Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Nintendo Switch connection issue Error code

    Scheduled Pinned Locked Moved Gaming
    nintendoupnpstatic mappingaclnat
    55 Posts 5 Posters 11.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JonathanLeeJ
      JonathanLee @mcury
      last edited by

      @mcury Yes I protect the web browser from specific sites. Child Safe system.

      Screenshot 2023-10-09 at 10.06.40 AM.jpg

      (It works great with many games like this)
      (F-ZERO X Online 99 players Racing game)
      Screenshot 2023-10-09 at 10.07.56 AM.jpg
      (Proxy use is approved of for Nintendo Switch)

      Nintendo Does not block proxy use, they approve of it. But this connection test may check for a proxy right? That is why it has NAT B over NAT A but it should still do a upload test ok right?

      Make sure to upvote

      M 1 Reply Last reply Reply Quote 1
      • M
        mcury @JonathanLee
        last edited by

        @JonathanLee When you get the error code: 2160-8055 (upload test fails), what shows up in Squid ?

        Since you are using transparent proxy, you won't be able to bypass that specific domain, but you can check their network IP range in https://whois.domaintools.com/.

        After getting their network range, can you try to bypass that network in Squid settings and test again ?

        dead on arrival, nowhere to be found.

        JonathanLeeJ 1 Reply Last reply Reply Quote 0
        • JonathanLeeJ
          JonathanLee @mcury
          last edited by JonathanLee

          @mcury a simple connection test thats shows good https response

          Screenshot 2023-10-09 at 10.16.48 AM.png

          ctest-ul-lp1.cdn.nintendo.net//upload
          ctest-dl-lp1.cdn.nintendo.net//download

          both show ok in proxy too

          Maybe . . .

          Screenshot 2023-10-09 at 10.13.08 AM.png stun port forward???

          Make sure to upvote

          M 1 Reply Last reply Reply Quote 0
          • M
            mcury @JonathanLee
            last edited by

            @JonathanLee I can see that Squid is intercepting SSL connections.
            Can you do a quick test ? Disable SSL interception for one second, test again and confirm the results..

            Then enable it again.

            If the test passes, you would need to bypass that network completely from Squid.

            I mean, better to bypass the entire network than a single IP address because they usually change.

            dead on arrival, nowhere to be found.

            JonathanLeeJ 1 Reply Last reply Reply Quote 0
            • JonathanLeeJ
              JonathanLee @mcury
              last edited by JonathanLee

              @mcury it is splice always for Nintendo already so it is transparent for this device

              Screenshot 2023-10-09 at 10.20.59 AM.png

              Make sure to upvote

              M M 2 Replies Last reply Reply Quote 0
              • M
                michmoor LAYER 8 Rebel Alliance @JonathanLee
                last edited by

                @JonathanLee Its sitll passing through the proxy.
                Can you set this up so it doesnt use the proxy at all. Have it hit a firewall rule instead.?

                Firewall: NetGate,Palo Alto-VM,Juniper SRX
                Routing: Juniper, Arista, Cisco
                Switching: Juniper, Arista, Cisco
                Wireless: Unifi, Aruba IAP
                JNCIP,CCNP Enterprise

                JonathanLeeJ 1 Reply Last reply Reply Quote 0
                • JonathanLeeJ
                  JonathanLee @michmoor
                  last edited by JonathanLee

                  @michmoor That would defeat the URL blocker/child safe features without the proxy. It has a web browser on it.

                  Make sure to upvote

                  1 Reply Last reply Reply Quote 0
                  • M
                    mcury @JonathanLee
                    last edited by mcury

                    @JonathanLee Splice all still messes up with the headers and break SSL chain since the proxy is now doing the request for the website and thus it is not a SSL connection between Nintendo Switch and nintendo.net anymore.

                    The problem I'm seeing here is that nintendo.net is using akamai.. so a bypass won't help in this situation because you won't want to bypass akamai..

                    dead on arrival, nowhere to be found.

                    JonathanLeeJ M 2 Replies Last reply Reply Quote 0
                    • JonathanLeeJ
                      JonathanLee @mcury
                      last edited by

                      @mcury Dang it. I guess it has to stay broken. The SSL stops at the modem in our LAN. O well.

                      Make sure to upvote

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        mcury @JonathanLee
                        last edited by

                        @JonathanLee said in Nintendo Switch connection issue Error code:

                        Dang it. I guess it has to stay broken. The SSL stops at the modem in our LAN. O well.

                        Is it possible to set the proxy only in the Nintendo Switch browser and not in the OS ?
                        If it isn't, perhaps you could set a password in the browser to block the use of it ?

                        dead on arrival, nowhere to be found.

                        JonathanLeeJ 1 Reply Last reply Reply Quote 1
                        • JonathanLeeJ
                          JonathanLee @mcury
                          last edited by JonathanLee

                          @mcury @michmoor

                          Thanks for working with me on this.

                          The Nintendo switch does work for all NAT B games and for his online account. Disney Speed racing game must require NAT A to work is all I think. So he has a lot of options to have fun with still that let the URL blocker work correctly.

                          I flat out love Nintendo's version of LAN options over XBOX's. Nintendo just lets you input a proxy. XBOX wont do it, it was such a pain to set up the XBOX, it needed WPAD and after that it needed special DHCP options to tell the XBOX where to go, and special spice options just to have the Child Safe URL blocker work. It was really illusive over Nintendo's simple plug the proxy in and go option. Don't get me wrong XBOX has it's items I like too.

                          STUN is new to me I have never played with that until today. I wonder if it will improve anything here or not?

                          Make sure to upvote

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            mcury @JonathanLee
                            last edited by

                            @JonathanLee said in Nintendo Switch connection issue Error code:

                            STUN is new to me I have never played with that until today. I wonder if it will improve anything here or not?

                            STUN is used to tell a server which IP/UDP port to use in the communication.
                            Sometimes it is just the voice communication in the game that doesn't work properly.
                            Sometimes is just you won't be able to host a game, but only connect to existing games in the server, things like that.

                            dead on arrival, nowhere to be found.

                            1 Reply Last reply Reply Quote 0
                            • M
                              michmoor LAYER 8 Rebel Alliance @mcury
                              last edited by

                              @mcury said in Nintendo Switch connection issue Error code:

                              The problem I'm seeing here is that nintendo.net is using akamai..

                              That right there is going to break Squid in Transparent mode
                              @JonathanLee As you are already aware there is an issue with Squid and quickly rotating IPs to Domain Names. So the suggestion to bypass the proxy all together should be considered.

                              Firewall: NetGate,Palo Alto-VM,Juniper SRX
                              Routing: Juniper, Arista, Cisco
                              Switching: Juniper, Arista, Cisco
                              Wireless: Unifi, Aruba IAP
                              JNCIP,CCNP Enterprise

                              JonathanLeeJ 1 Reply Last reply Reply Quote 0
                              • JonathanLeeJ
                                JonathanLee @michmoor
                                last edited by JonathanLee

                                @michmoor That might be resolved once PfSense adds unbound support for DoH. Unbound already supports it, just pfSense does not have the GUI options for it yet.

                                I don't have the issues you have, again I only use A DNS records because my ISP does not allow IPv6. The Nintendo works mostly for everything I need.

                                Make sure to upvote

                                1 Reply Last reply Reply Quote 0
                                • JonathanLeeJ
                                  JonathanLee
                                  last edited by JonathanLee

                                  I have learned it does use STUN for something check this out.

                                  My Nintendo SW is 192.168.1.17 This is a STUN port accessing Google stun

                                  Screenshot 2023-10-10 at 3.49.42 PM.png

                                  34.132.225.91 is Google, I assume because of the port used its a STUN server for Nintendo port 3478 I added a supress to that IP for it.

                                  Screenshot 2023-10-10 at 4.00.20 PM.png

                                  Make sure to upvote

                                  1 Reply Last reply Reply Quote 0
                                  • JonathanLeeJ
                                    JonathanLee
                                    last edited by JonathanLee

                                    I created a PCAP file when this connection test runs it seems like it has a lot of RST from the firewall itself this is when the connection fails right after

                                    Capture.PNG

                                    8 nil-aas(3128) -> 10316 [RST]

                                    keep in mind I do have a WAN floating traffic shaping rule running.

                                    Any ideas?

                                    Make sure to upvote

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @JonathanLee
                                      last edited by

                                      @JonathanLee well your nintendoswitch keeps sending ack, after the lee_family sent a fin,ack - so yeah if NS keeps talking to LF with sending acks, LF is going to keep telling it to F off with a RST..

                                      Not sure where pfsense comes into play in this conversation. Is this traffic routed over pfsense? 3128 is proxy port, so this NS wants to keep this conversation going after LF has told its done with the fin,ack..

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                      • JonathanLeeJ
                                        JonathanLee @johnpoz
                                        last edited by JonathanLee

                                        @johnpoz yes Squid proxy 3128 this is during the Nintendo Switch Network test it does an upload test right after the Nintendo Switch shows I have NAT type B next it does a download test that passes goes to UL test and this is in the PCAP. It has a ton right before it fails. LF my SG-2100. I wonder if I can increase the connection timers or something

                                        https://bugs.squid-cache.org/show_bug.cgi?id=5084

                                        Make sure to upvote

                                        M 1 Reply Last reply Reply Quote 0
                                        • M
                                          mcury @JonathanLee
                                          last edited by mcury

                                          @JonathanLee said in Nintendo Switch connection issue Error code:

                                          @johnpoz yes Squid proxy 3128 this is during the Nintendo Switch Network test it does an upload test right after the Nintendo Switch shows I have NAT type B next it does a download test that passes goes to UL test and this is in the PCAP. It has a ton right before it fails. LF my SG-2100. I wonder if I can increase the connection timers or something

                                          https://bugs.squid-cache.org/show_bug.cgi?id=5084

                                          I wonder if in Nintendo Switch, you could use a .pac file instead of setting the proxy by IP address and port, or, if there is a configuration field such as "Do not proxy connections for this destinations"..

                                          If this field existis in the Nintendo Switch proxy configuration, try to include nintendo.net there.

                                          Or, perhaps, if it is possible, try this .pac file in the Nintendo Switch configuration:

                                          This is the .pac file I used to have in a few customers back in the day that I was using squid..

                                          function FindProxyForURL(url, host) {
                                          //BYPASS POR REGEX
                                              if (isPlainHostName(host) ||
                                                  shExpMatch(host, "*.home.arpa") ||
                                          //BYPASS BY DESTINATIONS NETWORK
                                                  isInNet(dnsResolve(host), "10.0.0.0",  "255.0.0.0") ||
                                                  isInNet(dnsResolve(host), "172.16.0.0",  "255.240.0.0") ||
                                                  isInNet(dnsResolve(host), "192.168.0.0",  "255.255.0.0") ||
                                                  isInNet(dnsResolve(host), "127.0.0.0", "255.255.255.0") ||
                                          //LOCAL SITES
                                                  dnsDomainIs(host, "mywebsite.home.arpa") ||
                                          //Windows and Nintendo Switch
                                                  dnsDomainIs(host, "windowsupdate.com") ||
                                                  dnsDomainIs(host, "live.com") ||
                                                  dnsDomainIs(host, "microsoft.com") ||
                                                  dnsDomainIs(host, "nintendo.net") ||
                                          //Other
                                                  dnsDomainIs(host, "whatsapp.com"))
                                                return "DIRECT";
                                          if (isInNet(myIpAddress(), "192.168.1.0", "255.255.255.0"))
                                          return "PROXY pfsense.home.arpa:3128";
                                          }
                                          

                                          Edit: If you follow this route, bypass Nintendo's Switch IP address from the transparent proxy.

                                          dead on arrival, nowhere to be found.

                                          JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                          • JonathanLeeJ
                                            JonathanLee @mcury
                                            last edited by

                                            @mcury I like your pac WPAD file, however Nintendo does allow for Proxy use, meaning it should not have to bypass it. I have found a bug reported in bugzilla that matches the half closed issue. Your auto configuration file for me opens to many addresses. I do like the .arpa return direct I will use that for my internal devices thanks.

                                            Make sure to upvote

                                            M 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.