Day: January 6, 2009

It’s done. My Xbox 360 is now working properly via NAT talking through the Trashwall and using WOW! service.

After getting my previously mentioned pf problem on Trashwall sorted out I tested out the Xbox 360 to see if the network test for Xbox Live would pass. Guess what? It didn’t, continuing to insist that my NAT type is strict.

A bit more research (and information which seems to come from this post at Russ’s Blog) indicates that the Xbox Live uses the following classifications for NAT:

Strict: Symmetric NAT.
Moderate: Cone shaped NAT with port filtering or with UPnP turned off.
Open: Cone shaped NAT with no port filtering or with UPnP turned on.

Cone and symmetric NAT descriptions are formalized in RFC3489, and a bit more digging brought up this general how-to for using OpenBSD’s pf, indicating that the static-port directive on a NAT rule (described here in the POOL OPTIONS section of the pf.conf(5) man page) makes OpenBSD do cone-shaped NAT.

So, overall, what did it take to fix it? Well, it was actually three things:

· I switched to Wide Open West for data service, which gave me three IPs.
· While the whole house was NATted through one of the IPs, the Xbox 360 alone has been bidirectionally NATted through another.
·The magic static-port option on the NAT line for the Xbox 360.

Without a second IP I wouldn’t have been able to forward all ports inbound, which without a UPnP daemon (which didn’t go well before) would have resulted only a NAT setting of Moderate.

All of this has been documented in the updated version of the article on the Trashwall, my home’s a firewall / NAT device / switch / whatever built out of an unwanted PowerMac G4.

(In case you didn’t notice, this photo does a good job illustrating the wire in a aperture grill, such as the one here on an Sony KD-34XBR970 CRT HDTV. If you’d like to see the original without the no sign, here’s the small version and here it is at full res.)

4 Comments

UPDATED: This is fixed. See the bottom of the post.

With the move to Wide Open West for data service at home I now have up to three IPs available, all assigned via DHCP. In order to best use them and work around the Xbox Live problems I was having I wanted to do the following:

– Assign one IP to one interface, and NAT everything through it, like normal.
– Assign a second IP to a second interface, and use binat to have my Xbox 360 to basically have its own public connection. (Sort of like being in the DMZ on a Linksys box.)
– Leave the third IP alone for times when I want a non-firewalled connection.

While I have this set up, it doesn’t seem to be working. Here’s my current configuration. If anyone can tell me what I’m doing wrong or offer suggestions, please do so:

Leave a Comment