Trying to get open NAT again on XBOX

[uuscotty]

I am seriously struggling with getting open NAT on my Xbox One X console and I have a feeling I have been staring at it so long that I am missing something super simple that I just can’t see and was hoping some more eyes on my issue and configuration might help lead me to a solution.

I have looked at and followed several threads on this topic, but just can’t seem to get it to work correctly:
https://forum.opnsense.org/index.php?topic=14276.0
https://forum.opnsense.org/index.php?topic=19970.0
https://forum.opnsense.org/index.php?topic=6269.0 (this one was a feisty conversation)
https://niallbest.com/achieve-full-open-nat-with-port-forwarding-for-xbox-live-via-opnsense/
https://ultramookie.com/2020/05/opnsense-xbox-live/

I had this working previously at our old place and even had it working with two xbox consoles when we were on T-Mobile 4G Internet.  Opnsense box got destroyed in the move, so had to rebuild on new hardware after we moved into the new house with Century Link Fiber.  Kids have moved out, so only my xbox now, which I thought would make things much more simple, but still no luck.  It has now been several months since we moved in and I finally have some time for a little gaming, so wanted to get this working again.

Another weird thing I noticed is I don’t see any logs at all to or from the xbox console when running the NAT tests, speed tests and Internet connectivity tests on the xbox.  This is despite the fact that I have enabled logging on the WAN firewall rule, the port forward rule and the outbound NAT rule on Opnsense.  Was really hoping to see something here to help me diagnose the problem.

Here is what I have done so far:

I am using port 55858 as alternate port on xbox (because of having more than one xbox in the household, previously)

Statically mapped a DHCP address to the xbox on my IOT VLAN with 192.168.100.6.  And I am using Ethernet rather than wireless, as I do with everything that involves streaming (benefits of a newly built house with CAT 6 installed everywhere)

Created a host alias for the Xbox (HOSTS_DAD_XBOXONE/192.168.100.6)

Created a port alias for the xbox (PORTS_DAD_XBOX/55858)

Created a manual outbound NAT rule with the following:
Interface:  CENTURYLINK_WAN
TCP/IP Version:  IPv4
Protocol:  TCP/UDP
Source address:  HOSTS_DAD_XBOXONE
Source port:  PORTS_DAD_XBOX
Destination address:  any
Destination port:  any
Translation/target:  CENTURYLINK_WAN address
Log:  CHECKED
Translation/port:  EMPTY
Static Port:  CHECKED

Created port forward rule:
Interface:  CENTURYLINK_WAN
TCP/IP version:  IPv4
Protocol:  TCP/UDP
Destination:  CENTURYLINK_WAN address
Destination port range:  from PORTS_DAD_XBOX to PORTS_DAD_XBOX
Redirect target IP:  HOSTS_DAD_XBOXONE
Redirect target port:  PORTS_DAD_XBOX
Log:  CHECKED
NAT Reflection:  Enable

I used automatic rule creation when I built the port forward and this is the resulting WAN rule:
Protocol:  IPv4 TCP/UDP
Source:  Any
Port: Any
Destination:  HOSTS_DAD_XBOXONE
Port:   PORTS_DAD_XBOX
Gateway:  Any
Schedule:  Any

I have multiple VLANs for various purposes such as management traffic, guests, IOT, encrypted VPN tunnel traffic and non encrypted traffic.  My xbox lives on the IOT VLAN and I allow anything not destined for a local subnet/VLAN to pass to the Centurlylink WAN.

The following sits before my default block rules in the IOT_VL100 ruleset:
Action:  pass
Interface:  IOT_VL100
Direction:  in
TCP/IP version: IPv4
Protocol:  TCP/UDP
Source:  IOT_VL100 Net
Destination invert:  CHECKED
Destination:   Local_Subnets
Destination port range:  from any to any
Gateway:  CENTURYLINK_WAN_PPOE
 
I have also attached some screenshots for reference.

Hopefully I have provided sufficient information and something stands out to the more experienced and knowledgeable.  Appreciate any help anyone can give.

[alexdelprete]

I spent 2 days on the same issue. In the end I had to go the UPNP way to make it work, even if I don't like UPNP.

The positive thing is that I incidentally found out that UPNP offers traffic statistics: my home automation software automatically discovered the UPNP instance on OPNsense and now I have traffic stats without doing any kind of integration.

So I decided to leave it that way.