Show Posts
1
General Discussion / Re: OpnSense breaking UDP hole punching
« on: May 06, 2023, 08:48:00 pm »
Hi,
late answer but I hope it helps someone. I just got the same problem as PassionLynx. I found that as default firewall randomizes the source port on passing packets out. On UDP it can break some apps. Typicaly some streaming or VOIP apps. The reason for this is security by obfuscating info about source port app allocation. But bidirectional UDP traffic needs this to keep the "punch hole" automatically open for bidirectional traffic.
I discovered how to solve this problem. You have two options:
1. If you want to keep NAT more secure, you can create a special Outbound NAT rule only for your app, usually it is enough to specify the destination port or server address and 'STATIC' parameter enabled.
2. You can replace the default NAT rule with a manually configured one with the same parameters as the default one with the difference in 'STATIC' parameter.
Before you are able to make this change you must switch to Manual or Hybrid outbound NAT rule generation
If you can not predict the destination or source address or port, you must use option 2. I think that security risk at this case increase is usually minimal.
late answer but I hope it helps someone. I just got the same problem as PassionLynx. I found that as default firewall randomizes the source port on passing packets out. On UDP it can break some apps. Typicaly some streaming or VOIP apps. The reason for this is security by obfuscating info about source port app allocation. But bidirectional UDP traffic needs this to keep the "punch hole" automatically open for bidirectional traffic.
I discovered how to solve this problem. You have two options:
1. If you want to keep NAT more secure, you can create a special Outbound NAT rule only for your app, usually it is enough to specify the destination port or server address and 'STATIC' parameter enabled.
2. You can replace the default NAT rule with a manually configured one with the same parameters as the default one with the difference in 'STATIC' parameter.
Before you are able to make this change you must switch to Manual or Hybrid outbound NAT rule generation
If you can not predict the destination or source address or port, you must use option 2. I think that security risk at this case increase is usually minimal.