Possible to force Dynamic DNS to use a check IP service (even if WAN IP is of a valid public IP range?)

Gblenn · Mar 3, 2023, 3:48 PM

@johnpoz Like I said, it would be way better if miniupnp simply accepted rfc 1918, like other UPnP implementations do. And an even better solution would be to use a router which support bridging, but mine doesn't, and most consumer models don't.
So, for a failover setup like mine, I'm thinking this could be an acceptable solution until miniupnp is changed...

Wrt UPnP I agree about the risks it presents. But I do feel that the implementation in pfsense is pretty much as good as it can get. Especially the ACL is a nice addition.
For gaming, with multiple gamers in the house, UPnP is pretty much the only option available for "Open NAT"...

viragomann · Mar 3, 2023, 3:53 PM

@gblenn said in Possible to force Dynamic DNS to use a check IP service (even if WAN IP is of a valid public IP range?):

Well, as horrible as it may be, it does solve an issue with miniupnp not wanting to play ball when WAN IP happens to be RFC1918...

Did you try to enable STUN?

johnpoz · Mar 3, 2023, 3:55 PM

@gblenn not trying to be augmentative.. But why can you not just manually open what ports you need?

UPnP is ok for grandma that doesn't know what an IP is in allowing for unsolicited traffic to her shiny new PS5..

And I get the info some of these game makers provide for ports and firewalls is horrible.. But can you not just run UPnP for a bit, figure out what ports its wanting open, and then just port forward them manually. if the info provide for what ports are needed is not clear enough?

Just curious.. I have never ran into anything that required to run UPnP.. Even when my boys were running console games - I just manually forwarded the ports they needed via a little investigation of what was required for feature xyz to work in the game, etc.

Gblenn · Mar 3, 2023, 4:28 PM

@johnpoz said in Possible to force Dynamic DNS to use a check IP service (even if WAN IP is of a valid public IP range?):

Just curious.. I have never ran into anything that required to run UPnP.. Even when my boys were running console games - I just manually forwarded the ports they needed via a little investigation of what was required for feature xyz to work in the game, etc.

Yes well I have not seen any problems with console games, at least with my son being the only one playing on a PS4. And previously I was doing a bit of port forwarding as well. Might depend on what games are being played and in my case the problem games have been Inifinity Ward (Call of Duty) on PC.

The real challenge presented itself when we were three (myself included) PC's on the same game, online. The testing was tedious to say the least and I never managed to get all PC's up to Open NAT without the assistance of UPnP. I'm sure it's possible but I gave up.

What I have done to safeguard as much as possible is to use ACL to limit to the three PC's in question and to the port ranges in question...

johnpoz · Mar 3, 2023, 5:03 PM

@gblenn thanks - ok yeah multiple devices from the same network can get a bit crazy.. Thanks for quieting my curiosity cat..

Gblenn · Mar 3, 2023, 5:55 PM

@viragomann said in Possible to force Dynamic DNS to use a check IP service (even if WAN IP is of a valid public IP range?):

@gblenn said in Possible to force Dynamic DNS to use a check IP service (even if WAN IP is of a valid public IP range?):

Well, as horrible as it may be, it does solve an issue with miniupnp not wanting to play ball when WAN IP happens to be RFC1918...

Did you try to enable STUN?

I believe I have and if my memory serves me, I couldn't get it to work that way either...

viragomann · Mar 3, 2023, 8:13 PM

@gblenn
According to some threads here, only the Google STUN works on pfSense.
But STUN just let the UPnP server know, what's your real public IP. You have also forward the necessary ports on your external router of course.
Best practice is to forward all to pfSense WAN or even set the pfSense WAN IP as DMZ or as exposed host if the router provides this option.

Gblenn · Mar 4, 2023, 10:07 AM

@viragomann Yes, well I tested all servers, including Google. And perhaps I should test again to confirm it.
And yes, DMZ is a given here... Preferably bridge mode, but that's not always available.

Bob.Dig · Mar 4, 2023, 10:17 AM

@gblenn google (with its port) is working. Every other server not with pfSense. Why, nobody can tell. ;)

Gblenn · Mar 4, 2023, 2:41 PM

@bob-dig said in Possible to force Dynamic DNS to use a check IP service (even if WAN IP is of a valid public IP range?):

@gblenn google (with its port) is working. Every other server not with pfSense. Why, nobody can tell. ;)

Thanks, good to know!

Gblenn · Mar 4, 2023, 2:50 PM

@gblenn I guess this thread should really continue over here...
https://forum.netgate.com/topic/178472/will-we-ever-get-upnp-to-work-behind-private-network-ip

Google STUN server seems to be working and UPnP accepts requests to open ports. But it still isn't working. In fact it stops working and some games, like MW2 (2009) can't even connect to IW servers. Turning off UPnP gives me better results using manual port forwards...

However, the only way I have been able to get Open NAT across the board is faking a public WAN IP...