Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT

chrcoluk

Guys

An update

So I added an xbox series S to my network, forwarded the xbox ports and noticed nat was down, and it was reporting errors with testudo network.

Did a bit of research and it turns out microsoft now use ipv6 for their multiplayer, and if native ipv6 is not detected it will use testudo, now I never figured out why testudo wouldnt work, something somewhere seemed to be blocking it.

But as soon as I put it on my main VLAN which has working ipv6, it all works fine. With native ipv6 it will have its own routable ip so all solved.

food007

@chrcoluk thanks for the update. Glad to hear it's working for you.
I'm not using IPv6 in my networks behind my WAN link, so UPnP being broken is still a blocker on this issue for me. :(

w26

theprestigepacketfilter

@food007 agreed, feels like a workaround as opposed to a solution.

chrcoluk

Well i am looking into this again, trying to play UNO on steam.

Ubisoft in their wisdom decided to use the same port as xbox (port 3074), I see connection attempts adhoc in the firewall.

I have no experience with upnp at all, so its a learning crunch to try and understand how it is supposed to work, supposed to be configured etc, but all I know at the moment is that players cannot connect to me when I host a game but I can connect to others when they are host.

As usual the game vendors documentation is awful, so left trying to figure this out. If I get any success I will report back here.

aniel

@chrcoluk they will fixed by verison 2.5.next

chrcoluk

I think the issue here is none of the developers have gaming consoles so no testing is getting done by those who can change the code.

aniel

@chrcoluk i agree i just don’t understand why they can put more resources and interest into fixing this, in the meanwhile i will keep playing with open nat and my brother with strict nat on warzone.

chrcoluk

Bunch of these

Feb 25 03:02:15 miniupnpd 33263 PCPSendUnsolicitedAnnounce(sockets[0]) sendto(): No route to host
Feb 25 03:02:15 miniupnpd 33263 SendNATPMPPublicAddressChangeNotification: sendto(s_udp=18, port=5351): No route to host
Feb 25 03:02:12 miniupnpd 33263 PCPSendUnsolicitedAnnounce() IPv6 sendto(): No route to host
Feb 25 03:02:12 miniupnpd 33263 PCPSendUnsolicitedAnnounce(sockets[0]) sendto(): No route to host
Feb 25 03:02:12 miniupnpd 33263 SendNATPMPPublicAddressChangeNotification: sendto(s_udp=18, port=5351): No route to host
Feb 25 03:02:11 miniupnpd 33263 PCPSendUnsolicitedAnnounce() IPv6 sendto(): No route to host
Feb 25 03:02:11 miniupnpd 33263 PCPSendUnsolicitedAnnounce(sockets[0]) sendto(): No route to host
Feb 25 03:02:11 miniupnpd 33263 SendNATPMPPublicAddressChangeNotification: sendto(s_udp=18, port=5351): No route to host
Feb 25 03:02:11 miniupnpd 33263 PCPSendUnsolicitedAnnounce() IPv6 sendto(): No route to host
Feb 25 03:02:11 miniupnpd 33263 PCPSendUnsolicitedAnnounce(sockets[0]) sendto(): No route to host
Feb 25 03:02:11 miniupnpd 33263 SendNATPMPPublicAddressChangeNotification: sendto(s_udp=18, port=5351): No route to host
Feb 25 03:02:11 miniupnpd 33263 PCPSendUnsolicitedAnnounce() IPv6 sendto(): No route to host
Feb 25 03:02:11 miniupnpd 33263 PCPSendUnsolicitedAnnounce(sockets[0]) sendto(): No route to host
Feb 25 03:02:11 miniupnpd 33263 SendNATPMPPublicAddressChangeNotification: sendto(s_udp=18, port=5351): No route to host

At same time in firewall log, the block RFC1918 on WAN is blocking those packets, destination ip 224.0.0.1. Source ip/port is pfsense ip and port miniupnpd listens on. This is starting to get interesting.

chrcoluk

After allowing the traffic that pfsense was blocking (created easyrule for it), its working on my xbox.

Some info here, as this was worked on for pfsense 2.5.

https://redmine.pfsense.org/issues/7727

I am still trying to get it working with windows as a upnp host which is proving more difficult, but that may be a windows issue rather than pfsense.

aniel

@chrcoluk said in Test Request: UPnP Fix for Multiple Consoles playing the same game / static port outbound NAT:

https://redmine.pfsense.org/issues/7727

yep me and my brother are on pc, we can't both have open not

chrcoluk

@aniel

Is very frustrating, the consoles have a test feature which allows debugging.

I cannot find a way in windows to simply diagnose and test upnp.

How are you even getting one peron on open nat on the pc, how are you testing it?

--edit--

Tired after a few hours of uno, but I fixed it had 2 devices using same port using upnp at same time, which I believe was the reason for this thread?

I will need to collate everything together I did and compile it into a report for the devs to look into.

aniel

@chrcoluk yes please and also can u share how u got two pc to be playing the same game at the same time and both have open nat?

DonZalmrol

I'm trying to get two computers (A and B) that are on the same network in open NAT in order to play Anno 1800.

What I did:

Enabled "NAT Reflection mode for port forwards" with Pure NAT mode
Checked "Enable NAT Reflection for 1:1 NAT"
Checked "Enable automatic outbound NAT for Reflection"
Under NAT -> Outbound mode have my NAT mode set to "Manual Outbound NAT rule generation. (AON - Advanced Outbound NAT)" as I have some other services (e.g. mail and webserver) running that need a static port for NAT. *
Set my LAN network on which the computers reside to static port
Enabled "UPNP & NAT-PMP"
Checked "Allow UPnP Port Mapping"
Checked "Allow NAT-PMP Port Mapping
External interface = WAN
Interfaces = LAN
Checked "Log packets"
Checked "Deny access to UPnP & NAT-PMP by default"
Created as a test a non-scoped ACL entry "allow 1024-65535 MyLANNetworkRange/24 1024-65535"
Did a reset of the states
Restarted both computers

Question for Item 4 -> Do I need to have my outbound NAT mode set to Hybrid, or is it OK to have it in Manual mode?

Results: Computer A gets open NAT = success, Computer B gets strict NAT and multiplayer is offline. If computer B starts the game before A, the roles are reversed.

Any tips would be greatly appreciated!

PS: Have not yet checked "IP Options" under my LAN rule.

theprestigepacketfilter

@donzalmrol Your results are consistent with the expectations of your settings at this time. The only other workaround for end users at the moment is to use one of the workarounds mentioned earlier in this thread, or sit tight while more details and development are ironed out. Being subscribed to this thread (as you are since you have replied) will help you know when more progress has been made. Best of luck.

DonZalmrol

@theprestigepacketfilter Thanks for validating!

Another workaround is creating a new VLAN where the ISP its network is routed through, then place the 2nd computer in that vlan (by either cable or wireless), downside is that you bypass the firewall...

DeeSti

Add me to the list of users having this issue. Spent 5+ hours today reading through this forum, Reddit, etc. I can’t get two series X online with Warzone at the same time. If I move one Xbox over to my LTE router, everything is fine. I have the latest PFS release with outbound NAT rules and upnp with an allow list. The Xboxes test fine with an Open NAT. Warzone refuses to function on one.

DeeSti

I found a solution that actually worked for me for the meantime. I never noticed Warzone trying to NAT out 1024 also, so rbflurry's response (link below) was what I needed. A NAT from 3075->3075 and then another from 3075->1024 on the other console was what I needed.

https://forum.netgate.com/topic/152142/call-of-duty-modern-warfare-multiple-xbox-ones-upnp-and-nat-failure/8?loggedin=true

Still, I'd love to have a workable upnp solution in the future. Thanks!

Mkayze

I wish this was fixed...

hansaya

Like others have mentioned this is what helped me: https://redmine.pfsense.org/issues/7727#note-35

And I got both of the PCs to show open NAT. In my case I was trying to get COD to work so port "3074" works and this is what UPNP should have been doing automatically for us.

For what it's worth, I did have both PC's showing "Open" NAT types, and both were able to join each other's lobby, without upnp. I manually created port forwards and outbound mappings.

For outbound, I had:

192.168.1.48:3074 => WAN:13074
192.168.1.49:3074 => WAN:23074

For port forwards:

ANY:13074 => 192.168.1.48:3074
ANY:23074 => 192.168.1.49:3074

Marc05

@hansaya It'd be nice to have this tested on the latest dev snapshot. There seems to have been a lot of fixes with NAT.