Xbox Live Moderate NAT help.

RouterOS General
1

My dad got this new router which has been an absolute nightmare for me on Xbox Live for the Xbox One. The interface of this router is extremely advanced for me. We had a Linksys before which was much easier to do this with. All I want to do is forward my ports to enable my NAT to be OPEN on XBL because with a Strict NAT, it is troublesome to connect to people’s parties or connect to people’s lobbies. The entire experience is compromised. I googled some guides and proceeded to utilize them to open my ports for my Xbox. These are the links I used.
Suggested network ports from Xbox.com -

http://support.xbox.com/en-US/xbox-one/networking/network-ports-used-xbox-live

Youtube Portforwarding Mikrotik video -

https://www.youtube.com/watch?v=8sGL58AhQCQ

Website used to check if ports successfully opened -

http://scanme.firebind.com/applet.html

Here is the log from my terminal window of all of the ports that I opened.


[admin@MikroTik] > /ip firewall
[admin@MikroTik] /ip firewall> nat print 
Flags: X - disabled, I - invalid, D - dynamic 

0 ;;; default configuration chain=srcnat action=masquerade to-addresses=0.0.0.0 out-interface=ether1-gateway log=no log-prefix="" 

1 chain=dstnat action=dst-nat to-addresses=10.1.1.125 to-ports=88 protocol=udp in-interface=ether1-gateway dst-port=88 log=no log-prefix="" 

2 chain=dstnat action=dst-nat to-addresses=10.1.1.125 to-ports=3074 protocol=udp in-interface=ether1-gateway dst-port=3074 log=no log-prefix=""

3 chain=dstnat action=dst-nat to-addresses=10.1.1.125 to-ports=3074 protocol=tcp in-interface=ether1-gateway dst-port=3074 log=no log-prefix="" 

4 chain=dstnat action=dst-nat to-addresses=10.1.1.125 to-ports=53 protocol=tcp in-interface=ether1-gateway dst-port=53 log=no log-prefix="" 

5 chain=dstnat action=dst-nat to-addresses=10.1.1.125 to-ports=53 protocol=udp in-interface=ether1-gateway dst-port=53 log=no log-prefix="" 

6 chain=dstnat action=dst-nat to-addresses=10.1.1.125 to-ports=80 protocol=tcp in-interface=ether1-gateway dst-port=80 log=no log-prefix="" 

7 chain=dstnat action=dst-nat to-addresses=10.1.1.125 to-ports=500 protocol=udp in-interface=ether1-gateway dst-port=500 log=no log-prefix="" 

8 chain=dstnat action=dst-nat to-addresses=10.1.1.125 to-ports=3544 protocol=udp in-interface=ether1-gateway dst-port=3544 log=no log-prefix=""

9 chain=dstnat action=dst-nat to-addresses=10.1.1.125 to-ports=4500 protocol=udp in-interface=ether1-gateway dst-port=4500 log=no log-prefix=""

All of my ports, besides UDP 53 for some reason, report to be opened. But, after testing all of these ports my NAT refuses to change to OPEN and I am stumped as to why. I have tried UPNP and it did not work. I set my WAN interface to be external and my LAN to be internal as a guide suggested to no avail. Some help would be extremely appreciated. Thanks.

2

I’ve got this working at home so I will grab my config when I’m finished work.

In the meantime, if you think that your filter and nat rules are right, turn off the Xbox, reboot the Mikrotik and then power the Xbox back on.
Because the Mikrotik is stateful it remembers the Xboxs connection (I think for up to 24 hours). I was finding that changing rules and rebooting the Xbox was having no effect, because the original connection state was cached. A reboot of the Mikrotik will clear the cache and regenerate a connection state based on your updated rules.

3

You can remove connections from the GUI in Winbox by going into IP > Firewall > Connections
Highlight a connection, and click the red minus sign - to remove it.
If you do this, you won’t need to reboot the two devices.

4

I read something on the Microsoft forums that starts of by saying that enabling UPnP fixes everything, but just in case you don’t have UPnP… (lots of stuff)

Mikrotik supports UPnP
http://wiki.mikrotik.com/wiki/Manual:IP/UPnP

Try enabling it and seeing if this fixes your problem.

5

Top tip, I’ll remember that! :smiley:

From a security point of view, enabling UPnP is a complete no-no.

Here are my rules:

Filter Rules

chain=forward action=accept protocol=tcp dst-port=3074
chain=forward action=accept protocol=tcp dst-port=53
chain=forward action=accept protocol=tcp dst-port=80
chain=forward action=accept protocol=udp dst-port=88
chain=forward action=accept protocol=udp dst-port=3074
chain=forward action=accept protocol=udp dst-port=53
chain=forward action=accept protocol=udp dst-port=500
chain=forward action=accept protocol=udp dst-port=3544
chain=forward action=accept protocol=udp dst-port=4500

NAT Rules

chain=dstnat action=dst-nat to-addresses=<XBOX IP ADDRESS> to-ports=3074 protocol=tcp in-interface=<ISP INTERFACE> dst-port=3074
chain=dstnat action=dst-nat to-addresses=<XBOX IP ADDRESS> to-ports=53 protocol=tcp in-interface=<ISP INTERFACE> dst-port=53
chain=dstnat action=dst-nat to-addresses=<XBOX IP ADDRESS> to-ports=80 protocol=tcp in-interface=<ISP INTERFACE> dst-port=80
chain=dstnat action=dst-nat to-addresses=<XBOX IP ADDRESS> to-ports=88 protocol=udp in-interface=<ISP INTERFACE> dst-port=88
chain=dstnat action=dst-nat to-addresses=<XBOX IP ADDRESS> to-ports=3074 protocol=udp in-interface=<ISP INTERFACE> dst-port=3074
chain=dstnat action=dst-nat to-addresses=<XBOX IP ADDRESS> to-ports=53 protocol=udp in-interface=<ISP INTERFACE> dst-port=53
chain=dstnat action=dst-nat to-addresses=<XBOX IP ADDRESS> to-ports=500 protocol=udp in-interface=<ISP INTERFACE> dst-port=500
chain=dstnat action=dst-nat to-addresses=<XBOX IP ADDRESS> to-ports=3544 protocol=udp in-interface=<ISP INTERFACE> dst-port=3544
chain=dstnat action=dst-nat to-addresses=<XBOX IP ADDRESS> to-ports=4500 protocol=udp in-interface=<ISP INTERFACE> dst-port=4500

The in-interface isn’t necessarily the physical interface, depending on your setup. My in-interface is the pppoe interface the routerboard uses to connect to my ISP. Don’t forget to clear down the cached connection before turning the Xbox on.

6

First - glad to share a nifty trick. :slight_smile:

Second, I imagine that if there is such a thing as “reasonably secure” UPnP that it could be done on Mikrotik.
But…
I’ve seen some interesting exploits using UPnP in Youtube videos from DefCon…
So yeah - leaving it off is probably the best bet. :wink:

P.S. To anyone reading this thread as a “how-to” later on, with the static NAT maps, make sure the XBox has a static IP as well, or else the dst-nat pinholes are going to break whenever it gets a new IP

7

Very good point. If your Xbox is using DHCP, you’re going to have a bad time.

8

You could also leave the XBox on DHCP and make the lease static in the Mikrotik
IP > DHCP-Server > Leases - double click the XBox’s entry, and press the “Make Static” button.

This is convenient if you take your XBox to other places sometimes, e.g. for LAN parties and stuff, so you don’t have to reconfigure the network in the XBox itself.