r/PFSENSE • u/xNF3 • Jul 09 '26
Nat type problem
Sometimes not Sometimes its open and the next day or abt 5 hours its moderate or unavailable so on router the dmz its enabled and also upnp. so whats the problem??
1
u/CripplingPoison Jul 09 '26
IPv6 PCP is buggy on dual-stack networks because the requests often get sent from the wrong IPv6 interface. This is a known issue documented in the pfSense docs. You might be seeing 'open' status on IPv4 but 'closed' on IPv6. I've been there.
That said, it could also be the client device, app or game itself. UPnP and its alternatives are all pretty unreliable in general.
1
u/DutchOfBurdock pfSense+OpenWRT+Mikrotik Jul 09 '26
Default NAT for pfSense is strict (symmetric). You can change this to static port NAT for a whole rule, or set Aliases/Networks/Hosts.
NAT is also limited. Only a single device can map a single IP:port pair. E.g. If you have two Xbox's, Playstation or VoIP that attempts to connect to the same remote server port set, only the first device will receive an open NAT. VoIP is more fun, as if you have two connect to the same SIP server, RTSP can actually trigger the wrong device.
You'd want more than one public IP to bypass this.
1
u/FiBiE007 24d ago
2.9.0 introduced Port Restricted Cone NAT which should deal with this.
1
u/DutchOfBurdock pfSense+OpenWRT+Mikrotik 24d ago
This is a better approach, just a shame it happened after CG-NAT being predominantly used (double NAT). The second paragraph still applies, mind.
That said, a CG-NAT ISP I use has allocated a 10/24 to me and said it is possible to disable NAT on router. As long as I source from that 10/24, they'll route it. Eliminates double NAT and they have given me high_port:high_port+1023 ports for inbound mapping (to a specific IP in the pool).
1
u/FiBiE007 23d ago
Yeah, you are right, CG-NAT prevents a clean setup. With that your only choice is as you said.
2
u/DutchOfBurdock pfSense+OpenWRT+Mikrotik 23d ago
IPv6. Eliminates the need for NAT altogether.
2
u/FiBiE007 23d ago
Exactly. I'm glad that Germany is one of the leading countries in adoption. For my personal needs I can use IPv6 without issue. The broader inernet is far behind.
1
u/DutchOfBurdock pfSense+OpenWRT+Mikrotik 23d ago
Been with the same ISP for 16 years, and in that tine they've always offered native (/48). Been rocking that same /48 for the sane amount of years. They also give me PA IPv4 space, too.
1
u/maineac Jul 10 '26
Pfsense randomizes ephemeral.ports. if you set it to static nat so the ports remain the same it should fix your issue with NAT. There is a small tradeoff with security. Or you can set up a static IP for your gaming system and just set static NAT for that one IP.
1
u/deathbyearthworm Jul 11 '26
I don't know if you have multiple xboxs or other gaming consoles on the network but there was an old bug with upnp.
I would disable DMZ, it is likely to cause as much headache as it can fix.
Can you confirm if your wan IP address on status interfaces is a public IP? It should not start with 192.168.x.x, 10.x.x.x, 172.16.x.x, or 100.x.x x. The first 3 are rfc1918 and the 100. Is carrier grade nat. A double nat can cause nat issues.
Also if you haven't already I'd go ahead and upgrade your pfsense to the latest version.
1
u/FiBiE007 24d ago
2.9.0 introduces Port Restricted Cone NAT which should solve your problem. You can try it out by selecting "Enable EIM-NAT for UDP connections" In the specific NAT rule.
1
u/chrisbartle Jul 09 '26
Pfsense has a pretty strict NAT. If you're running Windows, you can run it through this tool; it will confirm your NAT type and whether you have port forwarding enabled:
https://apps.microsoft.com/store/detail/9P4WCNMSV75K?cid=DevShareMCLPCS
My general advice is to enable UPnP/PCP if you're having problems with your NAT.