Multiple Xboxes on the same network, Open NAT, cannot play together
-
I tried an experiment, I setup Ipv6 on my network, and tried connecting, still had issues. So I tried disabling ipv4 altogether, so we were communicating solely on ipv6. The xboxes could connect, however. My game started throwing errors about no internet connection detected. After some research, I found one forum post from a Bungie (Developer) team member stating that Destiny does not support ipv6. (Not much, but it is all I could find!) It turns out that even though the console as a whole is compatible with ipv6, there is no requirement for their games to be. So it is up to the developers whether they want to support it, and on Destiny, they do not.
Maybe NAT reflection is really my only option, but that is a mess. If I disable static port mapping for my xbox sub net, I get a "strict symmetrical NAT" error, which is officially not supported by xbox live. I also don't see where pfsense officially uses symmetrical NAT, so this may just be the Xbox reporting incorrect information, but if it does….
Here is an excerpt from their documentation on "Two different NAT types"
-
The NAT can assign one UDP port to each UDP source port used by a client device, regardless of the destination of the UDP packet. We call this “minimal port assignment policy” because it results in the minimum number of UDP ports being assigned by the NAT. This is also sometimes called a “cone” NAT.
-
The NAT can assign a different UDP port for each UDP destination. We call this an “aggressive port assignment policy” because it results in the NAT assigning many ports. This is also sometimes called a “symmetric” NAT.
Symmetric NATs make it very difficult to establish peer-to-peer connectivity between two devices behind NATs. Symmetric NATs are not supported by Xbox Live. A user behind a symmetric NAT will be able to connect to the Xbox Live service and will be able to join some games, but will sometimes encounter problems related to the difficultly of establishing peer-to-peer connectivity, such as problems with in-game voice communication, or the inability to join some game sessions.
I have another question, and maybe this is where I should have started from. Should I be trying to get a Cone NAT, and is there any method of getting a "Cone NAT" functionality in pfsense, not full Cone, because I understand that is static NAT, but maybe a restricted cone, or port restricted cone? Or is this one of those things that an enterprise networking platform does not do for security reasons or the like? If these terms are incorrect, I got my NAT information from:
https://www.think-like-a-computer.com/2011/09/16/types-of-nat/
And, if anyone wants it, here is the link to the Xbox Live documentation that the quote is from:
http://download.microsoft.com/download/5/b/5/5b5bec17-ea71-4653-9539-204a672f11cf/Xbox-Live.doc
-
-
If your games are not going to support ipv6, and these games also what all the members of the game to be using the same source port for their connection. Then your only solution is to have multiple IPv4 address..
You say you want static source nat so that source port talking to the public IP is the same as the game is using when it sends the connection. Then yeah you have a problem with multiple machines all looking like they came from the SAME IP. Maybe they do this on purpose for some sort of game security??
Nat reflection does not solve your source port issue. If your isp will not give you multiple IPv4 address. Maybe you could just get a bunch of vps and setup vpn connections to them. Now you could setup console 1 to use your native connection. console 2 to use your vpn connection, console 3 to use 2nd vpn connection.
You can get a vps for like $15 a year and setup openvpn on it, so even if you needed 4 or 5 of these your only talking less than $100 year, etc.
-
Well, as you have probably heard before, this works fairly well with a consumer router, we had a Netgear 6250. We sometimes had our 5th member would get kicked, but it worked some what well. If I could get back to that, that would be enough. I tried this to learn about Pfsense, and this enterprise routing platform. It is very interesting, and VERY nice to have so much control over your network. I love the Open VPN setup, and I was really looking forward using that. It is a great platform, I am just a little sad that I could not find out whatever hidden magic some of the consumer router's seem to have. But, I have 4 other people that play in the house I live in, and they don't care as much about that if we can't play together. I mean most of the time, we just get flat out failures trying to connect to one another, and they just don't seem to show up in the logs.
However, I am a stubborn person, I am not giving up on this, I will keep this box, and probably use it as my home router at a later date. I will follow updates, and try to figure out what sort of configuration could possibly allow us to communicate with each other peer 2 peer on the same sub net. That is all we really want to fix, and it is still having problems. I should probably try to analyze the traffic and see if i can figure out what is going on. If nothing else, ipv6 support will increase, and the whole problem will go away ;) .
Thank everyone for all of your help, but my fellow gamers are threatening to smash my little black router box if we can't play together. So I will probably have to take offline, and then setup the Netgear again. I will keep checking this forum to see if anyone else has any ideas. I know there must be something that I am missing.
-
Well maybe your consumer router is doing a shitty job and nat and is just doing a cone nat where once you open the port anyone can send traffic to your publicIP:port and get forwarded to your machine behind the nat?
But how does that solve an issue when game requires source port to be X? Is it really only require source port to be X thru Z? What is required to figure out your issue is understanding the ports used in the game and any requirements they have like hey this connection to destIP:port has to come from source port X?
Makes no sense why that would be a requirement to be honest Why would you give a shit what the source port is?? If that is the case it would seem they put in such a restrictions to prevent multiple players from all playing from the same IP..
Pfsense can clearly do nat reflection, and it can do UPnP so that would be exactly what your consumer router would be doing. How does that get you around any sort of source port restriction??
As to doing cone nat, it might be possible to do that.. It's not a option in the gui that I am aware of.. But I would think it possible.. Would not suggest it from a security point of view that is for sure. Can you not just get multiple IPs from your ISP.. This would be the best solution for sure!!!
-
I really don't think that the xboxes require source port to be x. I think that setting static source port made the xbox believe that it was behind a cone nat, which was creating one udp port for each source port, regardless of destination. Where it was really causing as many problems as it was solving.
I had to re-setup our netgear, my roommates could not stand it any longer. I will still experiment though, although it certainly looks like enterprise security and game consoles just don't mix. (Who is really that surprised?).
I will say, Johnpoz, you are really the voice of tough love on this forum, you are trying to help , but you don't tolerate bulls%&t, I thank you for it. I will look into doing a cone nat, but I am honestly looking at the x86-64 version of OpenWrt, It is a hack, but it is just consumer oriented enough that it might work. I cannot use any other enterprise routing solution like untangle or sophos, since they don't even have upnp as an option at all! I will re-install pfsense when I have a setup more under my control. I still think I must be missing something with my setup. I will research at a later day.
Or maybe I will just setup a completely custom setup with a linux distro, iptables, and miniupnpd. But god I hate iptables.
-
Or just get multiple IPs from your ISP would be the simple solution if you ask me.
-
Well maybe your consumer router is doing a shitty job and nat and is just doing a cone nat where once you open the port anyone can send traffic to your publicIP:port and get forwarded to your machine behind the nat?
But how does that solve an issue when game requires source port to be X? Is it really only require source port to be X thru Z? What is required to figure out your issue is understanding the ports used in the game and any requirements they have like hey this connection to destIP:port has to come from source port X?
Makes no sense why that would be a requirement to be honest Why would you give a shit what the source port is?? If that is the case it would seem they put in such a restrictions to prevent multiple players from all playing from the same IP..
Pfsense can clearly do nat reflection, and it can do UPnP so that would be exactly what your consumer router would be doing. How does that get you around any sort of source port restriction??
As to doing cone nat, it might be possible to do that.. It's not a option in the gui that I am aware of.. But I would think it possible.. Would not suggest it from a security point of view that is for sure. Can you not just get multiple IPs from your ISP.. This would be the best solution for sure!!!
I have played with this issue for years, and somehow my linksys router running DDWRT can pull off NAT "magic" to allow multiple xboxs to play online. It might be doing something outside the TCP/UDP/IP spec, but it works. When enabling UPnP the xboxs can see that if an inbound port is currently being used and it will pick a different one. Then all of the xboxs operate as if they have dedicated IPs. I am able to get similar UPnP functionality out of my pfSense box but I have never been able to replicate the NAT functionality.
It's a mystery that many have tried to solve in pfSense, but I have yet to see it work as well as some lesser consumer routers.
-
"xboxs can see that if an inbound port is currently being used and it will pick a different one."
"I am able to get similar UPnP functionality out of my pfSense box but I have never been able to replicate the NAT functionality."That is the really the whole point of UPnP.. Your saying that UPnP in pfsense does not do that?? Or just doesn't work with xboxes? If client 1 says hey I need port xyz forward to me.. The nat box doing UPnP should open that for them, if not should tell them hey pick another port that one is in use.
Can you sniff the UPnP traffic on your dd-wrt router and see what is going on? My guess is more that its just doing cone nat and has no security at all so that is why it works. I open a connection to IP-A from source publicIP:X… Then IP-B can then talk to me going to publicIP:X which is not secure.
The biggest issue to getting it to work is undertanding the communication required.. Since it never seems that any of these game makers actually point out what ports need to be used, or allow to change ports, etc.
Why can you not go into the game on console 1 and say use port X, then forward that port on your router. Then go into console 2 and say use port Y and go into your router and forward Y to that console, etc.
-
Hi All,
Apologies for digging out an old thread. I am suffering this exact issue and have not been able to find a resolution. I ask the question against this thread because this is the most in depth thread I have found and looks to have a real grasp of the issues.
Did anyone find a resolution that doesn't require more than one IP from the ISP?
Thanks
CV8R -
Hello,
I had the same issue with many games (Warframe, Red Dead Online, Destiny 2) on Xbox.
The tips is check Static Port for the 1 console (Menu NAT Outbound) and don't check Static Port for the second.
The second Xbox will appear with NAT Strict but you can invite and play together in Warframe for example.you must activate Pure NAT also.
Now it's OK for me in all game.
I will do a complete tuto for multiple Xbox One.
Edit 19/06/19 :
Hello,
I did a full howto for Xbox One without UPnP/DMZ.
Topic : https://forum.netgate.com/topic/144291/howto-multiples-xbox-play-together-without-upnp-dmz
Howto : pdf : https://forum.netgate.com/assets/uploads/files/1560932072924-pfsense_multiples_xboxone_v0.1.zip -
Hello,
I just happened to check back on these forums, it has been quite a while. And noticed a few people asking what happened.
I never found a good solution, and I believe (maybe incorrectly) that the issue's root cause is the underlying BSD Packet filter (pf) from what I read, pf is only capable of setting up a symmetrical NAT. Which maybe ideal for many enterprise applications, causes problems with gaming. Many games need a cone nat to operate properly (This is what "gaming mode" does on most consumer routers that have it). UPnP is also supposed to resolve this, but at the time (3 years ago) minupnp was not solving the issue, and I solved it by using another router installation that was based on Linux's netfiltering (iptables). Still like PFsense, but it never worked correctly for my setup with multiple xboxes behind one nat, all trying to play together in the same party.
-
Now you can play together with multiple consoles with Open NAT
https://forum.netgate.com/topic/168376/multiple-xbox-consoles-with-open-nat-and-working-play-together
-
https://forum.netgate.com/topic/169837/upnp-fix-for-multiple-clients-consoles-playing-the-same-game
The patch above looks like the solution. I am taking some time to test it. But if you find this old post, try the stickied patch thread above. That looks to be the real solution.
