Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT

EditioN

Tested today with a base installation of 2.5.0DEV and two PS4s.

Base config, just UPNP enabled and Pure NAT.

I get NAT Type 2 on one console but always type 3 on the second.

I can see the following:

miniupnpd rules/nat contents:
nat log quick on ix0.10 inet proto udp from 10.XX.XX.XX port = 9308 to any keep state label "10.XX.XX.XX:9308 to 9308 (UDP)" rtable 0 -> XX.XX.XX.XX port 9308
rdr pass log quick on ix0.10 inet proto udp from any to any port = 9308 keep state label "10.XX.XX.XX:9308 to 9308 (UDP)" rtable 0 -> 10.XX.XX.XX port 9308

So UPNP seems to be working but for some reason only allowing one console, any additional debugging I should do here?

Marc05

It seems that static ports on outbound NAT is still necessary. Make sure to create that rule as well.

EditioN

@Marc05 static port NAT is a workaround, and not a nice one.
The implementation we hope for is that two or more consoles work with only UPNP without any other special rules (similar to consumer grade routers)
The output above proves that upnp is working, I guess now the challenge is figuring out why only for one device/console.

Marc05

@EditioN

In my previous test earlier in the thread, I had tested with the patch provided in the redmine bug entry. I believe I had tested without the outbound rule enable, and just the patch. The results I posted seem to have UPnP working as intended for multiple consoles. After removing that patch and updating to the latest dev version of pfSense with the miniupnp RC version, the outbound rule was required.

@jimp
Did the code change from your patch make it into the miniupnp RC version provided in the latest dev release of pfSense?

jimp

It wasn't my code/patch, I had just posted a compiled version of the code from miniupnpd. The latest RC code should be what's in snapshots now.

m0t0k0

This is a fresh install upgraded the 2.5.0

I have enabled
Pure NAT
Automatic outbound NAT reflection
Default LAN to any rule has IP options
Enabled UPnP & NAT-PMP both have port mapping on

So the most basic setup

COD Warzone
Both machines can connect and play the game however both report strict NAT

Windows Xbox networking
Both machines can form Teredo IPV6 over IPV4 tunnel but it reports strict NAT

miniupnpd rules/nat contents:
nat quick on pppoe0 inet proto udp from 192.168.1.100 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 81.158.220.33 port 3074
nat quick on pppoe0 inet proto udp from 192.168.1.30 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 81.158.220.33 port 3160
nat quick on pppoe0 inet proto udp from 192.168.1.100 port = 55226 to any keep state label "Teredo 192.168.1.100:55226-&gt;55226 UDP" rtable 0 -> 81.158.220.33 port 55226
nat quick on pppoe0 inet proto udp from 192.168.1.30 port = 50805 to any keep state label "Teredo 192.168.1.30:50805-&gt;50805 UDP" rtable 0 -> 81.158.220.33 port 50805
rdr pass quick on pppoe0 inet proto udp from any to any port = 3074 keep state label "DemonwarePortMapping" rtable 0 -> 192.168.1.100 port 3074
rdr pass quick on pppoe0 inet proto udp from any to any port = 3160 keep state label "DemonwarePortMapping" rtable 0 -> 192.168.1.30 port 3074
rdr pass quick on pppoe0 inet proto udp from any to any port = 55226 keep state label "Teredo 192.168.1.100:55226-&gt;55226 UDP" rtable 0 -> 192.168.1.100 port 55226
rdr pass quick on pppoe0 inet proto udp from any to any port = 50805 keep state label "Teredo 192.168.1.30:50805-&gt;50805 UDP" rtable 0 -> 192.168.1.30 port 50805

I then tried the rules andrew_r posted earlier

To do this the machines were set with a static IP and outbound NAT rule was created with Static port option selected
(I just realised I did not have anything in the ACL field but I also did not select default deny so it should not matter)
I restarted the pf box and both machines

COD Warzone
The first machine connects and can play with moderate NAT
The second machine cannot connect

Windows Xbox networking
Both machines report an Open NAT

miniupnpd rules/nat contents:
nat quick on pppoe0 inet proto udp from 192.168.1.6 port = 50805 to any keep state label "Teredo 192.168.1.6:50805-&gt;50805 UDP" rtable 0 -> 86.138.134.168 port 50805
nat quick on pppoe0 inet proto udp from 192.168.1.6 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 86.138.134.168 port 3074
nat quick on pppoe0 inet proto udp from 192.168.1.7 port = 55226 to any keep state label "Teredo 192.168.1.7:55226-&gt;55226 UDP" rtable 0 -> 86.138.134.168 port 55226
rdr pass quick on pppoe0 inet proto udp from any to any port = 50805 keep state label "Teredo 192.168.1.6:50805-&gt;50805 UDP" rtable 0 -> 192.168.1.6 port 50805
rdr pass quick on pppoe0 inet proto udp from any to any port = 3074 keep state label "DemonwarePortMapping" rtable 0 -> 192.168.1.6 port 3074
rdr pass quick on pppoe0 inet proto udp from any to any port = 55226 keep state label "Teredo 192.168.1.7:55226-&gt;55226 UDP" rtable 0 -> 192.168.1.7 port 55226

Interestingly I ran the Xbox networking test first and as you can see above an automatic rule was created for both machines, however, when I tried to play Warzone it did not work but also the previously generated automatic rule disappeared

nat quick on pppoe0 inet proto udp from 192.168.1.6 port = 50805 to any keep state label "Teredo 192.168.1.6:50805-&gt;50805 UDP" rtable 0 -> 86.138.134.168 port 50805
nat quick on pppoe0 inet proto udp from 192.168.1.6 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 86.138.134.168 port 3074
rdr pass quick on pppoe0 inet proto udp from any to any port = 50805 keep state label "Teredo 192.168.1.6:50805-&gt;50805 UDP" rtable 0 -> 192.168.1.6 port 50805
rdr pass quick on pppoe0 inet proto udp from any to any port = 3074 keep state label "DemonwarePortMapping" rtable 0 -> 192.168.1.6 port 3074

winger46146

Still getting stick Nat.
2.5.0-DEVELOPMENT (amd64)
built on Wed Jul 08 13:03:53 EDT 2020
FreeBSD 12.1-STABLE

ipsec rules/nat contents:

miniupnpd rules/nat contents:
nat quick on em0 inet proto udp from 192.168.1.26 port = 55768 to any keep state label "Teredo 192.168.1.26:55768->55768 UDP" rtable 0 -> (WAN IP) port 55768
rdr pass quick on em0 inet proto udp from any to any port = 55768 keep state label "Teredo 192.168.1.26:55768->55768 UDP" rtable 0 -> 192.168.1.26 port 55768

natearly rules/nat contents:

natrules rules/nat contents:

openvpn rules/nat contents:

tftp-proxy rules/nat contents:

userrules rules/nat contents:

borediniraq

@m0t0k0 I'm having the same problem with WZ on 2 XBOX consoles

m0t0k0

@borediniraq I gave up and moved back to OpenWRT works with just the click of a button

andrew_r

I'm not sure when it happened, but I installed the latest dev update as of last night and it's broken this again.

andrew_r

Update: false alarm; somehow something changed in one of the updates that broke my OpenVPN connection. "Fixing" that ended up routing ALL traffic through the VPN. Breaking it again fixed the NAT problem, but there is still something squarely with the OpenVPN client rules.

I hadn't changed anything in the rules before it stopped working. I'll try setting it up again from scratch to see if that fixes it, but...

Hopefully the 2.5.0 stable release will be out soon, that's all I can say on that! :/

JeGr

@jimp quick question as this popped up in my subforum: does the new miniupnp daemon to test or the version in 2.5 also have the patch for https://redmine.pfsense.org/issues/10398 included?

Namely that was this miniupnp discussion: https://github.com/miniupnp/miniupnp/issues/433 about problems with RFC1918 addresses on WAN.

Also: the snapshots now already contain the new version, no need to manually patch/install it anymore?

Thanks,
\jens

goonie

Is this topic really going to die like all the other previous topics on this same issue over the years. This has been ongoing for years now. Can we get a little more developer traction on this issue? What is needed at this point from the pfSense side of things? What is needed for the miniupnpd side of things? Please, lets not let this die again.

jonathanjadams

I would also be interested to see if there has been any advancements on this.

Has anyone managed to get this to work?

Marc05

I think what's lacking at the moment is sufficient testing. The package responsible for UPnP has been update and is available in 2.5.0. Testing this requires a hardware setup that many don't have - if you're interested in resolving this and have the multiple consoles, multiple copies of the same game, and the time to test things, please do.

jonathanjadams

@Marc05 Thanks for getting back so quickly.

I do have multiple Xbox Ones with the same game (note that some people including myself have been having issues with Ghost Recon Wildlands) and some time to provide some testing. My knowledge is not 100% but I can certainly give testing ago.

Before I upgrade to v2.5 can I just confirm how best to conduct the testing:

I have successfully gained Open NAT via the use of Outbound NAT rules and static ports as well as UPNP ACLs. My xboxes are contained within their own specific VLAN.

Do I just need to remove all UPNP ACLs and Outbound NAT rules and then test to see if I get open NAT across consoles as well as seeing if I can play online in games I have previously had problems with?

Marc05

@jonathanjadams

It's important to first get a baseline of what works/doesn't. The basic configuration that should be currently in place is:
System / Advanced / Firewall & NAT

NAT Reflection mode for port forwards: Pure NAT
Enable automatic outbound NAT for Reflection: Checked

Firewall / NAT / Outbound

Rule with the following: Interface: WAN | Source: Alias with console IPs | NAT Address: Interface IP | Static Port: Checked

Firewall / Rules / LAN (or whichever interface the consoles are on)

Rule at top with the following: Protocol: UDP | Source: Alias with console IPs | Destination: Any | Allow IP options: Checked

Services / UPnP & NAT-PMP

Enabled with UPnP & NAT-PMP both checkd
External Interface: WAN
Interfaces: LAN (or whichever interface the consoles are on)
Default Deny: Checked
ACL: (e.g.) allow 0-65535 10.0.5.0/24 0-65535

Test
After these settings are set, power off the consoles, reboot the firewall (to clear states, old mappings, and ensure a control state for testing), then power on the consoles. Now test the same game at the same time on two consoles.

Does it work?
What is the output of (Diagnostics / Command Prompt): pfSsh.php playback pfanchordrill

Now upgrade to 2.5.0 and run through the same test steps. Please back up the configuration before upgrading.

jonathanjadams

Thanks @Marc05 my settings are exactly as you have them. I will do some testing and post my results here.

chrcoluk

@jimp said in Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT:

miniupnpd

Here is the github issue.

https://github.com/miniupnp/miniupnp/issues/226

Ideally if we could see the rules created on linux, then its trivial from that to send the correct syntax to that github post, and then I expect we will see progress.

goonie

My network setup:

cable modem -> pfsense (WAN igb0) -> Access Point (opt1) (igb1)
                                  -> opt2 (igb2)
                                  -> opt3 (igb3)

Xbox One 1 Static IP: 10.100.100.100 Port: 56450 (wired) (igb2) 
Gateway: 10.100.100.1
Xbox One 2 Static IP: 10.200.200.120 Port: 53063 (wireless) (igb1)
Gateway: 10.200.200.1

Ignore the PS4 info as well as any other irelevant IP's in the miniupnd debug info I posted below since I was only testing the 2 Xbox One's.

PS4 Static IP: 10.0.0.100 (igb3)
Gateway: 10.0.0.1
PS4 Static IP: 10.200.200.121 (igb1)
PS4 Static IP: 10.200.200.122 (igb1)
Gateway: 10.200.200.1

My miniupnpd.conf file:

ext_ifname=igb0
port=2189
listening_ip=igb1
listening_ip=igb3
listening_ip=igb2
secure_mode=yes
system_uptime=yes
presentation_url=https://10.200.200.1:30000/
uuid=c09cf14b-f345-e551-63c7-0514bc6bb0d
serial=C09CF14B
model_number=20.7.3
allow 53-65535 10.200.200.120/32 53-65535
allow 53-65535 10.200.200.121/32 53-65535
allow 53-65535 10.200.200.122/32 53-65535
allow 53-65535 10.100.100.100/32 53-65535
allow 53-65535 10.0.0.100/32 53-65535
deny 0-65535 0.0.0.0/0 0-65535
enable_upnp=yes
enable_natpmp=no
clean_ruleset_interval=600
min_lifetime=120
max_lifetime=86400

I manually built miniupnpd from source:

root@pfsense:~ # miniupnpd --version
miniupnpd 2.2.0-RC1 Aug 23 2020
using pf backend

My Build Options for Miniunpd:

CHECK_PORTINUSE: on
IPV6           : off
LEASEFILE      : off
PF_FILTER_RULES: on
UPNP_IGDV2     : off
UPNP_STRICT    : off

Unforunately I couldn't run a test where I only had just the 2 Xbox One's connected to the network. I ran miniupnpd in debug mode. I had other devices connected wired and wirelessly. Ignore anything except for the Xbox One static IP's and their gateways. I started both of my Xbox One's at the same time and started the same game (Apex Legends) at the same time. I then attempted to play same game with both xbox's while in the same lobby and it didn't work. One of the Xbox's would not connect but the other would. See the output below at pastbin.com since I couldn't post the entire output here:

miniupnpd runnning in debug mode