Potential New XBoxLive / XBox 360 HOWTO for Review and Comment

[rnsc]

Recently I set up a pfsense with an XBox 360 as one of the clients.
I aggregated everything I read, and learned quite a bit more, and
ended up with a setup that works very well.

I would like to propose the HOWTO below as a sticky, after it has been
reviewed and updated based on comments.

What is below worked for me, but should be considered a document in
review until "finalized."

–Ray

XBox360 Setup and Tutorial

Enormous caveat is that this work was done ENTIRELY with "Call of
  Duty / Modern Warfare 2."  I will update this as adjustments are
  made for other games.

On the other hand, it is completely consistent with everything else I
  have read, yet gives more information and a more closely carved setup.

Microsoft and others tell you to "open" or "Forward" ports 88 and 3074.
  This is both unnecessary and insufficient for pfsense if you have a
  "Default Deny" rule-set.  I assume that these directions are appropriate
  for other routers because of router behavior that Microsoft has assumed
  but not stated.

This setup assumes that you want to constraint the xbox360 as much as
  possible without any compromises on its activities.

88 is for kerebos authentication.  You have to let it out, but if you
  are doing NAT then the NAT engine will generate a transient rule to
  let the reponse in.  No port-forward is necessary.  If you put a port
  forward in place then no other machine on your network will be able to
  use kerebos, since all responses will come back to your XBox360!

I will present the configuration required, followed by an explanation.

First, NAT / Portforward port 3074 to the XBox360 port 3074.

Second, create a Fireall / Rule for WAN allowing the portforward of
  3074 to get through:

TCP/UDP  *  *  xbox360  3074

Third, NAT / Outbound

* Manual Outbound Rule Generation

        Create rules for each of your subnets.  Set "Static Port" on the
        subnet hosting the xbox360 to "Yes."  My rules look like this:

            WAN  192.168.240.0/24  *  *  *  *  *  NO
            WAN  192.168.241.0/24  *  *  *  *  *  NO
            WAN  192.168.243.0/24  *  *  *  *  *  YES

          XBox declared the connection as "Strict" without "Static
          Port, moving up to "Moderate" with "Static Port"

  Create the following firewall rules on the interface that services
  the xbox360:

      TCP/UDP  ABC_Net  *          IF IP Address  53(DNS)
      TCP/UDP  ABC_Net  *          !IF IP Address 53(DNS)
      TCP/UDP  ABC_Net  *          *              80(HTTP)
      TCP/UDP  ABC_Net  *          *              88(KEREBOS)
      TCP/UDP  xbox360  3074        *              1024-65535
      TCP/UDP  ABC_Net  1024-65535  *              3074

  Now for the explanation.

  Off topic, but I block use of external DNS servers.

  3074 is used for all communication, but in various ways.

  During play, all communication goes out through 3074.  Some other
  players appear to receive their incoming communication only on 3074,
  others on apparently random registered and dynamic port numbers.  A
  single one minute trace contained ports from 3976 to 63789.  You can
  block outgoing traffic except for destination ports 88 and 3074 and
  receive an "Open" rating when you run the XBoxLive connection test,
  but as you play, there will be many outgoing packets going to
  registered and dynamic ports that are blocked.  You seem to be much
  harder to kill.  The hypothesis is that those outgoing packets are
  reporting your death, and that the players with the ports other than
  3074 cannot learn of your death.

  All outgoing communication during play originates on port 3074.
  If you move the 3074 requirement from the destination to the source
  to restrict your xbox to sending on 3074 but allow it to send to any
  port, then you will be able to send to all other players.  You will
  be able to play fine, an examination of your Firewall log will not
  show anything blocked, and Packet Capture will not show any packets
  being sent to anything you have blocked.  However you will find that
  your XBoxLive network test now fails, saying that your MTU is too
  small.  This is not true; the xbox' test sends from ports 1258, 1259,
  maybe 1257, and less likely 1256.  Those packets are blocked from
  going out.  So Microsoft is testing on ports not being used for play,
  and playing on ports not being used for test!

  It appears that the use of registered ports is anarchy, except in all
  observed cases either the source or destination was port 3074.

  Short of openning everything wide, allow source (xbox) on 3074 or any
  registered (1024-49151) or dynamic ports (49152-65536) ports with
  destination to port 3074.  In my mind this is pretty stupid, but at
  least it prevents your XBox from sending to non-allowed well-known
  ports.

      TCP/UDP  ABC_Net  1024-65535  *  3074

  Similarly, allow the xbox port 3074 to send to any registered or
  dynamic ports:

      TCP/UDP  xbox360  3074        *  1024-65535

  I have not seen any traffic to date (other than 53(DNS) or 80(HTTP)
  or 88(Kerebos) that did not have 3074 as either the soure or the
  destination.

  This allows the XBoxLive network test to run, and it allows full
  play without any blocked packets in either direction. 

  I have not used uPnP because if I understand it correctly, it is an
  enormous hole.  Any device, or software running on a machine behind
  the firewall, *can* open up anything and everything, for either
  itself or any other machine, or all machines.  You are basically
  trusting every device, and every malware that might be infected
  on every machine.  I assume that I must be wrong or uPnP would be
  render each and every little blue box firewall worthless, but this
  is my understanding right now.  So I will not go near it.

[GruensFroeschli]

Imo you have too much text.
It's quite a lot to read with much unneeded information which is partly wrong and not a step by step how to.

Upnp in pfsense allows you to limit which IP can map which port.

What i would do:
Limit yourself in the text to what steps are necessary to get it to work.
Move all explanations into a second post.
Look at upnp and how to configure it correctly without opening everything up.

[rnsc]

Thanks.  I will collect comments for a couple of days then take another shot at it.
I would strongly prefer to have the explanation in the same note to keep them together.  This keeps all of the pertinent information together.  They could still be very separate, with the steps first.  However if you and others tell me otherwise, I will separate them.

[rnsc]

I decided to put up a new-improved version for the benefit of future readers.  Please continue to comment.  The information content should be the same.
–-

PFSense XBox360 Setup

NAT / Portforward WAN port 3074 to the XBox360 port 3074.

NAT / Outbound

Select:
        (*)  Manual Outbound Rule Generation

Create rules for each of your subnets.  Set "Static Port" to "YES"
      on the subnet with the XBox360, "NO" on the others.

My rules look like this, the XBox 360 is on the
      192.168.243.0/24 network:

WAN  192.168.240.0/24  *  *  *  *  *  NO
          WAN  192.168.241.0/24  *  *  *  *  *  NO
          WAN  192.168.243.0/24  *  *  *  *  *  YES

XBox's network test declared the connection as "Strict" before setting
      "Static Port", moving up to "Moderate" after setting "Static Port"

Create a Fireall / Rule for WAN allowing the portforward of 3074 to get
  through to the xbox360 port 3074:

TCP/UDP  *        *          xbox360        3074

Create the following firewall rules allowing outgoing traffic from the
  subnet hosting the XBox360 (Indicated here as "LAN_Net"):

TCP/UDP  LAN_Net  *          IF IP Address  53(DNS)
      TCP/UDP  LAN_Net  *          *              80(HTTP)
      TCP/UDP  LAN_Net  *          *              88(KEREBOS)
      TCP/UDP  LAN_Net  3074        *              1024-65535
      TCP/UDP  LAN_Net  1024-65535  *              3074

That is all you have to do.  If you want to understand more, read the
  explanation below.

Explanation

This setup assumes that you want to constraint the xbox360 as much as
  possible without any compromises on the XBox functionality or play.

Microsoft says to "open" or "Forward" ports 88 and 3074.  This is both
  unnecessary and insufficient for pfsense if you have a "Default Deny"
  rule-set.  I assume that these directions are appropriate for other
  routers because of router behavior that Microsoft has assumed but not
  stated.

88 is for kerebos authentication.  You have to let it out, but if you
  are doing NAT then the NAT engine will generate a transient rule to
  let the reponse in.  No port-forward is necessary.  If you put a port
  forward in place for port 88, then no other machine on your network
  will be able to use kerebos, since all responses will come back to
  your XBox360!

3074 is used for all communication, but in various ways.  During play,
  all communication goes out through 3074.  Some other players appear to
  receive their incoming communication only on 3074, others on apparently
  random registered and dynamic port numbers.  A single one minute trace
  contained ports from 3976 to 63789.  You can block outgoing traffic
  except for destination ports 88 and 3074 and receive an "Open" rating
  (The highest) from the XBoxLive connection test, but as you play, there
  will be many outgoing packets going to registered and dynamic ports
  that are blocked.  You will seem to be much harder to kill.

Since all outgoing communication during play originates on port 3074,
  it would seem to make sense to move the 3074 requirement from the
  destination to the source, restricting your xbox to sending on 3074
  but allow it to send to any port.  This would enable your xbox to
  contact all other players.  With this change, you will be able to
  play fine, an examination of your Firewall log will not show anything
  blocked, and Packet Capture will not show any packets being sent to
  anything you have blocked.  However the XBoxLive connection test will
  fail completely, saying that your MTU is too small.  This is not true;
  the XBoxLive connection test sends from ports 1258, 1259, maybe 1257,
  and less frequently on 1256.  Those packets are blocked from going
  out.  Microsoft is testing on ports not being used for play, and
  playing on ports not tested!

In all observed cases either the source or destination was port 3074.

Short of openning everything wide, allow both:

Source (xbox) on port 3074 to any registered (1024-49151) or
        dynamic (49152-65536) port.
  and
        Source (xbox) on any registered (1024-49151) or dynamic
        (49152-65536) port to destination port 3074.

This appears to be the tightest constraint that provides an "Open"
  XBoxLive connection and does not block any packets during test or play.

I have not seen any xbox traffic to date (other than 53(DNS) or
  80(HTTP) or 88(Kerebos) that did not have 3074 as either the soure or
  the destination port.