DMZ Help

jrronimo
Full Member

Posts: 37

DMZ Help Nov 26, 2015 6:45:24 GMT

Quote

Post by jrronimo on Nov 26, 2015 6:45:24 GMT

I'm running into a major problem playing the Wii U game Splatoon online. It doesn't seem to use specific ports, so you end up doing things like forwarding UDP 30000-65535 to a specific IP, and even then, 99% of the time, the game will not connect. I got into a game *once*, but I didn't change anything. It worked until I left the group, and I haven't been able to connect since.

Most chatter online suggests just putting the Wii U in a DMZ. I'm familiar with DMZ from more basic home routers, where the admin assigns an IP to be "the DMZ". SmallWall's setup is a bit more intimidating. Does it actually require a 3rd interface? Is there a way to declare an IP address to allow all traffic in and out of it on the existing interfaces?

I've been fighting with firewall rules all night. I can see accepted packets when I try to connect to a game, but then I'm given this mysterious 118-0516 error from Nintendo (essentially: check your firewall rules...). This page has the most detail relating to pfsense, but I'm not quite sure about the outbound NAT mapping. This thread also has some info about a static outbound port... I don't quite understand.

Any insights?

jrronimo
Full Member

Posts: 37

DMZ Help Nov 26, 2015 7:10:52 GMT

Quote

Post by jrronimo on Nov 26, 2015 7:10:52 GMT

Now that I went and posted that, I think I found a few things I was missing:

Setting the outbound NAT to be (Wii U's Static IP)/32 AND checking the box for "Avoid port mapping" seems necessary. After that's set, REBOOT!!!

I don't think I saw the dialogue box after making that change that said to reboot, but it's just as likely that I didn't read the page close enough. I epically need to go bed now, so I'll do more testing tomorrow. Then I can clean up my spaghetti of NAT rules and see what still works at a minimum.

Oy vey!

Lee Sharp Administrator Posts: 522	DMZ Help Nov 26, 2015 20:43:00 GMT jrronimo likes this Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Lee Sharp on Nov 26, 2015 20:43:00 GMT I do not know why the consoles keep forgetting that the world uses NAT now... Sigh... Good troubleshooting, however. The outbound NAT is probably the issue.

jrronimo
Full Member

Posts: 37

DMZ Help Nov 27, 2015 17:07:56 GMT

Quote

Post by jrronimo on Nov 27, 2015 17:07:56 GMT

Nov 26, 2015 20:43:00 GMT Lee Sharp said:

I do not know why the consoles keep forgetting that the world uses NAT now... Sigh... Good troubleshooting, however. The outbound NAT is probably the issue.

It definitely helped in the short test I did the other night.

When I write up that NAT guide for consoles (

), I might just include outbound NAT rules for all of them -- something tells me it might just be required to not remap outbound ports if avoidable.

It seems like consoles are depending on uPNP, which isn't something everyone will necessarily have...

Lee Sharp Administrator Posts: 522	DMZ Help Nov 27, 2015 18:24:11 GMT Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Lee Sharp on Nov 27, 2015 18:24:11 GMT Yep. Consoles are simply not programed with security in mind. At all... And source port remapping is a common security method. But it can break some things. Common with some VOIP implementations.

watercooled
Junior Member

Posts: 12

DMZ Help Dec 6, 2015 12:59:06 GMT Lee Sharp likes this

Quote

Post by watercooled on Dec 6, 2015 12:59:06 GMT

I've also found 'avoid port mapping' seems to be necessary for consoles to achieve 'open' NAT, and it seems to work for some PC games too, but of course there are still quite a few which are a complete mess with regard to networking and seem to fall apart without uPnP - even if you take the time to forward all of the port ranges they recommend, it still tends to not work properly. Plus it doesn't help matters that the 'tech support' people who make the port-forwarding guides don't understand the difference between firewalls and NAT and seem to include necessary outbound ports like 80 on their list of ports to forward to your PC. :facepalm:

/rant

Lee Sharp Administrator Posts: 522	DMZ Help Dec 6, 2015 16:03:48 GMT Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Lee Sharp on Dec 6, 2015 16:03:48 GMT What do you expect when you hire low bidder for support?

Post by jrronimo on Nov 26, 2015 6:45:24 GMT

Post by jrronimo on Nov 26, 2015 7:10:52 GMT

Post by Lee Sharp on Nov 26, 2015 20:43:00 GMT

Post by jrronimo on Nov 27, 2015 17:07:56 GMT

Post by Lee Sharp on Nov 27, 2015 18:24:11 GMT

Post by watercooled on Dec 6, 2015 12:59:06 GMT

Post by Lee Sharp on Dec 6, 2015 16:03:48 GMT

Quick Reply