Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PFsense - Multiple Xbox One(s) NAT Type Fail.

    Scheduled Pinned Locked Moved Gaming
    20 Posts 6 Posters 9.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jax7778
      last edited by

      I am not sure how much help I can be here, but I just finally got this working with 5 Xboxes with open nat and proper communication between them.

      First,  Follow this post about setting up manual outbound NAT on the PS4 from AhnHEL (works the same way on Xbox),

      https://forum.pfsense.org/index.php/topic,69319.msg384435.html#msg384435

      I have heard Hybrid NAT is easier, you might try that.  You give each xbox a DHCP reservation. Then you create a manual outbound rule at the top for their addresses, or their IP range, and check the box for static port.  Xboxes have a horrible time dealing with randomized ports, this is a problem on Microsoft's end NOT pfsense. Next setup Upnp as he/she instructs, (I did the optional step to restrict upnp to my xboxes only) This will give you open NAT > Then go to System > Advanced > NAT reflection > and set it to NAT+ Proxy.  Then Clear your Firewall states in Diagnostics > States > Reset States(this will kill internet for a couple of seconds, you will need to refresh) OR reboot your system and shutdown and kill power on your xboxes. Check in Settings > Network > Advanced Settings > on Xboxes and make sure they are picking up the IPs you assigned them. I did this setup, and I have 5 xboxes with open NAT and they can all now play together in one game and xbox party.

      I also added the rules on LAN from "databeestje" (Thank You) on the page below for multicast traffic, Also, after reading the setup more closely, AhnHEL's guide is just a more detailed explanation of the Upnp method on the Sticky, the sticky is just a little confusing because of the new updated interface. I would add enabling NAT Reflection: NAT + Proxy.

      Add these 2 allow rules on the LAN interface."

      *    LAN net    *    224.0.0.0/8    *    *    none          Allow Multicast
      *    LAN net    *    239.0.0.0/30    *    *    none        Allow Multicast

      NOTE: I am a newb with PFsense, I am an IT Technician in my daily life, but networking is one of my weaker areas.  A much more senior member recommended IPV6, and I am sure it is a better setup, this is working for me now, I will try Ipv6 as a project later.

      ALSO, The key to open nat seamed to be the Static port manual outbound NAT rule, and the key to us all being able to play together from one network, seamed to be NAT Reflection: NAT + Proxy.  If you can get Ipv6 working, that would be great! I would love to hear how it is working for you.  I know that NAT is not really part of ipv6, you can set one up, but you don't need too, and I assume that it is not this way by default, maybe your problem is in your firewall rules? I know the firewall will still be affecting traffic on Ipv6, and you need it too, since without NAT, that is the only thing between you and barracuda and shark riddled ocean that is the open internet.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Setting static nat for all ports is a borked configuration.  While it might some sort of mcgyver work around for broken configurations in console games.  It will cause issues at some point if your running multiple machines behind because what is suppose to happen here.

        So device1:portA –-> dest portX (nat device) publicIP:portA --- destIP:portX

        So that can work.. But now what happens when you have device2:portA as its source... How is the nat suppose to work?  That is the whole point of napt and sharing of 1 public IP..  when your different devices happen to use the same source port for some sort of communication on the public side of the nat, the natter ie pfsense in this case can just keep track of the connection and use a different FREE source port for the public side of the connection..

        With napt you end up with this

        device1:portA -- destIP:portX (nat) publicIP:portA --->destIP:portX
        device2:portA -- destIP:portX (nat) publicIP:portB --->destIP:portX
        device3:portA -- destIP:portX (nat) publicIP:portC --->destIP:portX
        etc..

        With static port mapping this breaks down as soon as you have more than 1 device trying to make connections to the outside with the same port.  this might rarely happen with a handful of devices but as you ramp up the number of devices behind your nat your odds of it happening ramp up as well.

        The use of ipv6 is suppose to fix all of these issues these games have with being behind a nat.. Since all the devices will have publicIP..  So if they want sure they can all use the same sourceport in the sessions since they all have their own IP.

        If your seeing issues with stating your strict NAT I would assume its testing your ipv4 and not your ipv6..  IPv6 has no nat, so how would it be anythingNAT?  But yes your going to have to make sure your firewall rules allow the traffic you want when you start using ipv6.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • W
          Wayne.C1972
          last edited by

          @johnpoz:

          If your seeing issues with stating your strict NAT I would assume its testing your ipv4 and not your ipv6..  IPv6 has no nat, so how would it be anythingNAT?  But yes your going to have to make sure your firewall rules allow the traffic you want when you start using ipv6.

          That  part I do understand.  Currently I believe I allow ALL ipv6 traffic for my gaming network (The network that my Xbox Ones are On) I think the problem lies within the XBox Ones. They dont seem to switch to IPv6 Only. They accept ipv6 and acquire local-link and global ipv6 address but they ALWAYS defer to the ipv4 network. But If I take and put both Xbox ones on my cheap Cisco (Linksys) E1000 IPv4 Only router with upnp…no problems at all! Why can that POS router work it out and pfsense cannot?

          ![Gaming Rules.JPG](/public/imported_attachments/1/Gaming Rules.JPG)
          ![Gaming Rules.JPG_thumb](/public/imported_attachments/1/Gaming Rules.JPG_thumb)

          2.3.4-RELEASE-p1 (amd64)
          built on Fri Jul 14 14:52:43 CDT 2017
          FreeBSD 10.3-RELEASE-p19
          Intel(R) Core(TM)2 Quad CPU Q8200 @ 2.33GHz
          4 CPUs: 1 package(s) x 4 core(s)
          8GB Ram
          Watchguard XTM 5 series firewall

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            while that rule allows your ipv6 out….  Where is your inbound rules.. How exactly do you have ipv6 setup?

            Native dual stack from isp, HE tunnel?

            Your inbound rules would have to be where inbound would be seen first, wan or your tunnel, etc.

            From outside trying to ping what of your IPv6 console IPs, do you see it allowed do you get an answer, or is blocked

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • W
              Wayne.C1972
              last edited by

              For Ipv6 I have Comcast which runs native ipv6.

              Using online ping test http://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-ping.php I am able to successfully ping my XBOX One at its ipv6 address

              Comcast_Wan.JPG
              Comcast_Wan.JPG_thumb

              2.3.4-RELEASE-p1 (amd64)
              built on Fri Jul 14 14:52:43 CDT 2017
              FreeBSD 10.3-RELEASE-p19
              Intel(R) Core(TM)2 Quad CPU Q8200 @ 2.33GHz
              4 CPUs: 1 package(s) x 4 core(s)
              8GB Ram
              Watchguard XTM 5 series firewall

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                ok I see 42 states open via ipv6.. so is your stuff working now?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • W
                  Wayne.C1972
                  last edited by

                  @johnpoz:

                  ok I see 42 states open via ipv6.. so is your stuff working now?

                  Currently I have verified IPv6 working and I have IPv4 NAT Type OPEN for both XBox ones. But I still have many connection issues. I am pretty sure that pfsense is causing the connection problems. I believe pfsense CANNOT properly negotiate the Upnp traffic for both console even thou I have NAT Type OPEN.

                  2.3.4-RELEASE-p1 (amd64)
                  built on Fri Jul 14 14:52:43 CDT 2017
                  FreeBSD 10.3-RELEASE-p19
                  Intel(R) Core(TM)2 Quad CPU Q8200 @ 2.33GHz
                  4 CPUs: 1 package(s) x 4 core(s)
                  8GB Ram
                  Watchguard XTM 5 series firewall

                  1 Reply Last reply Reply Quote 0
                  • S
                    savagews6
                    last edited by

                    @Wayne.C1972:

                    @johnpoz:

                    ok I see 42 states open via ipv6.. so is your stuff working now?

                    Currently I have verified IPv6 working and I have IPv4 NAT Type OPEN for both XBox ones. But I still have many connection issues. I am pretty sure that pfsense is causing the connection problems. I believe pfsense CANNOT properly negotiate the Upnp traffic for both console even thou I have NAT Type OPEN.

                    I've been in the works on configuring my dads Xbox One and triggering port forwards. All of my other applications, qBittorrent, OpenVPN ports are working correctly. I've done multiple NAT changes that I've found around reddit and here. Best I got was Moderate NAT, but then I lost it and back to strict. Unfortunately no experience with the Xbox One on 2.2.6 but curious if that is any different.

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      "But I still have many connection issues"

                      Do you have static ports set for everything?  Like I said that sort of config is BORKED!!!  And yeah your going to have issues with that sort of setup..  A port here or there when only 1 thing would be using the ports at a time ok… But you can not just say all ports static when you have devices wanting to use the same ports and other devices using napt (network address port translation) to share the 1 public IP.

                      If you want multiple consoles for ipv4, then you really should have multiple IPv4 addresses..  It amazes me that it would still use ipv4 if it can do ipv6.  Every other OS on the planet if has ipv6 prefers it over ipv4, and won't even use it unless ipv6 isn't available for what its trying to do.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • W
                        W4RH34D
                        last edited by

                        It only works for me with manual outbound nat with per device static port entries in the outbound nat rules for allow any udp to that device.  I could make it more secure but I have a "gaming" subnet with more lax rules.

                        Did you really check your cables?

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.