Nintendo Switch & Switch 2 - Needs static port on its outbound NAT

AkiraSensei

Sorry for reviving an old post but should I disable static ports on all other mappings? For example, the automatically created rules for localhost to WAN, LAN to WAN, OPT1 to WAN, etc.? I also have multiple game systems that require the static port on. Is it all right to have static ports on all of them ON at the same time? I'm still very new to pfSense (this is my post here, in fact!).

Falcon-OSX

Thank you very much a very simple and elegant solution. You made my son very happy. I will be adding other console to help with gaming.

Thank Again. :)

Derelict

@AkiraSensei:

Sorry for reviving an old post but should I disable static ports on all other mappings? For example, the automatically created rules for localhost to WAN, LAN to WAN, OPT1 to WAN, etc.? I also have multiple game systems that require the static port on. Is it all right to have static ports on all of them ON at the same time? I'm still very new to pfSense (this is my post here, in fact!).

As long as they do not need the same source port to talk with the same destination address:port it should be OK. There can only be one state for each local_wan_ip:port <-> remote_ip:port combination. Setting static port just means that the source port is left untranslated when connections are made outbound. If the local machine connects using source port 55000, then that port will be used on the WAN interface as the source port. Without static set, the port can be randomly selected from the ephemeral port space (1024 to 65535) and translated on WAN.

dazedman

this solved my problem on both the wii u and switch. thank you!

blue_smoke

Hi thank you for this guide. I had problems getting the NAT type from a D to a C or B even after following your steps but I eventually figured out what was happening.

In the step below, I found that the Mappings order was important. I originally added the rule as the last entry. When I moved the Mappings entry up above the other LAN entries I started getting NAT type B.

@jimp:

…

3. Add Outbound NAT rule

Firewall > NAT, Outbound tab

Click +

Set the console address as the source (Type = Network, then enter the IP address, pick /32 for the CIDR)

Check Static Port

Save/Apply

...

reilos

Well, i did exactly this, but my switch still says its type D :(

Maybe someone sees anything I missed here: https://forum.pfsense.org/index.php?topic=141535.0

c4bcons

I posted this in a different thread by accident ….

having some trouble here - I'm getting the error Nintendo code:

error code: 2618-0516
NAT traversal process has failed
etc…

I've attached the firewall/nat/outbound screen - have I missed anything?

firewall_nat_outbound.png_thumb

jimp

@c4bcons:

I posted this in a different thread by accident ….

having some trouble here - I'm getting the error Nintendo code:

error code: 2618-0516
NAT traversal process has failed
etc…

I've attached the firewall/nat/outbound screen - have I missed anything?

Looks like your NAT rule is set on the internal (LAN) interface when it should be on the WAN interface. Edit that rule, change it to WAN, Save, Apply.

c4bcons

Yes! ;D as simple as that. Just changed it to "WAN". Nothing else. Thank you very much for a helpful thread!!

tokamak

@jimp:

At least with the one online multiplayer game I have used so far (Fast RMX) the only requirement for Nintendo Switch online multiplayer is static port outbound NAT. It did not appear to require UPnP, but it's safer to enable that in case another game needs it later.

So as with the Wii U, 3DS, and other similar consoles the best course of action is:

1. Set a static IP address for the device via DHCP static mappings

Status > DHCP Leases, find the device, click + to add a mapping, set a static address, save, etc.

2. Switch to Hybrid Outbound NAT

Firewall > NAT, Outbound tab

Select Hybrid Outbound NAT, Save

3. Add Outbound NAT rule

Firewall > NAT, Outbound tab

Click +

Set the console address as the source (Type = Network, then enter the IP address, pick /32 for the CIDR)

Check Static Port

Save/Apply

4. (Optional, So far) Enable UPnP & NAT-PMP

Enable UPnP & NAT-PMP

Allow UPnP Port Mapping

Pick External (WAN) and Internal Interfaces (LAN)

Set other options as desired

Save

EDIT: My son is using the Splatoon pre-release global test fire and the online multiplayer is working fine, still only using static port outbound NAT. No UPnP.

THANK YOU!!!! For taking the time to outline this. Works perfect for the new Nintendo Switch in the house. Kids have been trying to play Splatoon 2 online and kept having issues until I found this.

Thanks again for helping a NOOB who loves pfSense!

MorzineIT

Hey Dude,
Thanks a million for that post. I just spend my whole afternoon trying to get Splatoon 2 multiplayer working on my son's Nintendo Switch
After I found this post it worked in a flash

THANK YOU !!!

jimp

Please keep future posts in this thread related to the Nintendo Switch only, thanks!

I split off an tangent conversation into a new thread.

tomv

I'm not having any luck getting the NAT type to report anything other than type D

Hopefully I'm just missing something.. Here are my settings.

thanks

jimp

@tvaldes said in Nintendo Switch - Needs static port on its outbound NAT:

I'm not having any luck getting the NAT type to report anything other than type D

Hopefully I'm just missing something.. Here are my settings.

As long as your switch is actually being assigned 10.0.0.139 that outbound NAT rule is OK.

What exactly is reporting "type D" for NAT? I haven't played any online games on my switch lately.

Have you enabled UPnP? It's possible a game may want that enabled as well.

tomv

@jimp said in Nintendo Switch - Needs static port on its outbound NAT:

@tvaldes said in Nintendo Switch - Needs static port on its outbound NAT:

I'm not having any luck getting the NAT type to report anything other than type D

Hopefully I'm just missing something.. Here are my settings.

As long as your switch is actually being assigned 10.0.0.139 that outbound NAT rule is OK.

What exactly is reporting "type D" for NAT? I haven't played any online games on my switch lately.

Have you enabled UPnP? It's possible a game may want that enabled as well.

My switch is definitely getting the IP.
The NAT type D is coming from the Nintendo Switch Connection Test
I also configured UPnP as described in Step 4

jimp

Hmm, my setup is configured the same way (static port outbound for the switch, UPnP enabled) and I get NAT Type B here. Maybe you have another device between the switch and pfSense, or between pfSense and the Internet, that is altering its behavior?

tomv

@jimp It's wireless so the only device is my access point and an unmanaged switch

order from internet to nintendo switch

cable modem
pfsense
unmanaged switch
wireless AP
nintendo switch

Is there an associated firewall rule I might be missing?

jimp

No, a firewall rule wouldn't prevent anything there, unless you have a second WAN or VPN that the switch is getting policy routed out so it doesn't hit that static port rule.

drcyber

@jimp Thank You. Works for Smash Bros. on the Switch.

ErTnEc

Sorry for digging up such an old thread, but I'd much rather keep on topic with this than create yet another topic about it.

I'm currently fighting with my daughters switch to get it to work online, oddly it was working fine up until recently, where no matter what I only get type D nat (previously type B), and no online games are working.

I've followed all of the above steps but to no avail (I'd already performed these over 12 months ago) my main differences being that I have 'Manual Outbound NAT rule generation. (AON - Advanced Outbound NAT)' enabled instead, and also that I have all games consoles in the house (PS4, Multiple Switches) all in an Alias which I am using within the static outbound nat rule instead of a single host (which has never been an issue previously). It appears that the issue lies in 2 parts:

uPnP mappings are not being created by miniupnp service.
Outbound NAT Static Port mappings are either being ignored or bypassed.

When checking the firewall logs, for example, when trying to connect to Splatoon 2, I'm seeing a massive influx of inbound udp connections being blocked. When checking through the states, I can see that these are connections which were initiated outbound via the switch, but the inbound connections back are then being blocked.