Weblog

Documentation in this area is hard to find. Needless to say, I've spent a few hours on this. Your blog was most useful, and I thought sharing this here might help others in the community.

This is what I did, and use, for my Open NAT X-Box LIVE connection. For reference

I use Solaris Nevada (snv_94) as my ipfilter box. Though, the same configuration(s) should work on Solaris 10.

1) While I went back and forth, the manual ip configuration is easier (set via the 'System -> Network Settings' blade on the X-Box 360 console).
2) The Xbox manual ip is 192.168.0.5
3) The LAN netmask is 255.255.255.0
4) The LAN gateway is 192.168.0.1 (Solaris w/ipfilter)
5) The Solaris ipfilter (skge0) nic is 192.168.0.1
6) The Solaris ISP/dhcp (nge0) nic is 192.168.1.97 (assigned by cable/dsl modem)
7) The Solaris ISP/PPPoE (sppp0) nic is 1.2.3.4 (assigned by ISP)
8) Use the following /etc/ipf/ipnat.conf

--ipnat.conf--
# Per Microsoft, the xbox requires ports 88/udp, 3074/udp, & 3074/tcp open
rdr sppp0 0/0 port 88 -> 192.168.0.5 port 88 udp
rdr sppp0 0/0 port 3074 -> 192.168.0.5 port 3074 udp
rdr sppp0 0/0 port 3074 -> 192.168.0.5 port 3074 tcp

# But, the xbox doesn't like portmap auto, so explictly set it off (first)
map sppp0 192.168.0.5/32 -> 0.0.0.0/32 tcp/udp

# Add these (very popular [moderate NAT] settings), so everything else on the LAN can still use the same gateway (192.168.0.1)
map sppp0 192.168.0.0/24 -> 0.0.0.0/32 proxy port ftp ftp/tcp
map sppp0 192.168.0.0/24 -> 0.0.0.0/32 portmap tcp/udp auto
map sppp0 192.168.0.0/24 -> 0.0.0.0/32
--ipnat.conf--

9) If you don't use ipf, or have 'pass in quick' configured, then the following line isn't required.

--ipf.conf--
pass in quick from any to 192.168.0.5 keep state keep frags
--ipf.conf

10) Enable pre-requisite services

svcadm enable network/ipfilter

11) Here's what the output looks like to ipnat, after running "Test Xbox LIVE Connection"

# ipnat -hl | grep -v 192\.168\.0\.12
--out--
List of active MAP/Redirect filters:
0 rdr sppp0 0.0.0.0/0 port 88 -> 192.168.0.5 port 88 udp
0 rdr sppp0 0.0.0.0/0 port 3074 -> 192.168.0.5 port 3074 tcp
2 rdr sppp0 0.0.0.0/0 port 3074 -> 192.168.0.5 port 3074 udp
11 map sppp0 192.168.0.5/32 -> 0.0.0.0/32 tcp/udp
0 map sppp0 192.168.0.0/24 -> 0.0.0.0/32 proxy port ftp ftp/tcp
50 map sppp0 192.168.0.0/24 -> 0.0.0.0/32 portmap tcp/udp auto
0 map sppp0 192.168.0.0/24 -> 0.0.0.0/32

List of active sessions:
RDR 192.168.0.5 3074 <- -> 1.2.3.4 3074 [65.59.234.162 39370]
MAP 192.168.0.5 3074 <- -> 1.2.3.4 3074 [65.59.234.162 3074]
MAP 192.168.0.5 3074 <- -> 1.2.3.4 3074 [65.59.234.161 3074]
MAP 192.168.0.5 1257 <- -> 1.2.3.4 1257 [65.59.234.163 88]
MAP 192.168.0.5 1259 <- -> 1.2.3.4 1259 [8.6.176.15 3074]
MAP 192.168.0.5 1258 <- -> 1.2.3.4 1258 [8.6.176.15 3074]

--out--

11) Finally, I'd read somewhere that you may have to turn off hardware checksums on some NICs (or was it for Solaris 10?). Though I did not
have to do it, You may have to add this in /etc/system:

set ip:dohwcksum=0

Posted by Joseph Tingiris on September 17, 2008 at 07:00 PM PDT #