• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Nintendo Switch connection issue Error code

Gaming
nintendo upnp static mapping acl nat
5
55
10.6k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    JonathanLee
    last edited by JonathanLee Nov 9, 2023, 2:26 AM Nov 9, 2023, 2:25 AM

    I created a PCAP file when this connection test runs it seems like it has a lot of RST from the firewall itself this is when the connection fails right after

    πŸ”’ Log in to view

    8 nil-aas(3128) -> 10316 [RST]

    keep in mind I do have a WAN floating traffic shaping rule running.

    Any ideas?

    J 1 Reply Last reply Nov 9, 2023, 4:16 AM Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator @JonathanLee
      last edited by Nov 9, 2023, 4:16 AM

      @JonathanLee well your nintendoswitch keeps sending ack, after the lee_family sent a fin,ack - so yeah if NS keeps talking to LF with sending acks, LF is going to keep telling it to F off with a RST..

      Not sure where pfsense comes into play in this conversation. Is this traffic routed over pfsense? 3128 is proxy port, so this NS wants to keep this conversation going after LF has told its done with the fin,ack..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      J 1 Reply Last reply Nov 9, 2023, 5:08 AM Reply Quote 0
      • J
        JonathanLee @johnpoz
        last edited by JonathanLee Nov 9, 2023, 6:04 AM Nov 9, 2023, 5:08 AM

        @johnpoz yes Squid proxy 3128 this is during the Nintendo Switch Network test it does an upload test right after the Nintendo Switch shows I have NAT type B next it does a download test that passes goes to UL test and this is in the PCAP. It has a ton right before it fails. LF my SG-2100. I wonder if I can increase the connection timers or something

        https://bugs.squid-cache.org/show_bug.cgi?id=5084

        M 1 Reply Last reply Nov 9, 2023, 11:21 AM Reply Quote 0
        • M
          mcury @JonathanLee
          last edited by mcury Nov 9, 2023, 11:22 AM Nov 9, 2023, 11:21 AM

          @JonathanLee said in Nintendo Switch connection issue Error code:

          @johnpoz yes Squid proxy 3128 this is during the Nintendo Switch Network test it does an upload test right after the Nintendo Switch shows I have NAT type B next it does a download test that passes goes to UL test and this is in the PCAP. It has a ton right before it fails. LF my SG-2100. I wonder if I can increase the connection timers or something

          https://bugs.squid-cache.org/show_bug.cgi?id=5084

          I wonder if in Nintendo Switch, you could use a .pac file instead of setting the proxy by IP address and port, or, if there is a configuration field such as "Do not proxy connections for this destinations"..

          If this field existis in the Nintendo Switch proxy configuration, try to include nintendo.net there.

          Or, perhaps, if it is possible, try this .pac file in the Nintendo Switch configuration:

          This is the .pac file I used to have in a few customers back in the day that I was using squid..

          function FindProxyForURL(url, host) {
          //BYPASS POR REGEX
              if (isPlainHostName(host) ||
                  shExpMatch(host, "*.home.arpa") ||
          //BYPASS BY DESTINATIONS NETWORK
                  isInNet(dnsResolve(host), "10.0.0.0",  "255.0.0.0") ||
                  isInNet(dnsResolve(host), "172.16.0.0",  "255.240.0.0") ||
                  isInNet(dnsResolve(host), "192.168.0.0",  "255.255.0.0") ||
                  isInNet(dnsResolve(host), "127.0.0.0", "255.255.255.0") ||
          //LOCAL SITES
                  dnsDomainIs(host, "mywebsite.home.arpa") ||
          //Windows and Nintendo Switch
                  dnsDomainIs(host, "windowsupdate.com") ||
                  dnsDomainIs(host, "live.com") ||
                  dnsDomainIs(host, "microsoft.com") ||
                  dnsDomainIs(host, "nintendo.net") ||
          //Other
                  dnsDomainIs(host, "whatsapp.com"))
                return "DIRECT";
          if (isInNet(myIpAddress(), "192.168.1.0", "255.255.255.0"))
          return "PROXY pfsense.home.arpa:3128";
          }
          

          Edit: If you follow this route, bypass Nintendo's Switch IP address from the transparent proxy.

          dead on arrival, nowhere to be found.

          J 1 Reply Last reply Nov 9, 2023, 5:05 PM Reply Quote 0
          • J
            JonathanLee @mcury
            last edited by Nov 9, 2023, 5:05 PM

            @mcury I like your pac WPAD file, however Nintendo does allow for Proxy use, meaning it should not have to bypass it. I have found a bug reported in bugzilla that matches the half closed issue. Your auto configuration file for me opens to many addresses. I do like the .arpa return direct I will use that for my internal devices thanks.

            M 1 Reply Last reply Nov 9, 2023, 5:09 PM Reply Quote 0
            • M
              mcury @JonathanLee
              last edited by mcury Nov 9, 2023, 5:18 PM Nov 9, 2023, 5:09 PM

              @JonathanLee What you gain with using a PAC file is the possibility to bypass destinations by domains, regex..

              You don't need to know the destination address as you would need to know when using transparent proxy.

              Browsers also have a builtin option to make use of that, that you can use with or without a .pac file.

              πŸ”’ Log in to view

              So, as I see it, Nintendo switch proxy implementation is poor, I mean, only an IP and address, port and a switch ON/OFF ?

              dead on arrival, nowhere to be found.

              M 1 Reply Last reply Nov 10, 2023, 9:15 PM Reply Quote 1
              • M
                michmoor LAYER 8 Rebel Alliance @mcury
                last edited by Nov 10, 2023, 9:15 PM

                @mcury

                The usage of Squid (to no ones surprise) is now deprecated.

                https://www.netgate.com/blog/deprecation-of-squid-add-on-package-for-pfsense-software

                Firewall: NetGate,Palo Alto-VM,Juniper SRX
                Routing: Juniper, Arista, Cisco
                Switching: Juniper, Arista, Cisco
                Wireless: Unifi, Aruba IAP
                JNCIP,CCNP Enterprise

                M J 2 Replies Last reply Nov 10, 2023, 9:59 PM Reply Quote 1
                • M
                  mcury @michmoor
                  last edited by Nov 10, 2023, 9:59 PM

                  @michmoor said in Nintendo Switch connection issue Error code:

                  The usage of Squid (to no ones surprise) is now deprecated.

                  https://www.netgate.com/blog/deprecation-of-squid-add-on-package-for-pfsense-software

                  I can't say I'm surprised indeed.. Thanks for the info.

                  dead on arrival, nowhere to be found.

                  1 Reply Last reply Reply Quote 0
                  • J
                    JonathanLee
                    last edited by JonathanLee Nov 11, 2023, 1:05 AM Nov 11, 2023, 12:50 AM

                    What is an alternative ???

                    Dang looks like I will have to stay with 23.09 until 2100 hardware twightlighted. I spent years getting this to actually work =(, it's just sad to me. :(

                    1 Reply Last reply Reply Quote 0
                    • J
                      JonathanLee @michmoor
                      last edited by Nov 11, 2023, 2:33 AM

                      This post is deleted!
                      1 Reply Last reply Reply Quote 0
                      • J
                        JonathanLee
                        last edited by Nov 11, 2023, 2:35 AM

                        What is the next official Netgate product that will continue to support a proxy with SSL intercept that can be purchased? Now that this is being twightlighted?

                        What version should I upgrade too for proxy cacheing abilities? I have a SG-2100 currently. Should users move to Palo Alto?

                        M 2 Replies Last reply Nov 11, 2023, 4:53 AM Reply Quote 0
                        • M
                          michmoor LAYER 8 Rebel Alliance @JonathanLee
                          last edited by michmoor Nov 11, 2023, 5:06 AM Nov 11, 2023, 4:53 AM

                          @JonathanLee There is nothing after Squid. Squid is really the only Forward proxy application that i know of. Your alternatives are going to be DNS blocklist or DNS server that can handle content filtering(OpenDNS or NextDNS).
                          Within my home, ive loaded up AdGuard within a container and pointed my "Family_VLAN" toward it. AdGuard has features to block content of various degrees and you can also upload blocklists. So its handy and arguably better than Squid.

                          Squid is just a very unsupported project without a lot of updated features and lots of CVEs. Its long past its prime and it had a good run. Im sad to see it go but there just isnt a better or any OSS alternative.

                          Firewall: NetGate,Palo Alto-VM,Juniper SRX
                          Routing: Juniper, Arista, Cisco
                          Switching: Juniper, Arista, Cisco
                          Wireless: Unifi, Aruba IAP
                          JNCIP,CCNP Enterprise

                          1 Reply Last reply Reply Quote 0
                          • M
                            michmoor LAYER 8 Rebel Alliance @JonathanLee
                            last edited by Nov 11, 2023, 5:25 AM

                            @JonathanLee said in Nintendo Switch connection issue Error code:

                            Should users move to Palo Alto?

                            Palos/Fortinet/Ciscos all have heavy subscription fees to use their products. Assuming you can get a PA-440 with a home lab license for a "cheap" price it's going to be very costly.
                            I suspect that if there are folks out there that need to MITM traffic flows they are probably within an enterprise or Financial space or even military and could well afford the pricey security vendors. I can't say what you should do but if you really need that feature set and you are willing to pay then the options you have are vast.
                            It all comes down to what your security/network requirements are.

                            Firewall: NetGate,Palo Alto-VM,Juniper SRX
                            Routing: Juniper, Arista, Cisco
                            Switching: Juniper, Arista, Cisco
                            Wireless: Unifi, Aruba IAP
                            JNCIP,CCNP Enterprise

                            1 Reply Last reply Reply Quote 1
                            • J
                              JonathanLee
                              last edited by JonathanLee Nov 11, 2023, 6:38 AM Nov 11, 2023, 6:19 AM

                              if (! isResolvable(host)) {
                              return "PROXY proxy.example.com:3128";
                              }

                              In the mean time I wonder if this would help with the WPAD.

                              Ref:
                              https://wiki.squid-cache.org/KnowledgeBase/ProxyPacSlow

                              Squid's website states there next upgrade to resolve bugs every 2 years.

                              "Major stable releases follow a two-year schedule. Beta branches are spawned six months before the corresponding major stable release."

                              πŸ”’ Log in to view
                              So Feb 2025 is when the security issues will be resolved?

                              Good run it's still running great. I am not at all concerned with the security issues from it. I am going to keep running it personally. It's million times better from day one of setting up my 2100. It's like a dream to see it run now on my system. I have one issue with a time out connection.

                              I actually feel like I have control of my privacy. I have asked many times per CCPA for sites to stop tracking me. Again they don't, this gave me the ability to force privacy with block lists. I am to invested in the configurations and stuff with it to give up on it. Yes it has some bugs like anything.

                              I keep thinking about Microsofts enteral blue bug. It's been abused over and over and patched and reopened for NSA tools and released.

                              pfSense and Squid provided me everything I needed in a firewall. So much so I would buy a new Netgate if it had the ability to run it still. It's perfect. Sure I block some advertising abuse from tracking us, that's them not following CCPA and GDPR laws.

                              I am on a tangent sorry because I personally Iove Squid Squidguard and lightsquid.

                              There run is not over yet... Squid keeps on protecting my GDPR and CCPA rights. It really took the Zoo/panopticon feeling out of advertising company abuses.

                              Again for the average users it's a living nightmare to configure, something that requires a cyber security degree and years of configuration changes after with a team of open source community members coding and searching for any issue.

                              It really was an amazing product.

                              M 1 Reply Last reply Nov 11, 2023, 2:46 PM Reply Quote 0
                              • M
                                michmoor LAYER 8 Rebel Alliance @JonathanLee
                                last edited by Nov 11, 2023, 2:46 PM

                                @JonathanLee
                                IMO, you are taking a huge gamble running an insecure application.
                                https://www.theregister.com/2023/10/13/squid_proxy_bugs_remain_unfixed

                                No one on the development side of the Squid project is taking ownership of these vulnerabilities. There is no roadmap to fix.

                                "He also acknowledged that the Squid proxy's maintainers – like most open source developers – are largely volunteers and may not have the support necessary to quickly fix all these problems.

                                "The Squid Team have been helpful and supportive during the process of reporting these issues," Rogers conceded. **"However, they are effectively understaffed, and simply do not have the resources to fix the discovered issues. Hammering them with demands to fix the issues won't get far."

                                As Netgate suggested, i would highly advise you to not use it anymore. If you really need more control over devices that are other methods availble today with less overhead.

                                Firewall: NetGate,Palo Alto-VM,Juniper SRX
                                Routing: Juniper, Arista, Cisco
                                Switching: Juniper, Arista, Cisco
                                Wireless: Unifi, Aruba IAP
                                JNCIP,CCNP Enterprise

                                J 1 Reply Last reply Nov 11, 2023, 4:06 PM Reply Quote 0
                                • J
                                  JonathanLee @michmoor
                                  last edited by JonathanLee Nov 11, 2023, 4:29 PM Nov 11, 2023, 4:06 PM

                                  @michmoor I am a computer science student, after I take a C++ class and php class I can start helping fix the issues. I just don't know how to debug something like this yet. I also will learn that soon, I think GitHub has virtual instances where it's a VM. I have to learn about better GitHub use also in class soon.

                                  M 1 Reply Last reply Nov 11, 2023, 5:34 PM Reply Quote 0
                                  • M
                                    michmoor LAYER 8 Rebel Alliance @JonathanLee
                                    last edited by Nov 11, 2023, 5:34 PM

                                    @JonathanLee
                                    What I don’t understand is why isn’t this a project that Netgate supports? They advertise a free project in all marketing. They fully utilize an open source tool to make money . IMO, Netgate should have a role in fixing this or offering an alternative

                                    https://www.netgate.com/pfsense-plus-applications/content-filtering

                                    Firewall: NetGate,Palo Alto-VM,Juniper SRX
                                    Routing: Juniper, Arista, Cisco
                                    Switching: Juniper, Arista, Cisco
                                    Wireless: Unifi, Aruba IAP
                                    JNCIP,CCNP Enterprise

                                    J 2 Replies Last reply Nov 11, 2023, 6:21 PM Reply Quote 1
                                    • J
                                      JonathanLee @michmoor
                                      last edited by Nov 11, 2023, 6:21 PM

                                      @michmoor

                                      https://docs.opnsense.org/manual/proxy.html

                                      Opensense is another alternative I can see once Squid is removed. However I really don't want to go to a new vendor. I bet Netgate will find a great SSL intercept web cache replacement in the end.

                                      1 Reply Last reply Reply Quote 1
                                      • J
                                        JonathanLee @michmoor
                                        last edited by Nov 11, 2023, 6:22 PM

                                        @michmoor I admit Squid was a reason I went with Netgate also the great community.

                                        1 Reply Last reply Reply Quote 2
                                        • M
                                          michmoor LAYER 8 Rebel Alliance
                                          last edited by michmoor Nov 13, 2023, 2:15 AM Nov 13, 2023, 2:11 AM

                                          @mcury @JonathanLee

                                          Not saying a switch of vendors is appropriate BUT...the ability to offer per network blocklist is available.
                                          Looks like they paywall that feature. https://docs.opnsense.org/vendor/deciso/extended_dnsbl.html

                                          Nevertheless, its possible but pfBlocker only has a single maintainer and we havent had a package update in quite a while. If you check the redmines, there are quite a few feature requests open and unassigned.
                                          I did call it with Squid and im calling it with pfBlockerNG. The lack of any ticket updates on a package is usually a bad sign that the maintainer has left. I told everyone that this /409 issue with Squid breaks the package and a pretty detailed write up on the redmine along with a potential solution but no one from Netgate picked it up.
                                          The pattern is repeated again, this time with pfblocker. I hope im wrong but with a single maintainer and unassigned redmines, the writing is on the wall for the package.

                                          Features requests pile up...
                                          πŸ”’ Log in to view

                                          Bug tickets pile up...
                                          πŸ”’ Log in to view

                                          Firewall: NetGate,Palo Alto-VM,Juniper SRX
                                          Routing: Juniper, Arista, Cisco
                                          Switching: Juniper, Arista, Cisco
                                          Wireless: Unifi, Aruba IAP
                                          JNCIP,CCNP Enterprise

                                          J 1 Reply Last reply Nov 13, 2023, 2:34 AM Reply Quote 1
                                          39 out of 55
                                          • First post
                                            39/55
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.