Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT

    Scheduled Pinned Locked Moved Gaming
    133 Posts 28 Posters 47.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • jimpJ
      jimp Rebel Alliance Developer Netgate
      last edited by

      We have added the 2.2.0-RC1 version of miniupnpd to the repository for pfSense 2.5.0 and so it should be included in snapshots shortly, later today or tomorrow, for additional (and easier) testing.

      Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

      Need help fast? Netgate Global Support!

      Do not Chat/PM for help!

      1 Reply Last reply Reply Quote 1
      • A
        andrew_r
        last edited by

        I updated my 5100 from the web UI this morning (from the latest stable official release to the latest devel release.)

        I can confirm that, with the correct NAT rules, I seem to be able to get multiple consoles online successfully using UPNP. My household has 3 switches, 2 XBox Ones and 2 PS4s, and I was able to get them all connected simultaneously with suitable NAT levels and no error reports.

        I can provide more detailed information to @jimp if necessary.

        I'll be doing some more testing later today to make sure I haven't missed anything, but so far so good.

        Andrew

        jimpJ 1 Reply Last reply Reply Quote 0
        • jimpJ
          jimp Rebel Alliance Developer Netgate @andrew_r
          last edited by

          That's good news!

          @andrew_r said in Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT:

          with the correct NAT rules

          Do you mean the correct NAT rules generated automatically by UPnP, or did you have manual rules setup for those consoles?

          Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

          Need help fast? Netgate Global Support!

          Do not Chat/PM for help!

          A 1 Reply Last reply Reply Quote 0
          • A
            andrew_r @jimp
            last edited by

            @jimp I had some manual rules set up from previous attempts, but they are fairly simple.

            (1) Assign each console a static IP.
            (2) Set up an firewall alias called UNPNP_NAT_GROUP containing those IPs.
            (3) Set up an outbound NAT rule as follows:
            Interface: WAN
            Address Family: IPv4 (I don't use IPv6)
            Protocol: any
            Source: Network / UNPNP_NAT_GROUP / 32 <-- not sure the 32 is right.
            Destination: Any
            Static Port: Checked
            Description: UNPNP NAT Static Port Rule

            Anything not mentioned was left as default.

            (4) UPNP Settings:
            Enable UPnP & NAT-PMP: Checked
            Allow UPnP Port Mapping: Checked
            Allow NAT-PMP Port Mapping: Checked

            External Interface: WAN
            Interfaces: LAN

            Log Packets: Checked.

            I haven't played around with the default deny option, and I have "allow 1024-65535 x.x.x.0/24 1024-65535" in the ACL field (where x.x.x is my network), although I think it might not be necessary unless I enable default deny.

            I'm not a firewall expert by any means, but this seems to do the trick. I'd appreciate it if you let me know if I've done something dumb here :)

            Andrew

            jimpJ 1 Reply Last reply Reply Quote 0
            • A
              andrew_r
              last edited by

              @jimp
              By the way; I do get this on reboot:

              Crash report begins.  Anonymous machine information:
              
              amd64
              12.1-STABLE
              FreeBSD 12.1-STABLE 1626cb2f005(factory-devel-12) pfSense
              
              Crash report details:
              
              PHP Errors:
              [11-Jun-2020 13:20:35 America/New_York] PHP Warning:  Invalid argument supplied for foreach() in /etc/rc.dyndns.update on line 52
              
              
              
              No FreeBSD crash data found.
              
              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate @andrew_r
                last edited by jimp

                @andrew_r said in Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT:

                @jimp I had some manual rules set up from previous attempts, but they are fairly simple.

                Can you try with those rules disabled?

                Was that working before this version of UPnP?

                We are primarily interested in knowing if this fixed situations that were broken before, or allows things to work with less intervention overall.

                Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                A 1 Reply Last reply Reply Quote 0
                • A
                  andrew_r @jimp
                  last edited by

                  @jimp It was not working with the previous release. There were errors upnp errors in my log, and nothing showing in the upnp status area.

                  I'll test disabling the rules, and get back to you but, if it's any help, I forgot to add the second xbox to the alias group at first (so the rules weren't applied to it), and that xbox reported back that it was double-nat'ed. Similarly, I forgot with the 2nd PS4 and the third Switch, they reported NAT Type 3 (rather than 1) and Nat Type 3 (rather than 2).

                  Does this answer your question, or would it help for me to retest with the rules completely disabled? (I have hybrid mode set, by the way).

                  Andrew

                  A 1 Reply Last reply Reply Quote 0
                  • A
                    andrew_r @andrew_r
                    last edited by

                    @jimp PS. Is the boot error I posted something to be concerned with?

                    1 Reply Last reply Reply Quote 0
                    • M
                      Marc05
                      last edited by

                      @andrew_r
                      Please test without any Outbound rules enabled.

                      Also, do you have any games of the same console that previously had issues with joining a lobby or playing together? If so, are those working now?

                      1 Reply Last reply Reply Quote 0
                      • A
                        andrew_r
                        last edited by

                        @andrew_r said in Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT:

                        eans, but this seems to do the trick. I'd appreciate it if you let me know if I've done som

                        I tested Minecraft on both xboxes with and without the outbound nat rule enabled.

                        With; everything worked fine.
                        Without; the first xbox was able to connect to the realm fine, but the second hung on "loading resources" before it even got to the main menu for me to join the realm.

                        So, I'd say the outbound rule is necessary, at least as far as Xbox goes.

                        Note that each console (including PS4 and Switch) reports the NAT as strict and/or double-nat'ed without the rule.

                        Oh, I also had "Enable NAT Reflection for 1:1 NAT" and turned on and "Automatic create outbound NAT rules that direct traffic back out to the same subnet it originated from." in the system/advanced/nat and firewall menu, if that makes a difference.

                        1 Reply Last reply Reply Quote 0
                        • M
                          Marc05
                          last edited by

                          That's weird. In my tests, I did not have the outbound rules set up and it seemed to work.

                          1 Reply Last reply Reply Quote 0
                          • A
                            andrew_r
                            last edited by

                            @Marc05
                            That is strange.

                            Not sure what's going on, but for some reason in my configuration, I require the outbound rules.

                            It may be to do with the ATT fiber connection? I've set the ATT box to behave as passthrough directly to the 5100, but I'm not sure that's doing exactly what I hope it is (or else why would people use pfatt?). I suspect that's the cause of the double nat error, and possibly why you're seeing a different result to me.

                            I guess the question I have is, if you add the rule, does your configuration still work?

                            A 1 Reply Last reply Reply Quote 0
                            • A
                              andrew_r @andrew_r
                              last edited by

                              @Marc05 By the way, this was with xbox - I didn't have anywhere near as many issues with the PS4s and the Switches.

                              1 Reply Last reply Reply Quote 0
                              • M
                                Marc05
                                last edited by

                                Adding the rules still keeps it working.

                                A 1 Reply Last reply Reply Quote 0
                                • V
                                  vMAC
                                  last edited by

                                  I upgrade pfSense and then found out my son took his PS4.......so i will have to wait to verify functionality tomorrow.

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    andrew_r @Marc05
                                    last edited by

                                    @Marc05 My guess is that they'll be necessary for XBox One. You only tested with PS4, correct?

                                    1 Reply Last reply Reply Quote 0
                                    • V
                                      vMAC
                                      last edited by vMAC

                                      Ok when I ran the command you asked for I received the following:

                                      [2.5.0-DEVELOPMENT][admin@BridgesSense.localdomain]/root: pfSsh.php playback pfa                                                                                   nchordrill
                                      
                                      ipsec rules/nat contents:
                                      
                                      miniupnpd rules/nat contents:
                                      nat quick on em0 inet proto udp from 192.168.1.30 port = 9308 to any keep state                                                                                    label "192.168.1.30:9308 to 9308 (UDP)" rtable 0 -> 24.255.xxx.xxx port 9308
                                      rdr pass quick on em0 inet proto udp from any to any port = 9308 keep state labe                                                                                   l "192.168.1.30:9308 to 9308 (UDP)" rtable 0 -> 192.168.1.30 port 9308
                                      
                                      natearly rules/nat contents:
                                      
                                      natrules rules/nat contents:
                                      
                                      openvpn rules/nat contents:
                                      
                                      tftp-proxy rules/nat contents:
                                      
                                      userrules rules/nat contents:
                                      [2.5.0-DEVELOPMENT][admin@BridgesSense.localdomain]/root: miniupnpd --version
                                      miniupnpd 2.2.0-RC1 Jun 10 2020
                                      using pf backend
                                      
                                      

                                      I tried my other PS4 (COD) and got no love.
                                      I then restarted the UPNP service and tried connecting on both PS4's then received the following:

                                      [2.5.0-DEVELOPMENT][admin@BridgesSense.localdomain]/root: pfSsh.php playback pfanchordrill
                                      
                                      ipsec rules/nat contents:
                                      
                                      miniupnpd rules/nat contents:
                                      nat quick on em0 inet proto udp from 192.168.1.31 port = 9308 to any keep state label "192.168.1.31:9308 to 9308 (UDP)" rtable 0 -> 24.255.xxx.xxx port 9308
                                      nat quick on em0 inet proto udp from 192.168.1.31 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3074
                                      rdr pass quick on em0 inet proto udp from any to any port = 9308 keep state label "192.168.1.31:9308 to 9308 (UDP)" rtable 0 -> 192.168.1.31 port 9308
                                      rdr pass quick on em0 inet proto udp from any to any port = 3074 keep state label "DemonwarePortMapping" rtable 0 -> 192.168.1.31 port 3074
                                      
                                      natearly rules/nat contents:
                                      
                                      natrules rules/nat contents:
                                      
                                      openvpn rules/nat contents:
                                      
                                      tftp-proxy rules/nat contents:
                                      
                                      userrules rules/nat contents:
                                      
                                      

                                      Still not working with both PS4's online have to completely disconnect one to get it to work.
                                      Let me know what other settings or logs you might need to help diag.

                                      I have assigned Static IPs to both PS4s (192.168.1.30 and 192.168.1.31)

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        Marc05
                                        last edited by

                                        @vMAC

                                        Make sure you enable Pure NAT, and check "Enable automatic outbound NAT for Reflection" under System / Advanced / Firewall & NAT

                                        V 1 Reply Last reply Reply Quote 0
                                        • V
                                          vMAC @Marc05
                                          last edited by

                                          @Marc05
                                          After changing those settings this is what I get:

                                          
                                          [2.5.0-DEVELOPMENT][admin@BridgesSense.localdomain]/root: pfSsh.php playback pfanchordrill
                                          
                                          ipsec rules/nat contents:
                                          
                                          miniupnpd rules/nat contents:
                                          nat quick on em0 inet proto udp from 192.168.1.31 port = 9308 to any keep state label "192.168.1.31:9308 to 9308 (UDP)" rtable 0 -> 24.255.xxx.xxx port 9308
                                          nat quick on em0 inet proto udp from 192.168.1.31 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3074
                                          nat quick on em0 inet proto udp from 192.168.1.30 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3108
                                          nat quick on em0 inet proto udp from 192.168.1.30 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3167
                                          nat quick on em0 inet proto udp from 192.168.1.30 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3116
                                          nat quick on em0 inet proto udp from 192.168.1.31 port = 9305 to any keep state label "192.168.1.31:9305 to 9305 (UDP)" rtable 0 -> 24.255.xxx.xxx port 9305
                                          nat quick on em0 inet proto udp from 192.168.1.31 port = 9306 to any keep state label "192.168.1.31:9306 to 9306 (UDP)" rtable 0 -> 24.255.xxx.xxx port 9306
                                          nat quick on em0 inet proto udp from 192.168.1.31 port = 3659 to any keep state label "EA Tunnel" rtable 0 -> 24.255.xxx.xx port 3659
                                          nat quick on em0 inet proto udp from 192.168.1.30 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3172
                                          nat quick on em0 inet proto udp from 192.168.1.30 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3096
                                          rdr pass quick on em0 inet proto udp from any to any port = 9308 keep state label "192.168.1.31:9308 to 9308 (UDP)" rtable 0 -> 192.168.1.31 port 9308
                                          rdr pass quick on em0 inet proto udp from any to any port = 3074 keep state label "DemonwarePortMapping" rtable 0 -> 192.168.1.31 port 3074
                                          rdr pass quick on em0 inet proto udp from any to any port = 3108 keep state label "DemonwarePortMapping" rtable 0 -> 192.168.1.30 port 3074
                                          rdr pass quick on em0 inet proto udp from any to any port = 3167 keep state label "DemonwarePortMapping" rtable 0 -> 192.168.1.30 port 3074
                                          rdr pass quick on em0 inet proto udp from any to any port = 3116 keep state label "DemonwarePortMapping" rtable 0 -> 192.168.1.30 port 3074
                                          rdr pass quick on em0 inet proto udp from any to any port = 9305 keep state label "192.168.1.31:9305 to 9305 (UDP)" rtable 0 -> 192.168.1.31 port 9305
                                          rdr pass quick on em0 inet proto udp from any to any port = 9306 keep state label "192.168.1.31:9306 to 9306 (UDP)" rtable 0 -> 192.168.1.31 port 9306
                                          rdr pass quick on em0 inet proto udp from any to any port = 3659 keep state label "EA Tunnel" rtable 0 -> 192.168.1.31 port 3659
                                          rdr pass quick on em0 inet proto udp from any to any port = 3172 keep state label "DemonwarePortMapping" rtable 0 -> 192.168.1.30 port 3074
                                          rdr pass quick on em0 inet proto udp from any to any port = 3096 keep state label "DemonwarePortMapping" rtable 0 -> 192.168.1.30 port 3074
                                          
                                          natearly rules/nat contents:
                                          
                                          natrules rules/nat contents:
                                          
                                          openvpn rules/nat contents:
                                          
                                          tftp-proxy rules/nat contents:
                                          
                                          userrules rules/nat contents:
                                          
                                          

                                          It now appears to be working. Tonight we will try it out and see if we can get matchmaking.

                                          1 Reply Last reply Reply Quote 0
                                          • V
                                            vMAC
                                            last edited by

                                            When playing I get Strict NAT on both devices. Should this be the case with UPnP setup?

                                            M 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.