Setting my Router's NAT to open

MikeMan

Having recently purchased Reach, I've been playing on XBL more often lately. And whenever I go into matchmaking, Halo warns me that my NAT type is "moderate."

I've tried everything, literally everything, that I could think of. I have Time Warner Cable, and a Linksys/Cisco E1000 wireless router that is connected via wire to my 360.

Things I have tried:

Opening a DMZ. I used walkthroughs similar to this. Absolutely no luck.

Specific range port forwarding. Followed this guide for that. Nothing.

I'm just about ready to throw my router out a window in frustration. On top of that, I can't even play certain gametypes in Halo (for those of you in the know, Firefight and Campaign Co-op online) without severe input lag. Also, on sunday my voice chat stopped working. I don't know if all of these are related to the NAT (I hope they are) but it's making many aspects of my online experience unplayable.

Halp?

Spudge

NAT settings should be in the Router's administration page, under

Setup > Advanced Routing

Once you turn NAT off, it will automatically enable RIP. You should be good then. If it still gives you issues, turn off RIP and give your Xbox a static IP (I usually do this any way, makes life easier)

bowen

The DMZ should've fixed it completely. I'm suspicious of turning off NAT in your router if that'll fix anything. Port forwarding for a machine with DMZ enabled is redundant and might actually cause more problems depending on your specific router.

For instance: http://en.wikipedia.org/wiki/DMZ_%28computing%29#DMZ_host

Basically, DMZing a host is just like taking your internet connection and plugging it right into the unit. With the exception of other ports forwarded. So if you do that, then port forward 80 to a linux box, that linux box will be what's displayed when users hit 80 on your IP. Everything else goes right to the XBox in this case. In this case DMZing the XBox and then forwarding ports to the XBox may be an issue.

Do you have another router you can slip in and DMZ the XBox through that?

MikeMan

bowen wrote: »

The DMZ should've fixed it completely. I'm suspicious of turning off NAT in your router if that'll fix anything. Port forwarding for a machine with DMZ enabled is redundant and might actually cause more problems depending on your specific router.

For instance: http://en.wikipedia.org/wiki/DMZ_%28computing%29#DMZ_host

Basically, DMZing a host is just like taking your internet connection and plugging it right into the unit. With the exception of other ports forwarded. So if you do that, then port forward 80 to a linux box, that linux box will be what's displayed when users hit 80 on your IP. Everything else goes right to the XBox in this case. In this case DMZing the XBox and then forwarding ports to the XBox may be an issue.

Sorry, I forgot to mention that when I set up the DMZ (which is what I'm operating under now), I disabled port range forwarding.

Do you have another router you can slip in and DMZ the XBox through that?

Alas, no. Could it be there's some sort of hidden setting? I honestly don't know what the issue is.

When I hook my Xbox directly to my modem, the internet doesn't work at all. My friend said this is because I might need a crossover cable. Is this accurate?

Spudge

Doubtful. I can't think of any modems that require a crossover cable these days; most of them have auto-switching enabled

One thing about connecting directly to your modem though - some ISPs require MAC authenticating and since your Xbox has a different MAC than your router, the modem may not recognize it

MikeMan

Spudge wrote: »

NAT settings should be in the Router's administration page, under

Setup > Advanced Routing

Once you turn NAT off, it will automatically enable RIP. You should be good then. If it still gives you issues, turn off RIP and give your Xbox a static IP (I usually do this any way, makes life easier)

But if I turn off NAT entirely, won't the two other computers I have connected to the network be completely open and vulnerable?

NailbunnyPD

I'm pretty sure the 360 can take advantage of uPnP if that's an option on your router. With uPnP, the 360 will automatically grab the ports it needs when it boots up, so remove any port forwarding you may have already configured.

Also, it might be a good idea to power cycle the router after making these configuration changes, just to be sure that nothing is still lingering in the configuration.

MikeMan

NailbunnyPD wrote: »

I'm pretty sure the 360 can take advantage of uPnP if that's an option on your router. With uPnP, the 360 will automatically grab the ports it needs when it boots up, so remove any port forwarding you may have already configured.

Also, it might be a good idea to power cycle the router after making these configuration changes, just to be sure that nothing is still lingering in the configuration.

Already tried uPnP. No luck.

edit: Maybe I did it incorrectly. To be honest I'm a bit lost with all this jargon.

Spudge

MikeMan wrote: »

Spudge wrote: »

NAT settings should be in the Router's administration page, under

Setup > Advanced Routing

Once you turn NAT off, it will automatically enable RIP. You should be good then. If it still gives you issues, turn off RIP and give your Xbox a static IP (I usually do this any way, makes life easier)

But if I turn off NAT entirely, won't the two other computers I have connected to the network be completely open and vulnerable?

That's purely subjective. I never run NAT (for the Xbox reason) and have never had a single virus on any of my machines

Keeping things like an updated antivirus, anti-malware and solid firewall installed on the computers can keep attacks to a minimum. NAT is just an added layer of protection; a lot of people run without NAT (whether they know it or not) and have little to no problem

bowen

Conversely, I have never had a problem with NAT for things like PS3/Xbox/games with proper port forwarding.

You wouldn't happen to have a DLink would you mike?

Gear Girl

Which ports did you forward? That guide seems to recommend 88 and 3074 but I also had to forward 80 and 53.

Sipex

I'm in this camp too, except mine is closed (can't get it to moderate or open). I use a DLink though (joy) but I'll try the suggestions listed here.

BoomShake

Just to throw my hat in the ring and echo some advice.
I've got an Xbox360 working fine. I'm using a Linksys WRT54GL with Tomato v 1.27.
Static internal IP for the 360, with ports 88 UDP and 3074 UDP/TCP forwarded.

The only time I've ever had a problem with it saying my 360 was moderate or strict was when I was at school. Their extra layers of networking above mine really screwed all sorts of things up.

Feral

BoomShake wrote: »

The only time I've ever had a problem with it saying my 360 was moderate or strict was when I was at school. Their extra layers of networking above mine really screwed all sorts of things up.

We should also verify that this is not the case with Time Warner Cable. Some cable "modems" are actually routers that run a layer of NAT on their own.

MikeMan, can you tell us the subnet of your Linksys router's WAN IP? Open up the configuration page, and look under Status and you'll find the WAN IP address.

Don't post the whole thing. It'll be in a form like this:

67.119.212.72

Post the first three numbers, like this:

67.119.212.0

bowen

I never even thought of that Feral.

MikeMan

Feral wrote: »

BoomShake wrote: »

The only time I've ever had a problem with it saying my 360 was moderate or strict was when I was at school. Their extra layers of networking above mine really screwed all sorts of things up.

We should also verify that this is not the case with Time Warner Cable. Some cable "modems" are actually routers that run a layer of NAT on their own.

MikeMan, can you tell us the subnet of your Linksys router's WAN IP? Open up the configuration page, and look under Status and you'll find the WAN IP address.

Don't post the whole thing. It'll be in a form like this:

67.119.212.72

Post the first three numbers, like this:

67.119.212.0

When I go into "Status" I see the following:

Connection Type: Automatic Configuration - DHCP
Internet IP Address:
Subnet Mask:
Default Gateway:
DNS1:
DNS2:
DNS3:
MTU:

But no WAN. Ditto for the other subheadings under Status. Is there something I'm missing?

BoomShake

It's the Internet IP Address.

MikeMan

Ah, thanks.

In that case the first three parts of it are 75.189.205.0

bowen

Hmmm, that's quite peculiar indeed. You restarted your xbox after changing the DMZ settings right?

MikeMan

bowen wrote: »

Hmmm, that's quite peculiar indeed. You restarted your xbox after changing the DMZ settings right?

Yes.

MikeMan

Okay, after trying out Spudge's advice and turning off NAT entirely, the internet completely cuts out and stops working. I save changes on the router setup, then unplug the router, wait a minute, plug it back in, and nothing.

The internet comes back when I enable NAT again.

3drage

Without natting your other machines would need to have individual public (routable) IP addresses. Xbox Live should run with NAT enabled and port forwarding to the correct IP of the machine (in this case x-box). Now if you are running DHCP for your non-routable IPs depending on your lease settings, the Xbox could be grabbing different IP addresses each time it boots up, thus negating static port forwarding.

Disabling NAT isn't an option unless you have multiple public IPs through your router.

MikeMan

3drage wrote: »

Now if you are running DHCP for your non-routable IPs depending on your lease settings, the Xbox could be grabbing different IP addresses each time it boots up, thus negating static port forwarding.

As someone who really doesn't understand this stuff, how would I go about finding out if this is the case?

3drage

MikeMan wrote: »

But if I turn off NAT entirely, won't the two other computers I have connected to the network be completely open and vulnerable?

Your other two computers will cease to route to the Internet.

NAT stands for Network Address Translation and it is a method to conserve public IP addressing. The talk of security is insignificant to the actual function NAT. Security comes in to play because it prevents outside sources from enumerating internal (private) IP space. NAT basically works like this:

One of your machines with a non-routable private IP requests something from the Internet. This request passes through your router as the gateway, and your router relays the request under the single public routable IP address that you have leased from your ISP. The outside server responds, and your router then forwards the information to your internal machine over a high random port designated for internal communication.

Port forwarding allows certain ports to be sent to specific internal non-routable IP addresses as if they were the public IP. You just need to figure out which ports Live supports and forward those to your x-box. Also I would recommend setting up a static IP for your x-box and reserve that IP from your DHCP list, as when you specify port forwarding, it goes to a single IP inside your network.

3drage

MikeMan wrote: »

3drage wrote: »

Now if you are running DHCP for your non-routable IPs depending on your lease settings, the Xbox could be grabbing different IP addresses each time it boots up, thus negating static port forwarding.

As someone who really doesn't understand this stuff, how would I go about finding out if this is the case?

Generally most home routers are the same....they'll have a WAN tab and a LAN tab in the configuration page.

Open up your LAN tab (Local area network) and see if there are any DHCP options, by default these are usually set to On/Yes/Aye/Hell yeah! DHCP is basically a service that gives your computers automatic internal IP addresses so they can communicate with each other as if they are a happy family.

The problem is that the DHCP passes out IPs in a list and can be random after each machine boot-up...technically you get a lease for an IP of each machine, that lasts anywhere from 30 minutes to a month. The problem is that when you set up port forwarding to a specific internal machine, once that lease is up your machine can get a different IP address and your port forwarding goes kaput.

Fortunately they thought of this problem and allow you personally to reserve IP addresses for specific machines. This means that you can reserve one IP...say 10.0.0.5/24 (make sure you follow your router's default IP scheme though...sometimes it's 192.168.0.xx), then you manually configure this IP for your system (through X-box control panel), and then your x-box will never change IP addresses. Then you can do all the port forwarding for the specific IP and it will then never break.

Don't disable NAT, it'll mess you up.

bowen

MikeMan wrote: »

3drage wrote: »

Now if you are running DHCP for your non-routable IPs depending on your lease settings, the Xbox could be grabbing different IP addresses each time it boots up, thus negating static port forwarding.

As someone who really doesn't understand this stuff, how would I go about finding out if this is the case?

Go into your xbox and set up a manual/static ip. Then, put that as the DMZ. That should fix it.

3drage

Warning: Putting a system in DMZ will make it vulnerable to external threats.

bowen

3drage wrote: »

Warning: Putting a system in DMZ will make it vulnerable to external threats.

Of course, but once it works it's as simple as finding all the ports it needs and go back to the forwarding. Once it's static troubleshooting is easy.

3drage

bowen wrote: »

3drage wrote: »

Warning: Putting a system in DMZ will make it vulnerable to external threats.

Of course, but once it works it's as simple as finding all the ports it needs and go back to the forwarding. Once it's static troubleshooting is easy.

Xbox LIVE requires the following ports to be open:
• TCP 80
• UDP 88
• UDP 3074
• TCP 3074
• UDP 53
• TCP 53

As a security professional I would never recommend anyone troubleshooting by enabling all ports open on a system. Static IP, Port forwarding, then further troubleshooting is the most secure way to stand up a system on a network.

Sipex

This is kind of why I never got around to it, every time I actually understand pieces of what I'm supposed to do I find scary security risks littering the thing.

You know, my halo matchmaking isn't that bad.

3drage

Yeah it can be a pain for people who don't do this stuff all the time and unfortunately there are easy fixes like just throwing your system out in the open and pray a worm or attacker doesn't find you interesting. But learning how to do it correctly is worth the effort in both functionality and for your peace of mind.

I do wish they made routing instructions easier for regular people to understand.

bowen

Again, like I said, it's okay to troubleshoot information. None of us run FBI databases that are the target of an attack for the 5 minutes it's in DMZ mode. I'd imagine the XBox employs some sort of firewall that would prevent someone from buffer overflowing it as soon as it's on the interwebs. It's a wise, but unfounded, security claim.

Once we figure out if it's the ports/dmz, static ip, or the router, we can advise him from there. Configuring ports is a bit more tricky than DMZ because some routers even have an access list on top of the port forwarding. (I'M FUCKING LOOKING AT YOU DLINK)

3drage

http://news.cnet.com/2100-7349_3-5313402.html

I'd venture that these days it takes less than 5 minutes with all the worms/malware going around.

When it comes to taking security seriously, doing things the proper way is far from unfounded. Putting it out on the DMZ is going to allow it to work, there's nothing to troubleshoot. Figuring out how to configure the system properly is the actual problem.

MikeMan

Wow, thanks for all the responses.

Since directly trying to set up a dmz didn't work at all, I'm going to try your suggestions 3drage. I'll let you know tonight if they work.

Thanks again!

bowen

Meh an Xbox is the complete opposite spectrum from some guy with an unpatched Win98 machine sitting on his FIOS DMZed.

Which are surprisingly common. But yes I'd imagine better safe than sorry if he gets it.

3drage

This may be a dumb question, but did you try running through the following?

http://support.microsoft.com/kb/979000/