|
|
Post by jrronimo on Nov 19, 2015 23:42:03 GMT
Hey Lee, have you thought about something like uPNP or NAT-PMP support?
I know it's a bit scary since it lets devices control port forwards rather than an administrator, but for a 'home' user, it can be helpful. I ran into trouble with some games on Xbox One / PS4 recently and had to set up like 6-10 different rules and assign those devices static IPs to get around it.
|
|
|
|
Post by Lee Sharp on Nov 20, 2015 18:31:41 GMT
Hey Lee, have you thought about something like uPNP or NAT-PMP support? Yes, and it has been discussed at length for YEARS. And the result is "Oh, Heck no!"  In all seriousness, there are several problems with implimenting something like this. First, the security aspects of it are just too much to overcome. There is no way to secure a router with these things enabled. Your first bit of malware will take down your network. Also, there is no way to stop bittorrent, which is a problem for both business and shared home users. But even if we tried to add it as an optional extra, it would be hard to work around the traffic shaping tools, that are even more important to most gamers. That all said, I would love to come up with something. I would love to have a NAT wizard or template for XBox, or PS4, or whatever. But right now there are other needs taking all of the time the developers have. (I keep trying to update ez-ip update, and still haven't finished!) But if you want to take a pass at it... It could even just be a guide on the website in how to set up the NAT rules for different things. Fame and fortune could be yours! (Well, fame anyway...) |
|
|
|
Post by jrronimo on Nov 21, 2015 0:16:37 GMT
Haha, cool! I may just do that -- the write-up, at least. Wouldn't be too hard... I'll have to brush up on the NAT and Firewall manual to be sure I haven't screwed up entirely, haha.
I figured that would probably be the answer, but I wasn't sure. Totally makes sense, and I agree with it. Just had to ask. Cheers!
|
|
|
|
Post by watercooled on Dec 13, 2015 0:14:29 GMT
Disabling port remapping for the device in question seems to work quite well in achieving 'open' NAT on the consoles for the most part. And I think forwarding port 3074 is helpful for at least the Xbox 360. But of course that doesn't help much if you have multiple consoles on the same router - as far as I'm aware there's no way to achieve open NAT on two Xbox 360 consoles without uPnP, but I've never tried it myself. If port 3074 is unusable (i.e. used by the other console), I think the process is to dynamically choose another port and forward it with uPnP.
However I've found PC gaming is much more of a pain in terms of port forwarding and there are a couple of games I've never managed to achieve 'open' NAT on without uPnP despite wasting hours on uselessly trying the stupidly-large port ranges recommended in their FAQ pages (as I ranted about in the other thread).
IMHO a 'good' compromise, at least from an end-user's perspective, is being able to allow only uPnP to only certain devices. I of course understand that doesn't fix the seemingly unfixable security mess, but with some hardening rules it could be made such that NAT and firewall entries can only be made/altered for the device in question. I'm not sure if that's what's currently done on pfSense?
Also I'm not sure how much bloat uPnP would add to the image? I'm a big fan of keeping it as minimal as possible. Maybe keep the uPnP in a separate image?
|
|
|
|
Post by Lee Sharp on Dec 13, 2015 3:15:36 GMT
What I think would be the best solution is to have a UP&P wrapper on the PC or another device to monitor what the client is trying do do, and allow you to manually set it on the firewall if you choose. Of course, writing better code in the first place so it was not needed would be the best solution, if also the least likely. That said, if someone wants to play with UP&P on SmallWall, and it is transparent and disable-able, I will do what I can to support you. |
|
|
|
Post by jrronimo on Mar 26, 2017 19:28:21 GMT
Unfortunately, Nintendo (at least) is unwilling to write better code. I have a Nintendo Switch, and tried to play in the server test for Splatoon 2 yesterday and Friday. I was unable to connect to a game, with the system telling me it was a NAT problem. Not even a joke, in absence of UPNP, Nintendo advises users to forward UDP ports 1 - 65535 to their console! en-americas-support.nintendo.com/app/answers/detail/a_id/651/~/how-to-set-up-port-forwarding This is absurd! Worse, it didn't work. I think what led me to make this thread in the first place was Splatoon 1 on Wii U, but that was sort of fixed once I told SmallWall not to remap outbound ports... but that didn't work for Splatoon 2 / Switch. I watched firewall logs and ended up forwarding ports 30000-65535, but still was unable to connect. It seems to also hit port 137, but that might be something else. Sadly, I don't see this situation changing anytime soon, and only getting worse. I don't know if I know enough to add something like this to SmallWall, but maybe I can figure it out. I imagine a checkbox to enable UPNP/NAT-PMP in the first place, and then maybe a list of MAC addresses that are allowed to do it...? I'll start looking into it when I can find some free time. |
|
|
|
Post by Lee Sharp on Mar 26, 2017 19:53:16 GMT
That is just unbelievable! But then again, I have done PCI compliance gigs, and so I know that security is a joke, even to people who have it as the focus of their job!
As a test, you probably need TCP, UDP and ICMP because I bet it pings back...
|
|
|
|
Post by jrronimo on Mar 27, 2017 2:29:13 GMT
Quick question:
When the "avoid port remapping" option is set for a specific IP, what should it look like in the log?
I see, as an example: Green arrow, time, If (WAN), Source (200.125.105.105, port 59609), Destination (192.168.1.92 [static IP of my Wii U], port 33858), Proto (UDP)
-- should the Source and Destination ports match? I'm on the 1.8.4b11 build.
|
|
|
|
Post by Lee Sharp on Mar 27, 2017 2:46:30 GMT
I have never done it for a single IP. I have only done it for the entire network... But no, source and destination never match. I guess they "could" but I have never seen it. |
|
|
|
Post by jrronimo on Mar 27, 2017 3:13:23 GMT
Well, that's good, at least. Just checking my assumptions before I go crazy trying to figure this out.  As it stands, Splatoon on Wii U can't connect to another game. There's no definitive "list" of ports, since it just uses whatever it darn well pleases... I'm not sure what to do to get it working. I've tried making a firewall rule that says "source = Wii U IP, proto & destination = any: allow", but I still see things getting blocked in the log with the source IP that should be "allowing all". I feel like I'm missing something... Edit:// Weirder: I put the rule under the WAN interface, but that doesn't make sense since packets coming from my LAN won't be coming from my WAN Interface. What is weird, though, is that the firewall is logging blocked packets from LAN as the source. The destination is TCP port 443... why would outbound 443 be blocked by the firewall? The only LAN interface rule is to allow everything. |
|
|
|
Post by jrronimo on Mar 27, 2017 4:18:26 GMT
Further weirdness: I found that I had posted a different thread largely about this game (sorry), and it seems that rebooting after setting up the "avoid remapping" setting helped: smallwall.freeforums.net/thread/92/dmz-help...but I still can't seem to get the game to connect. :/ I really don't understand what's up... |
|
|
|
Post by jrronimo on Mar 27, 2017 5:29:03 GMT
Got it. I didn't realize that the "Enable Advanced Outbound NAT" box had to be checked for the static outbound NAT settings to take effect. Eesh, that was frustrating... Credit where credit's due: I found it on an old m0n0wall post: m0n0.ch/wall/list/showmsg.php?id=353/15 I set a static mapping to be [Wii U IP]/32 with the "avoid remapping" option set, but then the Wii U was the only device with Internet. Thinking back to Lee's comment earlier about only doing it for whole networks, I changed the setting to 192.168.1.0/24 with "avoid remapping", and all devices are happy. Sooooo.... what are the implications of my whole network "avoiding remapping"? Is there a way to say "Devices 1, 2, and 3 should avoid remapping, but any other device can"? |
|
|
|
Post by Lee Sharp on Mar 27, 2017 14:41:01 GMT
Yes... But... Let me start with source port randomization. It helps fight DNS cache poisoning. (And a few other security issues) Of course if you have SmallWall act as DNS, that part is a non-issue. en.wikipedia.org/wiki/DNS_spoofing#Prevention_and_mitigationNow, to remap some but not all, you have to subnet. If you only want to not remap one address, you have to subnet a lot. Because you will have to have a rule covering every IP, so a /25, a /26, a /27, a /28, a /29, a /30, a /31, and two /32 networks with one being not remapped. Frankly, I just do not remap and do not worry about it. |
|
|
|
Post by jrronimo on Mar 27, 2017 19:18:53 GMT
Ahhh, gotchya... okay, yeah, I'll just not remap for the whole network. Thanks for the insight!
|
|
|
|
Post by Lee Sharp on Mar 27, 2017 19:27:08 GMT
No trouble, and glad to get it working for you!
|
|
