OpenWrt + Xbox Live always a moderate NAT

After struggeling for so long I finally figured out the problem.

@mindwolf is right! You indeed don't have to open any ports below 1024.
After some short testing I also figured out that you don't even have to open udp ports 3544 (teredo) and 4500 (IPSec).

However to be extra safe I still opened all the listed ports mentioned in the link below.
https://support.xbox.com/en-US/xbox-one/networking/network-ports-used-xbox-live

Since I had already done this before, with my xbox still showing me a moderate NAT, there had to be something else.
At "Network Settings" --> "Advanced settings" my xbox is telling me the port in use, which was for whatever reason not the default 3074.
Instead it was using an alternate port automatically. This feature is actually intended for people owning multiple xbox consoles that they would like to have an open NAT or if you need the port 3074 for something else.
I have no clue why my xbox is selecting an alternate port, but so be it. Maybe OpenWrt is using this port for something?

Anyway the solution is quite simple.
After opening the alternate port displayed, the xbox was still showing me a moderate NAT.
After opening all the alternate ports the settings would let you choose from, it was giving me an open NAT all the time!!!
I can restart my console, router, .... and my xbox now has an open NAT without needing to run any NAT tests on it.

In case anyone needs it, this is the firewall config which achieved me an open NAT.

firewall config
config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp'
	option src_dport '80'
	option dest_ip '192.168.1.31'
	option dest_port '80'
	option name 'XBL_000_TCP-80'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'udp'
	option src_dport '88'
	option dest_ip '192.168.1.31'
	option dest_port '88'
	option name 'XBL_001_UDP-88'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'udp'
	option src_dport '500'
	option dest_ip '192.168.1.31'
	option dest_port '500'
	option name 'XBL_002_UDP-500'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'udp'
	option src_dport '3544'
	option dest_ip '192.168.1.31'
	option dest_port '3544'
	option name 'XBL_003_UDP-3544'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'udp'
	option src_dport '4500'
	option dest_ip '192.168.1.31'
	option dest_port '4500'
	option name 'XBL_004_UDP-4500'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '53'
	option dest_ip '192.168.1.31'
	option dest_port '53'
	option name 'XBL_005_TCP+UDP-53'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '3074'
	option dest_ip '192.168.1.31'
	option dest_port '3074'
	option name 'XBL_006_TCP+UDP-3074'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '52635'
	option dest_ip '192.168.1.31'
	option dest_port '52635'
	option name 'XBL_007_TCP+UDP-52635'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '53044'
	option dest_ip '192.168.1.31'
	option dest_port '53044'
	option name 'XBL_008_TCP+UDP-53044'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '53453'
	option dest_ip '192.168.1.31'
	option dest_port '53453'
	option name 'XBL_009_TCP+UDP-53453'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '53862'
	option dest_ip '192.168.1.31'
	option dest_port '53862'
	option name 'XBL_010_TCP+UDP-53862'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '54271'
	option dest_ip '192.168.1.31'
	option dest_port '54271'
	option name 'XBL_011_TCP+UDP-54271'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '54680'
	option dest_ip '192.168.1.31'
	option dest_port '54680'
	option name 'XBL_012_TCP+UDP-54680'

Again, you probably don't need to forward any ports tcp+udp apart from 3074 and the alternate ports (52635 53044 53453 53862 54271 54680) to get an open NAT.
I still did it, but it also worked without all the others listed by microsoft.

1 Like