with more lax rules.