UPnP and multiple Xbox 360s (4-8)



  • Is it realistic to think that UPnP and Open NAT status are possible for more than one Xbox 360 behind 1 IP using pfsense(or any router for that matter)?

    I am using 1.2 RC2 and have applied the upnp fix that RSW686 has submitted and as far as i can tell they are working.  However it seems that with multiple xbox 360s, you are sharing the port forwards between the Xbox 360s.  I check the XBL connection in the dashboard and it says open for all xbox 360s.  Should I try XBL connection test for all 4 Xbox 360s simultaneously?

    The reason I am asking is because we play often online in Halo 3 and everyone claims that "We never get host."  Could this be the symptom of the multiple Xbox 360/UPnP thing?

    I have everyone pointing the finger at me saying that this router software is inferior and I'm getting annoyed.  I get responses like "just get an xbox live compatible router and it will be easier and faster."  (of course those people only have one xbox at their house). I don't want an XBL compatible router at all.  I want pfsense!

    Also once the xbox 360 is off should there still be entries in the uPNP status menu for the xbox 360s that were on a few hours ago?  In my case I still see entries in the upnp status from the night before.

    Any help would be greatly appreciated.

    EDIT: By the way I have enabled static ports.



  • @xcrustwadx:

    However it seems that with multiple xbox 360s, you are sharing the port forwards between the Xbox 360s.

    Every xbox 360 should have its own mapping in the UPnP status page.

    @xcrustwadx:

    The reason I am asking is because we play often online in Halo 3 and everyone claims that "We never get host."  Could this be the symptom of the multiple Xbox 360/UPnP thing?

    What do you mean by "we never get host". I rarely play xbox 360 so put it in dumb terms as far as what you do to have that happen. Does this happen with one xbox 360 or just with multiple xbox 360 being on at the same time?

    @xcrustwadx:

    Also once the xbox 360 is off should there still be entries in the uPNP status menu for the xbox 360s that were on a few hours ago?  In my case I still see entries in the upnp status from the night before.

    Yep I have noticed this as well. The issue is xbox 360 never deletes the port mappings. I think it expects the router to just delete them after an inactive time period. However every other UPnP software or device always deletes the mappings. Xbox aldo doesn't check for an exisiting mapping either. Thats why I had to update miniupnpd so that if the port forwarding for the xbox was already there it didn't create a new one on a different port.

    It is not a big deal the mappings are left in place, except for having that port always being forwarded. I think there is a menu choice in the xbox 360 so you can delete the mapping manually, however it might be easier to just restart the service.

    @xcrustwadx:

    EDIT: By the way I have enabled static ports.

    Gald you edited your post and added that. That was the first thing I was going to recommend.



  • When i said "We never get host" i was referring to Bungie's host choosing algorithm.  In the past few days we have gotten to host some games so this issue seems to be resolved (after i turned off traffic shaper)

    Also it's true that all xbox 360s have their own entry… only one has the 3074 entry however.

    we normally just press the power button to turn off the Xbox 360... do you think properly shutting the Xbox down will clear the port mappings in uPnP? like hold the X button and choose shutdown.

    By the way RSW thank you for your help!!!  I have tracking your upnp progress and it has really helped my network!

    I am currently using 6 Xbox 360s at my house using upnp.  I will keep you updated on how everything works.



  • @xcrustwadx:

    Also it's true that all xbox 360s have their own entry… only one has the 3074 entry however.

    It is good to know turning off the traffic shaper seemed to fix the problem. Yep only one will have port 3074. All the xbox's must have their own unique port number. You only have one public IP. So from the outside the only way to request a specific xbox is with its unique port.



  • We now have 7 xbox 360s on my network behind a pfsense box all working with upnp.  average upstream with all on xbox live is ~ 78-82KB/s… although i am using remote desktop from another location so this may be lower since RDP uses some upstream.
    CPU usage is never more than 5%, avg 0-3% on:
    AMD athlon 1.5ghz skt A
    512mb  (2x256) registered DDR 266
    ASUS mboard
    8gb 5400rpm hard drive
    generic compaq atx psu
    3com 3c network cards
    interfaces: lan, wan, opt1 and opt2

    Thank you so much for your upnp help and the great router distro!



  • it,s a serch on the site. or some swedish det är en sök sida här nånstans.  can,t i play with you ? what,s your namne on xbox live ?



  • It is not a big deal the mappings are left in place, except for having that port always being forwarded. I think there is a menu choice in the xbox 360 so you can delete the mapping manually, however it might be easier to just restart the service.

    How would I schedule the miniupnpd service to restart at 7:30AM every morning?  I would like those upnp entries cleared every morning when no one is playing.  I was scared to mess around with the crontab file since it stated that it is best to not edit the file manually.

    Would it be something like

    minutes - 30
    hours 7
    day *
    month*
    etc ?

    command = /etc/init.d/miniupnpd restart?
    (I'm new to Freebsd)

    The reason I am asking is because after there were about 8-10 residual upnp entries for the xbox 360s on my network and after a few days, none of the Xbox 360s were able to connect to Xbox Live (similar to the symptoms I experienced pre-RSW patch to miniupnpd).  After I cleared the upnp entries (and the miniupnpd service was restarted) via the web interface and rebooted the Xbox 360s I was OK.  I normally manually restart the service but I would like to avoid using the web interface every day to do so.

    It also seems like when two or more Xbox 360s are powered on at the same time (or very close together), one or more will fail to connect to Xbox Live the first couple times we try to connect.  Is this normal?

    Thank you for your help.



  • You would need to backup your config, add the cron item, and then restore your config.

    <cron><minute>30</minute>
    <hour>7</hour>
    <mday></mday>
    <month>
    </month>
    <wday>*</wday>
    <who>root</who>
    <command></command>/usr/local/sbin/upnp_support restart</cron>

    Since miniupnpd is supported with the livecd there is no rc file as the commands are php functions. You would need to download the following file. I would place it under /usr/local/sbin/. This will allow to interface miniupnpd from the command line.

    http://wgnrs.dynalias.com/pfsense/miniupnpd/upnp_support



  • Hey thanks for the script… That's a lot of work for you to write!  I will try it tonight and let you know how it works.



  • @xcrustwadx:

    Hey thanks for the script… That's a lot of work for you to write!  I will try it tonight and let you know how it works.

    Your welcome! I am the miniupnpd maintainer and the script was a way for me to easily test out builds.



  • The script seems to be working AOK.  However my time/date is set incorrectly.  I did "date 0711151223" from SSH to set it to 12:20 11/15 but I'm not sure this is the proper way.  What is the proper way to set the time and date in Pfsense?



  • @xcrustwadx:

    The script seems to be working AOK.  However my time/date is set incorrectly.  I did "date 0711151223" from SSH to set it to 12:20 11/15 but I'm not sure this is the proper way.  What is the proper way to set the time and date in Pfsense?

    The date and time is set automatically via ntp. Make sure your timezone is set correctly on the System -> General page.



  • ok time is now set properly via the general menu.  Sorry, I glanced there for a time setting but I missed it.  Should have done CTRL+F.  Thank you.



  • OK.  The script/cron job definately works.  I just checked the upnp status and it's completely cleared!  This is great.

    Are there any plans to build in a timeout for upnp port mappings?

    The reason I ask is because it has been said that Xbox never bothers to release the ports when it is powered off (which I can certainly say is true from firsthand experience).  I know that this is actually a problem with the implementation on the Xbox's end and not with miniupnpd but restarting the service every morning seems like it may not be the best solution.  If there is any way I can help, please let me know.



  • My debate about adding it into miniupnpd is deciding when is the port inactive. I'm not sure how easy it is to see the last activity since once the rule is created pfSense is dealing with the redirects not miniupnpd. I'll contact the miniupnpd author and see what his opinion is on this.



  • 1.  Can I manually remove one upnp record/mapping without restarting the entire service and clearing ALL mappings?

    2.  Would it be feasible for me to write a custom script that removes a particular upnp port mapping once the DHCP lease that requested it expires?

    Im starting to think… why incorporate a band-aid into the code of miniupnpd, which works fine, that is a workaround for a problem that should be solved on Microsoft's end... ie send the "I'm done with this upnp mapping, you can remove it now." packet.  I'd rather make an "external" band-aid to avoid adverse effects on miniupnpd(a script for instance).

    I'm not too clear on how DHCP protocol works but the pfsense web UI seems to know when a host is down and no longer using its lease.



  • @xcrustwadx:

    1.  Can I manually remove one upnp record/mapping without restarting the entire service and clearing ALL mappings?

    2.  Would it be feasible for me to write a custom script that removes a particular upnp port mapping once the DHCP lease that requested it expires?

    Miniupnpc is the client which can talk to miniupnpd. You would need to compile this for pfSense. Then it could be used to tell miniupnpd to remove a mapping. This is something that could be added to the pfSense UPnP implementation. I could see this being useful for others.

    The easiest way to compile for the pfSense platform is to use the pfSense Developers edition. I think you can still get this on the snapshot server.

    @xcrustwadx:

    I'm not too clear on how DHCP protocol works but the pfsense web UI seems to know when a host is down and no longer using its lease.

    True, but that is a bandaid fix as well. Not everyone is going to want or need that feature. The DHCP protocol marks the lease as inactive when its renewal time expires and the host has not renewed the lease. However some people set this time limit to days.



  • I forgot to mention that if you use Windows XP you can remove the mappings by going to the Network Connections folder. Right click on Internet Connection click Properties, click Settings, and you can delete individual mappings.



  • Thanks for the tip.  You need the Windows XP uPnP UI installed on the XP machine first and then this will work.  I have just used it.  Im currently using VM to install pfsense dev beta 1 and I will attempt to compile the miniupnpc.



  • @xcrustwadx:

    Thanks for the tip.  You need the Windows XP uPnP UI installed on the XP machine first and then this will work.  I have just used it.  Im currently using VM to install pfsense dev beta 1 and I will attempt to compile the miniupnpc.

    I just built miniupnpc successfully use gmake. You'll need to add gmake using

    pkg_add -r gmake

    To build

    /usr/local/bin/gmake

    From here you could add check boxes next to the mappings on the UPnP Status page and a remove button. You could even write a script to search the current mappings and then remove any with xbox in them at 7:30 in the morning. Or if you want to get detailed write the script to compare the mappings with the dhcp leases and remove the inactive ones.



  • @rsw686:

    From here you could add check boxes next to the mappings on the UPnP Status page and a remove button. You could even write a script to search the current mappings and then remove any with xbox in them at 7:30 in the morning. Or if you want to get detailed write the script to compare the mappings with the dhcp leases and remove the inactive ones.

    Turns out that the new version of miniupnpd can clean out old mappings. I have compiled the binary and updated the webgui. The other improvement is called secure mode which locks down clients to only creating mappings to their IP. If anybody would like to test it out and let me know how it works that would be great. I plan on adding this into the cvs for 1.3, but for now you can update your 1.2 version with the following.

    
    cd /tmp
    fetch http://wgnrs.dynalias.com/pfsense/miniupnpd/upnp_support
    chmod +x upnp_support
    ./upnp_support update
    
    

    Afterwards you'll need to reconfigure upnp via the webgui. Please note that if you don't like the new version you'll have to manually restore the old files.



  • @rsw686:

    Afterwards you'll need to reconfigure upnp via the webgui. Please note that if you don't like the new version you'll have to manually restore the old files.

    Or reapply the 1.2 release full update that will reset all files back to release versions  ;)



  • RSW686: I just saw your post sorry it took so long.  I check back here occasionally.  I have applied the patch you posted on March 17 and I will test this weekend for sure at my secondary location.  I will also attempt to try at my other location which has the multiple Xbox 360s.

    Does the "upnp bypassing the traffic shaper problem" still happen in 1.2 final?  If so is this in the works for 1.3?



  • @xcrustwadx:

    Does the "upnp bypassing the traffic shaper problem" still happen in 1.2 final?  If so is this in the works for 1.3?

    There is a way to compile miniupnpd to use an ALTQ queue. I'm not sure how this would tie in with the traffic shaper.



  • Well what i recommend is to add an option to tag packets that match the miniupnp nat/rdr/filter rules and not make them terminating ie not use quick.

    This is the same at what ftp-proxy on latest openbsd does and it helps a lot catching things up queueing them and so on.

    Please suggest to the author of miniupnpd to make this change and be done with it.
    One pfSense 1.3 you can match tags from the filter rules created in the gui.

    This is the best design and would make miniupnd compeletely standalone and not watching at other information it does not need to.

    I do not know if PNP protocol supports classes but if it does it would be nice to allow the option to specify one tag to be applied to specific traffic served by this daemon and then matched by tag from the user so to shape or not allow it at all.

    I hope this helps you somewhat.
    As for the change iirc it is just ~10 lines of changes max.



  • @ermal:

    Well what i recommend is to add an option to tag packets that match the miniupnp nat/rdr/filter rules and not make them terminating ie not use quick.

    Miniupnpd was using rdr pass on, but I have recompiled it so that it is creating an rdr and a pass rule. I have also disabled the quick setting. So now I have rules that are looking like this

    jellyfish:/tmp#  pfctl -aminiupnpd -sn
    rdr on fxp2 inet proto udp from any to any port = 46678 label "Azureus UPnP 46678 UDP" -> 10.10.1.150 port 46678
    rdr on fxp2 inet proto tcp from any to any port = 46678 label "Azureus UPnP 46678 TCP" -> 10.10.1.150 port 46678
    jellyfish:/tmp#  pfctl -aminiupnpd -sr
    pass in on fxp2 inet proto udp from any to any port = 46678 flags S/SA keep state label "Azureus UPnP 46678 UDP"
    pass in on fxp2 inet proto tcp from any to any port = 46678 flags S/SA keep state label "Azureus UPnP 46678 TCP"

    Your saying I need to tag it as well. So at the end of the rule it should have a tag UPNP or something of that sort like the below?

    pass in on fxp2 inet proto udp from any to any port = 46678 flags S/SA keep state label "Azureus UPnP 46678 UDP" tag UPNP

    The option already in the upnpn daemon can append queue SOMENAME to the rule. I could easily add in the tag option like above if that is better.



  • Yeah a tag option is better and get rid of the queue option compeletly.
    It is not needed and is cumbersome.

    Please add the tag to the rdr rule so it produces
    rdr ….blabla.... tag MYTAG label "whatever" -> to $whatever

    it is better in the rdr since it is the first thing that takes a look at the packet ;)

    I would also like to see the rdr being generated for multiple interfaces so the PNP traffic can be loadbalanced with the help of tags.
    But that is more homework i guess.



  • So I could do rdr pass….blabla.... tag MYTAG label "whatever" -> to $whatever and skip the separate pas rule?

    The additional features can come once I get the basic thing working in 1.3 with the traffic shaper. ;)



  • @rsw686:

    So I could do rdr pass….blabla.... tag MYTAG label "whatever" -> to $whatever and skip the separate pas rule?

    No since that extra "pass" might bypass the ruleset.
    Just add the tag on the rdr that is my suggestion, you still need the separate rules to pass traffic.



  • Sounds good. I just wanted to make sure it was implemeted the best way. 1.2 upnp just uses one rdr pass rule and I wasn't sure what was more efficient. Thanks.



  • Is it that uPnP bypasses the traffic shaper all together or does it's traffic just get automatically sent to the default queue?  I'm on 1.2 Final and it looks like the upstream traffic from utorrent using a random port via upnp is being "picked up" in the "qwandef" queue status graph.

    So… if I design my shaper solution around this fact, I might be able to make it work, correct? (and not have to wait until 2009 for 1.3)
    For instance:  I know Xbox 360 traffic will be uPnP and so will be in the default queue automatically.  I can make my P2P stuff go to another queue of lower priority and saturate it completely.  Then I'll see if my ping times are OK.  If they are OK, or at least less than with no shaping, then I'm headed in the right direction!

    I'm going to test this when I get home.

    Also the 1.2 final release has a working version of upnp which DOES NOT, from my experience, need the script/patch provided by RSW686 for the older version(I believe this patch is already included in the recent PFsense releases).  I'm back to using a residential ISP with 1 dynamic address and we have 8 Xbox 360s here (all upnp, all open NAT status) as well as a PS3(uPnP as well) all playing nicely online.  My pfsense uptime has been around 72 days and I haven't restarted miniupnpd in about 2 weeks.  The only reason it has restarted is because of the troublesome power outages.  My last issue in the traffic shaper

    Thanks again for your help.



  • Yes your assumtion is correct.



  • I tested it all this weekend.  It is true, the uPnP traffic gets sent to the default queue automatically.  So I was able to play around with the shaper to make it work!  There is a ton of tweaking I need to do still(default queue is showing drops while the P2P queue is not).  All in all I would say it's a great success for me!  I was able to completely saturate my upstream and play online games for many hours with only a few tiny hiccups(like I said I need to tweak).  It's a great thing!

    What I've been attempting is to treat my default queue like my highest priority queue which can work since I don't use voip and 90% of traffic that I couldn't classify(and send to a lower priority queue) would be high priority online gaming traffic anyway.
    I'm researching the traffic shaper now.



  • The shaper seems to be working very well now!  UPnP is working great as well.  I've attached a screenshot of what my uPnP status page looks like.  I don't think there are too many routers out there that can handle this kind of usage.  Thank you PFsense devs for making the ultimate gaming router / firewall!



Log in to reply