• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT

Scheduled Pinned Locked Moved Gaming
133 Posts 28 Posters 48.6k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • Z
    zman442
    last edited by Jun 8, 2020, 8:31 AM

    So if am reading this correctly through the various posts I see two issues, uPNP isnt working at all and more than one console or system attempting to play the same game or service can fail if they need to use the same port on the firewall? I just installed pfSense this weekend and immediately started running into issues with our Nintendo Switch, Amazon tablet etc.

    Can someone smarter than myself help me understand how this works with consumer grade firewalls like eero, netgear, comcast, etc...without issue but pfSense chokes on it? This isn't a knock on pfSense by any means as the increase level of visibility and control and plethora of additional features is worth the extra steps provided they work as I am looking to invest in the 7100 model router/firewall but I am just having hard time wrapping my head around an issue thats apparently been around for at least three years and still isnt fully functional. I have read that other routers apparently can be affected by the NAT traversal issue but on my old router I could use two Nintendo Switch's on the same network and same game without NAT issues.

    I would love to help test but with the flack I am receiving from my kids I will be forced to put back the other router for now.

    Regards

    1 Reply Last reply Reply Quote 0
    • J
      jimp Rebel Alliance Developer Netgate
      last edited by jimp Jun 8, 2020, 1:14 PM Jun 8, 2020, 1:14 PM

      There are plenty of topics covering those questions already, this thread is only for testing this fix.

      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

      Need help fast? Netgate Global Support!

      Do not Chat/PM for help!

      F 1 Reply Last reply Jun 9, 2020, 3:47 PM Reply Quote 2
      • F
        Firetop @jimp
        last edited by Firetop Jun 9, 2020, 3:48 PM Jun 9, 2020, 3:47 PM

        This post is deleted!
        1 Reply Last reply Reply Quote 0
        • V
          vMAC
          last edited by Jun 10, 2020, 4:01 AM

          So I'm willing to upgrade to 2.5.0 image to test. My only concern is if I switch to the new image will I be able to get back to a stable version without having to wait for a new version? For instance can I go to 2.5.0 and then downgrade back to 2.4.5_1?

          J 1 Reply Last reply Jun 10, 2020, 12:54 PM Reply Quote 0
          • J
            jimp Rebel Alliance Developer Netgate @vMAC
            last edited by Jun 10, 2020, 12:54 PM

            @vMAC said in Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT:

            So I'm willing to upgrade to 2.5.0 image to test. My only concern is if I switch to the new image will I be able to get back to a stable version without having to wait for a new version? For instance can I go to 2.5.0 and then downgrade back to 2.4.5_1?

            There is no downgrade procedure. Take a config backup first and keep an installer handy for 2.4.5-p1. If something goes wrong on 2.5.0, reinstall 2.4.5-p1 and restore the 2.4.x backup.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 1
            • J
              jimp Rebel Alliance Developer Netgate
              last edited by Jun 10, 2020, 6:43 PM

              We have added the 2.2.0-RC1 version of miniupnpd to the repository for pfSense 2.5.0 and so it should be included in snapshots shortly, later today or tomorrow, for additional (and easier) testing.

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 1
              • A
                andrew_r
                last edited by Jun 11, 2020, 8:10 PM

                I updated my 5100 from the web UI this morning (from the latest stable official release to the latest devel release.)

                I can confirm that, with the correct NAT rules, I seem to be able to get multiple consoles online successfully using UPNP. My household has 3 switches, 2 XBox Ones and 2 PS4s, and I was able to get them all connected simultaneously with suitable NAT levels and no error reports.

                I can provide more detailed information to @jimp if necessary.

                I'll be doing some more testing later today to make sure I haven't missed anything, but so far so good.

                Andrew

                J 1 Reply Last reply Jun 11, 2020, 8:16 PM Reply Quote 0
                • J
                  jimp Rebel Alliance Developer Netgate @andrew_r
                  last edited by Jun 11, 2020, 8:16 PM

                  That's good news!

                  @andrew_r said in Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT:

                  with the correct NAT rules

                  Do you mean the correct NAT rules generated automatically by UPnP, or did you have manual rules setup for those consoles?

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  A 1 Reply Last reply Jun 11, 2020, 8:37 PM Reply Quote 0
                  • A
                    andrew_r @jimp
                    last edited by Jun 11, 2020, 8:37 PM

                    @jimp I had some manual rules set up from previous attempts, but they are fairly simple.

                    (1) Assign each console a static IP.
                    (2) Set up an firewall alias called UNPNP_NAT_GROUP containing those IPs.
                    (3) Set up an outbound NAT rule as follows:
                    Interface: WAN
                    Address Family: IPv4 (I don't use IPv6)
                    Protocol: any
                    Source: Network / UNPNP_NAT_GROUP / 32 <-- not sure the 32 is right.
                    Destination: Any
                    Static Port: Checked
                    Description: UNPNP NAT Static Port Rule

                    Anything not mentioned was left as default.

                    (4) UPNP Settings:
                    Enable UPnP & NAT-PMP: Checked
                    Allow UPnP Port Mapping: Checked
                    Allow NAT-PMP Port Mapping: Checked

                    External Interface: WAN
                    Interfaces: LAN

                    Log Packets: Checked.

                    I haven't played around with the default deny option, and I have "allow 1024-65535 x.x.x.0/24 1024-65535" in the ACL field (where x.x.x is my network), although I think it might not be necessary unless I enable default deny.

                    I'm not a firewall expert by any means, but this seems to do the trick. I'd appreciate it if you let me know if I've done something dumb here :)

                    Andrew

                    J 1 Reply Last reply Jun 11, 2020, 8:52 PM Reply Quote 0
                    • A
                      andrew_r
                      last edited by Jun 11, 2020, 8:49 PM

                      @jimp
                      By the way; I do get this on reboot:

                      Crash report begins.  Anonymous machine information:
                      
                      amd64
                      12.1-STABLE
                      FreeBSD 12.1-STABLE 1626cb2f005(factory-devel-12) pfSense
                      
                      Crash report details:
                      
                      PHP Errors:
                      [11-Jun-2020 13:20:35 America/New_York] PHP Warning:  Invalid argument supplied for foreach() in /etc/rc.dyndns.update on line 52
                      
                      
                      
                      No FreeBSD crash data found.
                      
                      1 Reply Last reply Reply Quote 0
                      • J
                        jimp Rebel Alliance Developer Netgate @andrew_r
                        last edited by jimp Jun 11, 2020, 8:52 PM Jun 11, 2020, 8:52 PM

                        @andrew_r said in Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT:

                        @jimp I had some manual rules set up from previous attempts, but they are fairly simple.

                        Can you try with those rules disabled?

                        Was that working before this version of UPnP?

                        We are primarily interested in knowing if this fixed situations that were broken before, or allows things to work with less intervention overall.

                        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                        Need help fast? Netgate Global Support!

                        Do not Chat/PM for help!

                        A 1 Reply Last reply Jun 11, 2020, 8:57 PM Reply Quote 0
                        • A
                          andrew_r @jimp
                          last edited by Jun 11, 2020, 8:57 PM

                          @jimp It was not working with the previous release. There were errors upnp errors in my log, and nothing showing in the upnp status area.

                          I'll test disabling the rules, and get back to you but, if it's any help, I forgot to add the second xbox to the alias group at first (so the rules weren't applied to it), and that xbox reported back that it was double-nat'ed. Similarly, I forgot with the 2nd PS4 and the third Switch, they reported NAT Type 3 (rather than 1) and Nat Type 3 (rather than 2).

                          Does this answer your question, or would it help for me to retest with the rules completely disabled? (I have hybrid mode set, by the way).

                          Andrew

                          A 1 Reply Last reply Jun 11, 2020, 9:02 PM Reply Quote 0
                          • A
                            andrew_r @andrew_r
                            last edited by Jun 11, 2020, 9:02 PM

                            @jimp PS. Is the boot error I posted something to be concerned with?

                            1 Reply Last reply Reply Quote 0
                            • M
                              Marc05
                              last edited by Jun 11, 2020, 9:27 PM

                              @andrew_r
                              Please test without any Outbound rules enabled.

                              Also, do you have any games of the same console that previously had issues with joining a lobby or playing together? If so, are those working now?

                              1 Reply Last reply Reply Quote 0
                              • A
                                andrew_r
                                last edited by Jun 11, 2020, 11:04 PM

                                @andrew_r said in Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT:

                                eans, but this seems to do the trick. I'd appreciate it if you let me know if I've done som

                                I tested Minecraft on both xboxes with and without the outbound nat rule enabled.

                                With; everything worked fine.
                                Without; the first xbox was able to connect to the realm fine, but the second hung on "loading resources" before it even got to the main menu for me to join the realm.

                                So, I'd say the outbound rule is necessary, at least as far as Xbox goes.

                                Note that each console (including PS4 and Switch) reports the NAT as strict and/or double-nat'ed without the rule.

                                Oh, I also had "Enable NAT Reflection for 1:1 NAT" and turned on and "Automatic create outbound NAT rules that direct traffic back out to the same subnet it originated from." in the system/advanced/nat and firewall menu, if that makes a difference.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  Marc05
                                  last edited by Jun 11, 2020, 11:47 PM

                                  That's weird. In my tests, I did not have the outbound rules set up and it seemed to work.

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    andrew_r
                                    last edited by Jun 11, 2020, 11:51 PM

                                    @Marc05
                                    That is strange.

                                    Not sure what's going on, but for some reason in my configuration, I require the outbound rules.

                                    It may be to do with the ATT fiber connection? I've set the ATT box to behave as passthrough directly to the 5100, but I'm not sure that's doing exactly what I hope it is (or else why would people use pfatt?). I suspect that's the cause of the double nat error, and possibly why you're seeing a different result to me.

                                    I guess the question I have is, if you add the rule, does your configuration still work?

                                    A 1 Reply Last reply Jun 11, 2020, 11:54 PM Reply Quote 0
                                    • A
                                      andrew_r @andrew_r
                                      last edited by Jun 11, 2020, 11:54 PM

                                      @Marc05 By the way, this was with xbox - I didn't have anywhere near as many issues with the PS4s and the Switches.

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        Marc05
                                        last edited by Jun 12, 2020, 3:36 AM

                                        Adding the rules still keeps it working.

                                        A 1 Reply Last reply Jun 12, 2020, 3:45 AM Reply Quote 0
                                        • V
                                          vMAC
                                          last edited by Jun 12, 2020, 3:41 AM

                                          I upgrade pfSense and then found out my son took his PS4.......so i will have to wait to verify functionality tomorrow.

                                          1 Reply Last reply Reply Quote 0
                                          22 out of 133
                                          • First post
                                            22/133
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received