Correct Port Forwarding for PlayStation 5 Remote Play

lerinave · August 6, 2022, 1:52am

I’ve been trying to set up set up Remote Play for my PS5 connected to Mikrotik hex S, which is directly connected to the Internet.
There are some different answers regarding the correct ports to forward for PS5. However, I set up forwarding for all of them for ease, including
1935/3478/3479/3480/3074/987/9295/9296/9297/9301/9303/9304/9308/8572
and included both TCP and UDP for convenience, with commands in /ip firewall nat such as
add chain=dstnat dst-port=3478 in-interface=pppoe-out1 action=dst-nat protocol=udp to-address=%PS5 Internal IP% to-port=3478

However, each time I try to connect from my iPad in the same LAN, the Remote Play app goes through the Internet to get linked to PS5 instead of “nearby”, which means via the LAN directly. The connection, once established, is not stable either, as it drops pretty quickly (though not laggy before disconnection).

Do I need to make some additional settings such as hairpin NAT or something else to make it connect locally? Or if the port forwarding I set up was not quite right?..

Many thanks!

anav · August 6, 2022, 12:45pm

Not familiar with that, and it looks like you want to access the at home play5 with your ipad and instead the ipad wants to go out the internet to the Play5 cloud server??
Sounds like a setting is required on the ipad application to let it know that there is a local entity that you want to access?

What IP do you give the IPAD to connect it should be the LANIP of the local play5 ???

a. a diagram would be helpful
b. the full export of the config is necessary…
/export hide-sensitive file=anynameyoulike
minus any WAN IP or WAN Gateway IP info…

anav · August 6, 2022, 12:52pm

A diagram would be helpful to understand the network
But even better your full config /export hide-sensitive file=anynameyouwish
just ensure you use fake numbers for any WANIP or WAN Gateway IP information.

I am not sure what you mean by remote play.
Most times your xbox or play5 connects to a remote server and NO ports need forwarding as its handled via the initial connection to the server.

Okay so what is being done here is your playstation 5 streams the game to your device, so it is playing over the internet.
You connect the APP to the cloud PSN account and then select the Server (probably from the cloud) to your wanip…

Thus perhaps you are running into hairpin nat issues?
Post your config and then we will see what we can do.
/export hide-sensitive file=anynameyouwish
just ensure you put in fake number for WANIP or WAN Gateway IP info.

anav · August 6, 2022, 12:53pm

What NAT type do you have when you connect to the pS5 network, and I mean without any of the port forwarding nonsense which you should have to do!!

lerinave · August 8, 2022, 1:55am

@anav thanks for the reply! I’ve been out so am a bit late reading it.

The topology is quite simple: the router (hex S) dials PPoE over the ONT, so it gets a public IP address directly. Everything else simply connects to this router (WiFi devices via an AP), and all local IP addresses are statically leased, including the iPad and PS5.
Yes, I’m trying to use iPad’s Remote Play app to connect to the PS5. It does not have much options/settings to change, and both the iPad and PS5 shows NAT Type 2.
The iPad app searches if the PS5 is “nearby” first, and goes to search via the “Internet” if it does not find the PS5 “nearby”, which means local. However, mine never finds the PS5 locally and it goes to the Internet every time. SONY’s server’s may, as I believe, bridge the two devices during setup, but is out once they found each other (via the Internet, which should not be necessary). The ideal path should be that once it is determined that the two devices are within the same local network, no internet traffic would be necessary.

I have attached the exported config to the reply with irrelevant and sensitive info removed. It would be great if you can further help:)
currentconfig.rsc (6.89 KB)

Znevna · August 8, 2022, 4:09am

What AP are you using and how is it configured?

anav · August 8, 2022, 10:12am

Step 1: DISABLE all current port forwardings for the ports you entered for the P5. (not remove as they may be required later).
Be advised all the rules are not in the correct format for dynamic IP address and hairpin nat and would have to be changed anyway)

add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=1935 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=1935
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=3478 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=3478
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=3479 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=3479
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=3480 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=3480
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=3074 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=3074
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=3478 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=3478
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=3479 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=3479
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=987 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=987
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=987 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=987
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9295 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=9295
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9295 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=9295
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9296 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=9296
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9296 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=9296
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9297 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=9297
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9297 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=9297
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9301 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=9301
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9301 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=9301
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9303 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=9303
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9303 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=9303
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9304 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=9304
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9304 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=9304
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9308 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.xxx.151 \
    to-ports=9308
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=9308 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=9308
add action=dst-nat chain=dstnat comment=PlayStation_5 dst-port=8572 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.xxx.151 \
    to-ports=8572

…

Now lets modify a particular firewall rule you have …
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
We are going to create three rules instead…

add action=accept chain=forward in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward connection-nat-state=dstnat
add action=drop chain=forward comment=“Drop all else”

Drop all else as the last rule, is part of the rule we are replacing but a better way of doing this as this drops all traffic from WAN to LAN but also all LAN to WAN or potentially any other L3 traffic within the LAN (lan to lan - if you had vlans for example). Its more comprehensive and puts the admin in control of allowed traffic. Due to this we have to add in the allow internet rule.
The dst-nat rule is now in a clear format which will allow dst nat from inside the LAN not just from the WAN which is in effect part of the issue here…

Now try connecting and see what the results are!

Znevna · August 8, 2022, 3:05pm

@lerinave: also the mighty reddit suggests to just enable “remote play” on PS5 WITHOUT LINKING a device. So DO NOT select “link a device” and it will find it locally.