Strange NAT results double NAT and UPnP

Gblenn

In the past I had some trouble getting Open NAT on a few games, and in particular Modern Warfare 2 (2009). One solution I found back then, was to place another router, with UPnP, between pfsense and the gaming PC.

Since a few releases back and the updates made to UPnP, this is no issue at all with pfsense. Although External Interface for UPnP can still not be set to e.g. Failover gateway, which I think is unfortunate.

Anyway, playing around with another firewall (Sophos) I have not been able to get anyting other than Strict NAT on this game. But as I remembered this "trick" with double routers from the past, I decided to try this with Sophos, and it worked!!
In fact, for MW2 I don't even have to open any port at all in the Sophos firewall... for other games I get Moderate NAT unless I create firewall rule to allow port 3074 as well as both DNAT and reflexive rule for that port, with the second firewall as the internal "target".

Can someone explain what might be happening behind the scenes here? And possibly come up with a solution that may work on firewalls without UPnP. On pfsense the workaround I actually used, involved hybrid outbound nat and setting static port for the rules involved there...
https://forum.netgate.com/topic/169837/upnp-fix-for-multiple-clients-consoles-playing-the-same-game/108

Also, when playing MW2 through pfsense, now when UPnP works for this game, UPnP status page shows two lines with external ports 28960 and 28961, both with 28960 as the internal port.

johnpoz

@Gblenn said in Strange NAT results double NAT and UPnP:

One solution I found back then, was to place another router, with UPnP, between pfsense and the gaming PC.

Not sure what you think that would do - it sure wouldn't open the port from the internet.

internet -- (wan) Nat Router 1 (lan) ---- (wan) Nat router 2 (UpnP) (lan) ---- PC

Unless you forwarded all ports router 1 to send to router 2 wan.. That pc could open all the ports it wants on router 2, and nothing would come in unsolicited from the internet..

Gblenn

@johnpoz Well, it's not really about what I was thinking it would do, it's what actually happened...

I am able to get Open NAT on most games with a NAT and a FW rule in Sophos for port 3074 UDP. But there seems to be no way to make MW2 even get to Moderate NAT. Yet, with UPnP in between the game and Sophos, or pfsense in the past, it just works...

Now, if I could get this to work with the right rules, I could potentially turn off UPnP in pfsense (my main firewall) and feel a little bit more secure, right.
Why this even popped up was because I just managed to get a second IP from my ISP which made playing around with different firewalls and configs a lot more convenient. And most importantly I can do it without disturbing the peace at home...

Anyway, many, or most, games require you to open some ports in the router in order to be able to do certain things. Just playing a game on a public server may not be an issue, even when the game reports Strict NAT. The game, as does every application, will reach out using whatever port it is designed to use and find e.g. Deamonware servers to get the list of active servers to play on.

But if you want to host a game, to play with your friends, you have to have at least Moderate NAT. And Open NAT is desired since also those with Strict will be able to access your server then.

So for most or all other games that are being played in our home, it's as simple as looking up what ports to forward, and add the rules, and you typically get Open NAT.
Which is what I wrote in reference to opening port 3074 on Sophos, to get Open NAT on the other games, when behind the second router. And this works fine also when directly connected to Sophos.

For most games this is enough:
internet -- (wan) Nat rule Port 3074 Router 1 (lan) ---- (wan) Nat router 2 (UpnP) (lan) ---- PC

But the game in question is using ports in a strange way, and I can't figure out what's going on. Even if you open all the ports that are listed for that game, you still get Strict NAT. And if you ONLY use UPnP, all that shows up in pfsense Status page are Ports 28960 and 28961. So these have been requested as port forwards alhtough both show internal port 28960 (which is the port listed to be opened if playing on one PC).
Like I also mentioned, to get this to work in earlier versions of pfsense, before some updates in UPnP, you had to use Hybrid Outbound NAT and make sure to set Static Port in the Translation section. I'm thinking there is some clue here as to what is going on?

And when I now have placed a second router with UPnP in between, it is handling this "translation" in the way the game likes it. Whilst on the uplink side, is is "playing nice and pure" in terms of which port(s) it is using to reach the internet.

I think I need to do some pcap to see what is going on in the different scenarios.