Show Posts
1
General Discussion / Re: Several Questions - New User and brain pain.
« on: September 29, 2023, 03:25:40 pm »Strong NAT has to do with blocked ports, they can be accessed because the user allowed an app to run, but it's not visible by the outside so your latency/interaction with said program is slower than it should be.
It is like opening port 80 on a firewall.
I want to know if it's possible to allow access to a port without actually puncturing a hole in the firewall. If not, how do I do it safely?
And yeah, having a young kid wasn't in the cards, I will be changing diapers well past my 50th birthday now
The MS Xbox NAT page doesn't have an entry for Strong NAT. Are you sure it says Strong NAT or do you mean Strict NAT?
https://support.xbox.com/en-US/help/hardware-network/connect-network/xbox-one-nat-errorUnfortunately, I'm with CM. I don't use xbox and I'm usually the only one gaming. That said, I assume the warning you're getting is Strict NAT and not Strong NAT?
Have you made any changes to the defaults? I assume by static ips you mean static dhcp leases.
It looks like one of MS solutions is to do port forwarding for both systems and configure one to use custom ports. I dislike this as you then have open ports connected directly to machines on your lan. This is also why I dislike upnp. I have a friend that got hacked because they didn't realize their nas had open ports to the internet.
Are you able to see something besides Strict NAT if you just have the pc or xbox on after rebooting OPNSense?
I've made no changes as of yet, I am still working with a virgin system as it stands now, I am afraid to make a mistake and have my firewall scream to the world "I'm used by an idiot, abuse me!"
The troubleshooting process is definitely helped by you not randomly making changes in order to "fix" things.
That said, you didn't answer any of the other questions I asked. Since I don't think any of us have an xbox or multiple, we're having to debug by proxy and that requires a lot more information.
And no, if you open a port, the port is open to all. That's why it's not generally recommended and instead you let the firewall only pass through replies to your requests. upnp works by automatically opening ports without telling the user and that's why it's often recommended as a "fix" and why security conscious people recommend turning it off.
Like I said, excuse my mistakes, and lack of sleep... I got 3 hours today too.. lol.
And yes, Strict is what I meant to say. And all I am seeing is Strict NAT, nothing else... everything else works fine considering. I am able to play games, etc... but if the port as you called it allowed me to pass through without issues, I would be able to have flawless gameplay, right now my internet connection to the servers it reduced by 25 to 50% normal because of the way MS interacts with OPNSense....
AS you showed with the link (and I have seen it before) It says to "open" the ports, but as I said I don't want to do that, so how to do I set up OPNSense to allow the XBox and PC to (because they use the same ports) to allow throughput instead of punching a hole?
I really wish you could do all of this on one page instead of going to three different tabs (or seems like it) just to allow a piece of hardware to use the firewall correctly and visa versa.
I have a dozen pieces of hardware on the network, none require special treatment, they are all internal only... they don't play with the outside, so none of the hardware on my network gives me any errors or issues.
What questions specifically do you need me to answer, I only ask because I need you to be specific due to the fact I am new to this system and I may not know the answer... so I may not answer it because I honestly may not know I should have known...
Feel like Dick Cheney during the Gulf War... "We know there are bad guys, but we don't when, we don't know where, but they are there."
I know there are things going on, but I don't know squat on how to make it work... so I apologize if I don't answer clearly because, I honestly am new to OPNSense... and some of the things in it are not as intuitive as I wish it was.
