pfSense Gold Subscription

Author Topic: Nintendo Switch - Needs static port on its outbound NAT  (Read 2793 times)

0 Members and 1 Guest are viewing this topic.

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 20158
  • Karma: +1200/-8
    • View Profile
Nintendo Switch - Needs static port on its outbound NAT
« on: March 06, 2017, 08:46:41 pm »
At least with the one online multiplayer game I have used so far (Fast RMX) the only requirement for Nintendo Switch online multiplayer is static port outbound NAT. It did not appear to require UPnP, but it's safer to enable that in case another game needs it later.

So as with the Wii U, 3DS, and other similar consoles the best course of action is:

1. Set a static IP address for the device via DHCP static mappings
- Status > DHCP Leases, find the device, click + to add a mapping, set a static address, save, etc.

2. Switch to Hybrid Outbound NAT
- Firewall > NAT, Outbound tab
- Select Hybrid Outbound NAT, Save

3. Add Outbound NAT rule
- Firewall > NAT, Outbound tab
- Click +
- Set the console address as the source (Type = Network, then enter the IP address, pick /32 for the CIDR)
- Check Static Port
- Save/Apply

4. (Optional, So far) Enable UPnP & NAT-PMP
- Enable UPnP & NAT-PMP
- Allow UPnP Port Mapping
- Pick External (WAN) and Internal Interfaces (LAN)
- Set other options as desired
- Save

EDIT: My son is using the Splatoon pre-release global test fire and the online multiplayer is working fine, still only using static port outbound NAT. No UPnP.
« Last Edit: March 24, 2017, 03:16:07 pm by jimp »
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline iloveramen

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #1 on: March 08, 2017, 11:19:18 am »
Thank you jimp.  This is a great reminder and advice for everyone on the forum.

Offline Alex Atkin UK

  • Jr. Member
  • **
  • Posts: 31
  • Karma: +0/-0
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #2 on: March 24, 2017, 03:07:55 pm »
Are you sure about this?

I just tried and you can't set the console IP as the source as the only options are Network, Any or This  Firewall.

 think you may have applied Static Port to the whole LAN not the Switch specifically, in which case you do not need a new rule, just modify the existing one.

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 20158
  • Karma: +1200/-8
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #3 on: March 24, 2017, 03:15:17 pm »
Nope, just the switch. Use network and /32 for a single host on the outbound NAT source.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline sirjorj

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #4 on: March 24, 2017, 03:20:34 pm »
Thanks for this!  I just spent the hour trying to get the Splatoon 2 test fire working and for all I know, the entire event was to show off their new "Unable to connect" screen (I have a screenshot if you want to see it - it is very pretty!)

I had UPNP enabled for the right addresses and it did nothing.  I then unchecked the 'deny access by default' option and it still did nothing.  If that didn't help, what good is UPNP anyway?  Or is this just Nintendo writing bad network code?

Anyway, thanks again!

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 20158
  • Karma: +1200/-8
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #5 on: March 24, 2017, 03:40:42 pm »
Well UPnP is for inbound connections, outbound NAT is for outbound. Apparently the way their multiplayer code works, it needs to send back to the console on a particular port, which needs to be static so it's the same in both directions. Not sure why game servers can't just send back to the port it came from, but who knows...

So UPnP does nothing for that kind of setup. Just setup the static port outbound NAT as I laid out above and it should be fine.

At least there are two more days of test fires so keep trying. There are times tomorrow and Sunday. And even one more tonight. See attached (times in EDT)

Edit: Not my pic. Shamelessly lifted from Reddit.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline Alex Atkin UK

  • Jr. Member
  • **
  • Posts: 31
  • Karma: +0/-0
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #6 on: March 24, 2017, 06:03:57 pm »
Still annoying that Nintendo did it this way.

For a portable device that most likely will get used a fair bit on public networks that you CAN'T specify their outbound NAT settings, it seems like a very poor design indeed.

Thanks for reminding me about the /32, it was only hours later I realised my mistake.  Its just been one of those days.
« Last Edit: March 24, 2017, 06:08:27 pm by Alex Atkin UK »

Offline Yockanookany

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #7 on: March 24, 2017, 11:03:09 pm »
I made a thread dealing with these issues (https://forum.pfsense.org/index.php?reportsent;topic=127837.msg705258#msg705258) and followed your directions which were already mostly done besides hybrid NAT. I had no luck with those changes sadly and it's the end of the testfire so I'm unable to test further for now.

Offline sirjorj

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #8 on: March 26, 2017, 06:15:25 pm »
Just to confirm, making those changes did make it work for me.
Thanks again.

sirjorj

Offline carlosgarciars

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
    • Tarifas mas movil
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #9 on: April 05, 2017, 07:06:56 am »
Good advice jimp! I will purchase it this weekend

Offline j.koopmann

  • Jr. Member
  • **
  • Posts: 43
  • Karma: +9/-0
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #10 on: April 08, 2017, 04:26:34 pm »
This worked for me like a charm for months. Yesterday I received a second DSL and setup a multi-wan. Got the usual error again. So I added the static NAT for the second WAN line as well and to ne safe added a firewall rule so that the console only uses the original first WAN.

Now sometimes it works and sometimes it does not. In the states diag I only see the first DSL being used. I am puzzled by this.

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 20158
  • Karma: +1200/-8
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #11 on: April 10, 2017, 09:15:41 am »
If your Multi-WAN setup is using Load Balancing, you might need to force the switch to a failover group instead so it is not balanced. It might be sending some traffic out WAN1, other traffic out WAN2, and since the far side sees different addresses it may be cutting that off.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline j.koopmann

  • Jr. Member
  • **
  • Posts: 43
  • Karma: +9/-0
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #12 on: April 10, 2017, 01:36:18 pm »
Already did that... Quote: "added a firewall rule so that the console only uses the original first WAN. "

One day later everything seems to be fine. Maybe some missing old states.... Will monitor it...

Offline behemyth

  • Newbie
  • *
  • Posts: 24
  • Karma: +2/-0
    • View Profile
Re: Nintendo Switch - Needs static port on its outbound NAT
« Reply #13 on: April 12, 2017, 01:34:56 pm »
These kind of posts are why I love this platform. I've never seen a platform where the actual people working on it post informational things like this for everyone to use.

Major kudos to the Pfsense team.