Thank you very much for your help.

Going to test it today or tomorrow!

//edit:

Do you have the same setup (router infront of the PfSense) ?

Whats the difference between the Port Forward section and the Outbound section under Firewall -> NAT ?

Do I need to set the Automatic outbound nat to Manual outbound nat?

Why did you used the Outbound section?

Best regards

"completely unfiltered and connect only to the WAN interface."

Do you have more than 1 public IP from your isp?  You can not do what your asking with 1 IP that you would need for your other devices.

As to xbox live not working.  Should be simple port forward of 88 tcp, 3074 tcp/udp, 5060-5061 udp.  Your not blocking outbound traffic are you?

pfSense comes with a packet sniffer.  I don't have it in front of me right now, but I think it's under Diagnostics - Packet Capture.  Select your interface, do your thing to make it fail and then use Wireshark to follow the flow and see if you can see the problem.

I assume you've already used the Firewall log to check for blocked traffic from their IP space?

Thanks for your input johnpoz!

@johnpoz:

Or you could have the tenant put their devices that need inbound services directly on your pfsense lan.  So put a switch in front of their router, now their router gets 172.16.1.2 and their ps4 or whatever gets 172.16.1.3 for example.

This ended up being our recommendation.

We already have "protectected port" setup (Cisco switches) separating each tenant, though they're on the same subnet. I'm not very keen on re-designing the network, which otherwise works great. Hence the recommendation :)

Thanks!

I fixed it by creating a static ip address for the 3ds in the dhcp server.

I then created a manual out band rule in the firewall>Nat> settings like this

Interface:WAN
IP: 192.168.9.200 (or what ever your ip address for the nintendo is)

Static PORT: YES

everything else is as defaults.

Save settings and i rebooted just to be sure.

Works 100% of the time now

Hope that helps

Richard

Also some tips here about some oddities with GFWL and this game:

http://forums.steampowered.com/forums/showthread.php?t=2959611

@Bai Shen

would you mind posting a screenshot for this solution?
we still encountered issues in warframe

"Strict NAT detected. Upnp malfunctioning. Please forward  udp ports 4950 and 4955 to 192.168.1.32"

i did this already:
1. upnp enable (sevices>UPnp)
2. select Manual Outbound NAT rule

created 3 rules same below since we have 3dsl lines (in routing mode)
interface: wan1/wan2/wan3
source: 192.168.1.0/24
source port: blank
destination: any
destination port: blank
NAT address: default
NAT port: blank
Static port: CHECK

thank you

@dsekclub:

I tried what I could be like you were.

You can log in to steam as a player. But connet a counterstrike server that manages
the first computer possibly a second computer. To start more computers and connect a counterstrike server, these computers will not be connected without the game freezes, or a message stoped after 10 retries. Closes the first computer that is inside the gameserver, then any of those other computers connects, but not as easily its lookslike there is interference.

It seems that pfsense can not handle traffic from another router and traffic to Steam Game Servers with out interference. Interference increases as more computers starts.

Is this a new bug?

More people with some problem or have solution ?

Regards Kip3r

Check your Snort alerts if you are using it. I noticed that the Emerging Threats sigs pick up Justin.tv as a trojan.

This is a month old topic, but perhaps this will help someone.  If you are having problems connecting between the subnets and you have firewall rules that allow to pass between the interfaces, my guess is that your game assumes you are in the same subnet.  Broadcast packets will not cross subnet boundaries.  Instead, you should bridge all of your interfaces and assign the bridge as the LAN interface so that it can all be in the same subnet.  This will make the pfSense act as a switch on those physical interfaces.  Broadcast packets will pass and the game will be visible on all of the bridged interfaces.

How many PC's are on your network?  There is so much dynamic content these days, squid probably isn't doing you any good anyway.  Not to mention, with today's broadband speeds, you'd be better off using the traffic shaper.

Uninstall Squid and report back.

just try to delete those two rules below and enable uPnP in services>uPnP

Hi guys,

so i've still been trying to get this sorted out.  Ever since i started messing with the xb1, i haven't been able to get my 360 to work correctly.

when i follow the instructions to use upnp with my machines, the connections work great.  Last night i had both machines working perfect with open nat.  When i checked this morning, my xb1 has strict nat again and cannot obtain a Teredo IP address.  if i clear my upnp, reset states, and reboot, it clears and i can open my nat.  its as if my connections wont clear after I turn an xbox off.

I don't even know where to begin looking or loggin to see where the issue is.

any guidance would be greatly welcomed.

Thanks

Diablo 3 is using these remote ports : 1119 TCP/UDP (mainly uses this) and 6881-6999 UDP
if you create a lan rule containing these remote ports with a queue, it would solve your problem

You don't do it based on ports, you make your rules based on the IP address.  That way you don't have to worry about ports.  As long as you have all traffic to/from your PS4 going into qGames, that's all you need to do.

I did a lookup on one of the IP addresses in your list and it's an Amazon AWS address.  A lot of game companies use AWS to distribute their stuff.  Perhaps that traffic was the PS4 downloading an update to one of your existing games?

i used a traffic shaper config xml and restored someone else's with it and it seems to help. can you help optimize and fix latency KOM?

thanks, that's my looking,too

yes I understand that is not a "pfsense"issue, i'm just looking for a working and secure setup with my pfsense box
I was not able to find a solution to forward broadcast traffic so I will use that bridge solution (unless someone can share a better one?)

about wlan, yes a dedicated AP is an option but I dont really need/want another device just for something that will be useless as soon as pfense 2.2 is released and I really want my atheros AR9280 to be used at full speed someday ;)

thanks

UPDATE -

I updated the micropc to the latest 32bit release and the issues have disappeared.

once change I made between the current setup and when I posted this was unblocking private networks on the WAN side as Comcast modems have a private network they use and I wanted to be able to check my modem status on regular basis.

For clarification - i386 version 2.1.1 pre-release dated 26 mar 1350EDT 2014 has fixed my issues.

BUMP +
I am having issues with this as well. I am not able to help but that is because I am a newb. Post back if you get your answer please. I am having same issues with other MMO's TERA Rising is one of them. But I think the HAVP package is causing this issue with TERA(they don't allow proxy), not sure.

Have  a Great DAY!