Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Nintendo Switch - Needs static port on its outbound NAT

    Scheduled Pinned Locked Moved Gaming
    36 Posts 21 Posters 54.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • jimpJ
      jimp Rebel Alliance Developer Netgate
      last edited by jimp

      At least with the one online multiplayer game I have used so far (Fast RMX) the only requirement for Nintendo Switch online multiplayer is static port outbound NAT. It did not appear to require UPnP, but it's safer to enable that in case another game needs it later.

      So as with the Wii U, 3DS, and other similar consoles the best course of action is:

      1. Set a static IP address for the device via DHCP static mappings

      • Status > DHCP Leases, find the device, click + to add a mapping, set a static address, save, etc.

      2. Switch to Hybrid Outbound NAT

      • Firewall > NAT, Outbound tab
      • Select Hybrid Outbound NAT, Save

      3. Add Outbound NAT rule

      • Firewall > NAT, Outbound tab
      • Click +
      • Set the console address as the source (Type = Network, then enter the IP address, pick /32 for the CIDR)
      • Check Static Port
      • Save/Apply

      4. (Optional, So far) Enable UPnP & NAT-PMP

      • Enable UPnP & NAT-PMP
      • Allow UPnP Port Mapping
      • Pick External (WAN) and Internal Interfaces (LAN)
      • Set other options as desired
      • Save

      EDIT: My son is using the Splatoon pre-release global test fire and the online multiplayer is working fine, still only using static port outbound NAT. No UPnP.

      EDIT 2020-03-31: The same settings here do work for Animal Crossing: New Horizons. If you still receive errors, it may not actually be your firewall causing them, but the remote console or something in between.

      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

      Need help fast? Netgate Global Support!

      Do not Chat/PM for help!

      D 1 Reply Last reply Reply Quote 17
      • I
        iloveramen
        last edited by

        Thank you jimp.  This is a great reminder and advice for everyone on the forum.

        1 Reply Last reply Reply Quote 0
        • A
          Alex Atkin UK
          last edited by

          Are you sure about this?

          I just tried and you can't set the console IP as the source as the only options are Network, Any or This  Firewall.

          think you may have applied Static Port to the whole LAN not the Switch specifically, in which case you do not need a new rule, just modify the existing one.

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            Nope, just the switch. Use network and /32 for a single host on the outbound NAT source.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • S
              sirjorj
              last edited by

              Thanks for this!  I just spent the hour trying to get the Splatoon 2 test fire working and for all I know, the entire event was to show off their new "Unable to connect" screen (I have a screenshot if you want to see it - it is very pretty!)

              I had UPNP enabled for the right addresses and it did nothing.  I then unchecked the 'deny access by default' option and it still did nothing.  If that didn't help, what good is UPNP anyway?  Or is this just Nintendo writing bad network code?

              Anyway, thanks again!

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                Well UPnP is for inbound connections, outbound NAT is for outbound. Apparently the way their multiplayer code works, it needs to send back to the console on a particular port, which needs to be static so it's the same in both directions. Not sure why game servers can't just send back to the port it came from, but who knows…

                So UPnP does nothing for that kind of setup. Just setup the static port outbound NAT as I laid out above and it should be fine.

                At least there are two more days of test fires so keep trying. There are times tomorrow and Sunday. And even one more tonight. See attached (times in EDT)

                Edit: Not my pic. Shamelessly lifted from Reddit.

                IBpHe_CrHJB5TizK_tPZPUiELm5_GCwjvknLzwl6myI.png
                IBpHe_CrHJB5TizK_tPZPUiELm5_GCwjvknLzwl6myI.png_thumb

                Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                1 Reply Last reply Reply Quote 0
                • A
                  Alex Atkin UK
                  last edited by

                  Still annoying that Nintendo did it this way.

                  For a portable device that most likely will get used a fair bit on public networks that you CAN'T specify their outbound NAT settings, it seems like a very poor design indeed.

                  Thanks for reminding me about the /32, it was only hours later I realised my mistake.  Its just been one of those days.

                  1 Reply Last reply Reply Quote 0
                  • Y
                    Yockanookany
                    last edited by

                    I made a thread dealing with these issues (https://forum.pfsense.org/index.php?reportsent;topic=127837.msg705258#msg705258) and followed your directions which were already mostly done besides hybrid NAT. I had no luck with those changes sadly and it's the end of the testfire so I'm unable to test further for now.

                    1 Reply Last reply Reply Quote 0
                    • S
                      sirjorj
                      last edited by

                      Just to confirm, making those changes did make it work for me.
                      Thanks again.

                      sirjorj

                      1 Reply Last reply Reply Quote 0
                      • C
                        carlosgarciars
                        last edited by

                        Good advice jimp! I will purchase it this weekend

                        1 Reply Last reply Reply Quote 0
                        • J
                          j.koopmann
                          last edited by

                          This worked for me like a charm for months. Yesterday I received a second DSL and setup a multi-wan. Got the usual error again. So I added the static NAT for the second WAN line as well and to ne safe added a firewall rule so that the console only uses the original first WAN.

                          Now sometimes it works and sometimes it does not. In the states diag I only see the first DSL being used. I am puzzled by this.

                          1 Reply Last reply Reply Quote 0
                          • jimpJ
                            jimp Rebel Alliance Developer Netgate
                            last edited by

                            If your Multi-WAN setup is using Load Balancing, you might need to force the switch to a failover group instead so it is not balanced. It might be sending some traffic out WAN1, other traffic out WAN2, and since the far side sees different addresses it may be cutting that off.

                            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                            Need help fast? Netgate Global Support!

                            Do not Chat/PM for help!

                            1 Reply Last reply Reply Quote 0
                            • J
                              j.koopmann
                              last edited by

                              Already did that… Quote: "added a firewall rule so that the console only uses the original first WAN. "

                              One day later everything seems to be fine. Maybe some missing old states.... Will monitor it...

                              1 Reply Last reply Reply Quote 0
                              • B
                                behemyth
                                last edited by

                                These kind of posts are why I love this platform. I've never seen a platform where the actual people working on it post informational things like this for everyone to use.

                                Major kudos to the Pfsense team.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mrhub
                                  last edited by

                                  This worked for the Switch AND for the PS4 that had NAT type 3.

                                  Using a Firebox X550e

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    AkiraSensei
                                    last edited by

                                    Sorry for reviving an old post but should I disable static ports on all other mappings? For example, the automatically created rules for localhost to WAN, LAN to WAN, OPT1 to WAN, etc.? I also have multiple game systems that require the static port on. Is it all right to have static ports on all of them ON at the same time? I'm still very new to pfSense (this is my post here, in fact!).

                                    1 Reply Last reply Reply Quote 0
                                    • F
                                      Falcon-OSX
                                      last edited by

                                      Thank you very much a very simple and elegant solution. You made my son very happy. I will be adding other console to help with gaming.

                                      Thank Again. :)

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        @AkiraSensei:

                                        Sorry for reviving an old post but should I disable static ports on all other mappings? For example, the automatically created rules for localhost to WAN, LAN to WAN, OPT1 to WAN, etc.? I also have multiple game systems that require the static port on. Is it all right to have static ports on all of them ON at the same time? I'm still very new to pfSense (this is my post here, in fact!).

                                        As long as they do not need the same source port to talk with the same destination address:port it should be OK. There can only be one state for each local_wan_ip:port <-> remote_ip:port combination. Setting static port just means that the source port is left untranslated when connections are made outbound. If the local machine connects using source port 55000, then that port will be used on the WAN interface as the source port. Without static set, the port can be randomly selected from the ephemeral port space (1024 to 65535) and translated on WAN.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          dazedman
                                          last edited by

                                          this solved my problem on both the wii u and switch. thank you!

                                          1 Reply Last reply Reply Quote 0
                                          • B
                                            blue_smoke
                                            last edited by

                                            Hi thank you for this guide.  I had problems getting the NAT type from a D to a C or B even after following your steps but I eventually figured out what was happening.

                                            In the step below, I found that the Mappings order was important.  I originally added the rule as the last entry.  When I moved the Mappings entry up above the other LAN entries I started getting NAT type B.

                                            @jimp:

                                            …

                                            3. Add Outbound NAT rule

                                            • Firewall > NAT, Outbound tab
                                            • Click +
                                            • Set the console address as the source (Type = Network, then enter the IP address, pick /32 for the CIDR)
                                            • Check Static Port
                                            • Save/Apply

                                            ...

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.