Xbox One: How I got open NAT without UPnP

[JdeFalconr]

I hope this post helps someone else out there having trouble achieving open NAT; I know it can be a bear for some people and it's a potentially frustrating technical issue for many users.

This is with both an XB1 console as well as the Xbox Console Companion app on my PC running. If you don't care about the Xbox Console Companion then you can omit those portions of the setup (personal computer alias, forwarding and firewall rules for TCP/UDP 60200). I didn't want to use upnp due to the security risks it poses (letting any LAN client open inbound ports automatically). I get that I'm effectively doing the same thing here but the difference is this approach limits the scope to just the Xbox and to specific ports. I did a bit of Google searching so some of the below suggestions (like the NAT reflection and the outbound NAT rule) were from what I found there. The rest was just following guides on port forwarding and the necessary ports to open. My selection of ports is based on https://www.bungie.net/en/Help/Troubleshoot?oid=13610#PortForwarding. Really when thinking about this what I mostly did was manually set up what upnp does automatically. I did note that when adding/changing just about any of the above rules I had to reset firewall states for the change to fully take effect (Firewall/Diagnostics/States Reset/check both boxes). I've attached screenshots of some of the relevant rules on my box for your own reference.

Here's what I did:

1. Aliases
XboxOneXPortForwardTCP: port 3074
XboxOneXPortForwardUDP: ports 88,500,3074,3544,4500,1200
XBoxOneX_Ports_TCP: ports 53,80,3074,7500:7509,30000:30009,443
XBoxOneX_Ports_UDP: ports 53,88,500,1001,3074,3544,4500,1200:1299
XboxOneX_IP: <private IP for my XB1X>
Manetheren: <private IP for my computer running Xbox Console Companion; sub it for yours>
TeredoPortForwardingGroup: port 60200

2. Port Forwarding Rules
I created a few port forwarding rules (see attached image) for the necessary TCP and UDP ports. Not mentioned on the Bungie Support page I linked above were those Teredo ports (TCP and UDP 60200) used by the Xbox Console Companion app. Important here was to ensure that NAT Reflection was enabled for those forwarding rules; that's an option in the NAT rule settings. I also chose the option to automatically create associated firewall rules for the forwarding rules.

3. Firewall Rules
I created rules (see attached image) to open all XB1X TCP and UDP ports for the XB1X IP address only. The rest of the necessary rules were auto-created.

4. Outbound NAT Rule
An outbound NAT rule (see attached image) was required for the XB1X. The key setting there is to check the "Static Port" box.


What you have to do to get this working for you:
--You must assign a static IP address to your Xbox One and if you want to use Xbox Console Companion a static IP to your PC. I chose to do that with DHCP reservations.
--Substitute the alias IP addresses "Manetheren" and "XboxOneX_IP" above for the respective IPs of your devices.
--Set up the above things. As a reminder you will not need to create WAN firewall rules for any of the port forwarding rules that are set to auto-create associated firewall rules.

[emmalone]

Perfect.  Thank you.