12 ms·
How to Set Up a Router's Port Forwarding for a Nintendo Switch Console
- rehamelbasha 5y agoAs a network engineer, this made me audibly sigh. Solid advice, redirect all incoming UDP traffic to your Switch, and your Switch alone...
- siva7 5y agoCan you explain the consequences to the plebs? :)
- iqanq 5y agoNone. Unwanted traffic will simply be discarded.
- toyg 5y agoFrom the little I understand of networking, this might mean that other machines on the network will never get that traffic (unless the Switch routes it and those machines use it as gateway, which is unlikely).
- cube00 5y agoI think we can safely assume something that needs 20k odd ports forwarded to it won't be doing anything like re-routing and acting as a secondary gateway on the network. It doesn't strike me that a lot of thought went into how a Switch would be used behind a firewall during the design if you need that many ports.
- aspenmayer 5y agoSwitch wants all the common ports, and then some. If this is requested via UPnP/NAT-PMP via the router, other services which rely on those ports may be negatively impacted if they are not designed to allocate ports outside this range. Switch is requesting ALL of the ports, which is going to make the above a bit difficult, to say the least. https://www.reddit.com/r/NintendoSwitch/comments/agv6hw/fixing_nat_for_a_nintendo_switch_using_upnp_w/ https://www.reddit.com/r/NintendoSwitch/comments/agv6hw/fixi... https://docs.netgate.com/pfsense/en/latest/services/upnp.html https://docs.netgate.com/pfsense/en/latest/services/upnp.htm... https://www.sciencedirect.com/topics/computer-science/registered-port https://www.sciencedirect.com/topics/computer-science/regist...
- chrismorgan 5y agoAbsolutely nothing else on the network will be able to receive anything over UDP. To begin with, this completely breaks DNS, though maybe if your devices use the router as the DNS server and it does the recursion it’ll be OK. Next, just about all real-time communications uses UDP, so your Skype, Zoom, &c. are all broken. And it just goes on. Some, like HTTP/3, will happily fall back to TCP when they observe it’s broken (HTTP/3 will fall back to HTTP/1 or HTTP/2), but various things will just be broken. Take a look at everything in https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml https://www.iana.org/assignments/service-names-port-numbers/... that uses UDP. This will break just about all of it. And even if you didn’t need any of those things: what if you want to have two Switches on your network? This is just mind-bogglingly stupid advice.
- iqanq 5y agoThis does not break DNS, HTTP/3, whatever. It does not affect outgoing connections at all, only incoming connections from the WAN to your router.
- mulmen 5y agoI'd tell you the joke about UDP but you might not get it.
- leokennis 5y agoOr that joke about TCP: 1: Do you want to hear a joke about TCP? 2: Yes I do want to hear it. 1: I confirm you want to hear it. 1: I am now going to tell the joke. 2: I acknowledge you are now going to tell the joke. 1: I will now start the first sentence of the joke. 2: I acknowledge I am now ready to hear the first sentence of the joke. 1: So a network packet walks into a bar 2: Sorry I couldn't quite here you. Please start over. 1: Do you want to hear a joke about TCP?
- CPLX 5y agoI’ve always wanted to add an HTTP joke to these sorts of networking humor threads but the prospect makes me feel mildly insecure.
- Fnoord 5y agoNo port can be used by any other computer or server (since all are required by Switch), and any port listening on your Switch will be automatically reachable by anyone which is a potential security risk. Does a Switch work if you are IPv6-only? Cause if it'd work with IPv6, a mitigation could be to only use IPv6. It wouldn't solve the security issue, but it would solve the problem of all (external IPv4) ports being used.
- tolien 5y agoThe Switch has no support for IPv6 that I’ve seen.
- lelag 5y agoIt is also a massive security liability as any vulnerable software running on the Switch could be used to compromise the console remotely and by extension compromise your home network since your Switch is likely connected directly on it.
- donkarma 5y agoconsoles are one of the most secure systems due to the fact they're alwyas unnder attack for ajilbreak
- Ekaros 5y agoAlso it would be really nice bot network...
- deleted 5y ago[deleted]
- AshamedCaptain 5y agoNo, it is not. NAT is not a firewall; its goal is to let traffic through, not prevent it. The fact that it sometimes happens to behave like a firewall is very dangerous since it leads people into a false sense of security. I have early 2000s routers that would basically forward all UDP traffic from $IP to the last computer that had sent any traffic to $IP. This did wonders for most games, but you were in for a nasty surprise if you were relying on NAT to protect your fragile Win9x network...
- lelag 5y agoIf you follow Nintendo steps, what happens is that anybody will hit your Switch directly if they connect to any port on your public IP. If some services on the Switch are running and listening on the Switch public interface, they will answer. If one of the those service has a security vulnerability, you are in trouble. You just don't want to expose your entertainment devices to the whole world like this. This setup could make some sense for a DMZ but not a gaming console connected to your local lan.
- 5y ago
- mjg59 5y agoWhen you connect to a remote machine, you send traffic to a specific port on that remote machine but also from a specific port on your machine. The remote port would probably be well-known (eg, port 80 on TCP is the well known port for HTTP), but the local port would be chosen from a random range of available ports. As a result, every connection could be described based on a combination of parameters - the local IP, the remote IP, the local port and the remote port. But these days most users don't connect to remote servers directly. Instead, they're on a local network that connects through a router that only has a single world-routable IPv4 address. That means that while the combination of local and remote IPs and ports is still nominally a unique identifier, the local IP could now refer to multiple different devices. NAT handles this by keeping track of which machine behind the NAT triggered a local connection, mapping its local port to a local port on the publicly routable IP, and then rewriting traffic and forwarding it appropriately so this is mostly invisible (eg, you send traffic to 142.250.189.174 on port 80, and your local port is 31337. Someone else on your network may also be using port 31337 to talk to port 80 on 142.250.189.174, so your NAT router rewrites your local port to 31338. When it sees incoming traffic on port 31338 from 142.250.189.174, it rewrites the packet to be sent to you and as far as you're concerned you're directly communicating with 142.250.189.174) This basically works fine for TCP, because TCP requires you to explicitly make a connection. That means the NAT router can tie the combination of a remote host and a local port to a unique mapping to an internal machine. But UDP is, at the transport layer, stateless - when you send traffic to a remote machine over UDP, the expectation is that that remote machine can just send traffic back to the same UDP port at some arbitrary point in the future and, if the local client is still listening, that'll got through. If you port-forward literally every UDP port to a specific device, when another local device tries to connect to an external service over UDP, your router will probably be confused - it can't just say "Ok, you connected to something over UDP, I rewrote your local port to 31337, traffic to 31337 will be sent to you", because 31337 is already configured to be forwarded to the Switch. You can potentially send traffic to a remote service, but the responses may be forwarded to the wrong device. In theory you could say that because a machine with a specific internal IP sent traffic to a specific remote IP and you rewrote that to a specific port, any traffic from that remote IP to that port should be forwarded to that internal IP even if there's a general port forwarding rule that would instead forward it to the Switch. I have no idea whether that's how routers behave, and it's far too late for me to dig into the kernel source to check that (I've spent the evening fighting Linux's in-kernel ASN1 parser, I'm not inclined to do more)
- hyperman1 5y agoI'll try an analogy. Your router is an apartment building. The switch is one of the many tenants. The problem: Mail for the switch does not arrive in the correct pidgeon hole of the building. Problem one: Nintendo wants you to take your IP and add 20. So if you live in blahstreet 1 box 7, they tell you to send all Switch post to blahstreet 1 box 27. If someone else happens to own that box, bad luck for him. Worse, the IPs are dynamic via DHCP, so a box unused today may be used tomorrow. But that's the minor part. Problem 2: Nintendo wants you to tape a big paper above the pidgeon holes, saying: Postmaster, please drop all mail in box 27, no matter what box it specifies. Technically only for UDP, so the TCP traffic will be delivered. Even so, a lot of post will be wrongly delivered to the Switch and thrown away. Other tenants will wonder why they don't get their mail. Problem 3: You become very vulnerable. The router will send every hacking attempt to the Switch. The tiniest bug in its networking is now critical, as outsiders can just assume your Switch will receive anything they send. To recap, Nintendo is making sure their device receives traffic by throwing every other device you own under the bus. Even a second Switch will suffer. The advice is Dilbert PHB level idiotic but will seem to work for a while.
- misnome 5y agoApparently you only _need_ to forward 45000~65535: https://www.reddit.com/r/NintendoSwitch/comments/6qjhjy/i_have_figured_out_the_actual_range_of_ports_to/ https://www.reddit.com/r/NintendoSwitch/comments/6qjhjy/i_ha... I went through this when setting up the switch to talk to someone behind heavy NAT over the holidays. 45000+ worked for me. ....which makes this even more ridiculous if it never uses them.
- the_mitsuhiko 5y agoThat makes it worse. That means this is not actually a mistake in the documentation. JFC. Does it not support UPnP?
- Macha 5y agoIt does, these docs are for people for whom upnp has failed. The wide port range I think is Nintendo throwing their hands in the air and not actually knowing what ports third party switch software uses
- cat199 5y ago> not actually knowing what ports third party switch software more than likely i'd think this is for enabling inbound responses to outbound ephemeral ports given the port range
- Macha 5y agoEven a restricted NAT should allow for this without explicit port forwarding configuration? Unless you're doing something like active FTP where it's replying to a different port than the one the request originated from. Which would be a interesting choice for a console designed in like 2018.
- laumars 5y agoIt’s a firewall thing not a batting thing. You need a stateful firewall to do that kind of smart port forwarding. Which, to be fair, all consumer routers should have. Stateless firewalls, however, need to have explicit rules for UDP traffic. So that’s what Nintendo are addressing here.
- thanatos519 5y agoWhat, they can't use UPnP like a good citizen?
- OldTimeCoffee 5y agoBecause UPnP is disabled by default on a lot of routers.
- yrro 5y agoMaybe if the network administrator has disabled UPnP that is a hint that they don't want to allow random devices to expose themselves to the entire internet?!
- deleted 5y ago[deleted]
- GekkePrutser 5y agoI don't think upnp is used a lot anymore as it's also really handy for malware makers
- 1_player 5y agoWhat? It's used by tons of legitimate applications as well. Not only malware benefits from being able to accept connections from the Internet. Games, torrents and other p2p services, etc.
- GekkePrutser 5y agoI play a lot of games and I've never had any issues not having UPnP. They got used to working around it. Probably with centralised servers. I never liked the P2P model anyway, dedicated servers are more fun because you can influence the gamemode, add mods etc. For torrents I don't know... If I were to torrent I would not do it without VPN anyhow.
- tux3 5y agoMalware that's already on your system can do whatever it wants. NAT punching is not some complicated dark art for people who already have working exploits...
- Terry_Roll 5y agoI cant believe a company this size could suggest such a thing, so has anyone tried doing this and then monitored what happens? Is the Switch able to do other stuff which is not reported or mentioned anywhere?
- dm319 5y agoDarn, I hope this isn't the solution to the problem I have where my switch won't join other worlds on minecraft.
- mschuster91 5y agoMy s/o and her sister (CS student) regularly play Animal Crossing over the Internet. I (and the SIL) wanted to curse Nintendo to hell and back for requiring users to essentially put their Switches available to the wide Internet (meaning, as long as the Switch is powered on, any RCE exploit on the Switch turns it into a full, unrestricted gateway into my home network!) simply because Nintendo doesn't want to follow basic Internet standards like UPnP or, heaven forbid, provide STUN/TURN proxies paid for by the Nintendo Online subscription. Hell it took years for them to implement Bluetooth audio on the Switch, and that's output-only, no microphone. What stuff is their software division smoking?
- tokamak-teapot 5y agoI’ve played Animal Crossing with friends over the internet and I certainly didn’t touch anything on our router to do so. Any idea if there is a particular scenario where this becomes required?
- echelon 5y agoNintendo, despite making some of the first attempts at networked play in the late 80's and 90's, does not really understand the internet. https://en.wikipedia.org/wiki/Family_Computer_Network_System https://en.wikipedia.org/wiki/Family_Computer_Network_System (1988) https://en.wikipedia.org/wiki/Satellaview https://en.wikipedia.org/wiki/Satellaview (1995) https://en.wikipedia.org/wiki/64DD https://en.wikipedia.org/wiki/64DD (1999) They don't understand a lot of things, even some of which they've lucked into, like the competitive Smash scene. Or fan remakes and tributes (of which Sega notoriously doesn't send their lawyers after). But they still make some incredibly compelling games.
- ginko 5y agoWhat is this needed for? I never set up any port forwarding and don't remember having any issues with network connectivity. But then again I don't play that much online.
- smcl 5y agoI came to ask the same thing - I haven't picked up my Switch in a couple of months but I never touched my router settings for this and it was always working fine. Maybe it's just something from a recent Switch firmware update? Or perhaps just for online play in specific games.
- tootie 5y agoTypically you'd do this for enabling peer-to-peer connections. I run some Minecraft servers in my house this way. I have no idea what kind of peer-to-peer gaming Switch enables. Social gaming is done over the internet with a cloud subscription that costs like $20/year.
- smcl 5y agoYeah this is what I thought, I remember fiddling around with this to make Soulseek (or something) work on my old Linksys WRT54G back when I was at university. I wonder what Switch services/games work this way
- stevenwoo 5y agoI dunno if this had anything to do with it but there is peer to peer online gaming with Divinity Original Sin 2, and I tried grouping up with many folks I friended online and not in the same time zone and it never worked for us. Borderlands also appears to use peer to peer connections.
- goldcd 5y agoIt's pretty good advice, if you're Nintendo and spending a fortune trying to provide support advice to people with crappy router config/connections. Yes it's entirely likely to cause other problems - but probably going to get that switch working. Other problems will go to other vendors - and if their advice stops your switch from working, that's on them.
- spockz 5y agoSo… what if you have two switches?
- foxtrottbravo 5y agoYou obviously need a separate ISP package for every Switch you own
- spockz 5y agoAt that point it would be easier if it just came with its own 5g modem and ipv6 support.
- notum 5y agoExactly. Just like on the Apple's website: "If someone starts shooting at your iPhone: guard it with your body. Layers of tissue and fat should prevent the bullets from scratching iPhone's screen." Perfect business sense.
- hamasho 5y agoI guess they don't like it. If the device is not broken, but the user is dead, they have fewer consumers and more good devices in the secondhand market, no profit. But if the user survives and the device is broken, he or she continues to buy Apple products, at least the next one immediately, profit!
- andi999 5y agoIs this on their website, or is it a joke. Seriously, I cant tell anymore.
- rawling 5y agohttps://news.ycombinator.com/item?id=29903365 https://news.ycombinator.com/item?id=29903365
- mysterydip 5y agoWhat if I have two switches?
- julius_deane 5y agoon the first switch you redirect all ports to the second one I will not elaborate
- fuzzy2 5y agoYou’ll have to switch between them
- goodlinks 5y agoset up rules in your firewall for the correct NAT type either for your whole network or just those devices - unless something has changed recently.
- peppermint_tea 5y ago
- foxtrottbravo 5y agoLet's make it constructive then and talk about something that grinds my gears. Throwing all ports in the direction of a single host has nothing to to with a DMZ. I know consumer router manufacturers like to call it that but it isn't. It's an Exposed Host setup. A DMZ is a multi-tiered firewall approach where you have a Firewall between the internet and your DMZ and another one between your DMZ and your LAN
- IntelMiner 5y agoPlease don't use slurs to indicate points :(
- _trampeltier 5y agoYou allways have to, why? And I was so close to buy a Switch. But no .. never gona happen to may home Network.
- 46424ea63d4c 5y agoJust a quick advice, as I struggled with this as my daughter complained that she could not join network games in Animal Crossing because she had only “NAT Type D”. Forwarding all these ports was the recommended solution in Nintendo’s docs. However, it did nothing to resolve this problem. What helped was to ensure not to modify source ports in the NAT setup (“static-port” in pf).
- goodlinks 5y agoWhen i use routers provided by my ISP the switches always just work. when i was running pfsense (i need to set it up again soon :) ).. I just had to set a rule for them to always get the same IP and the correct NAT type and it worked perfectly. It does make me wonder if all ISP provided routers are pretty insecure in some way?
- hwers 5y agoWhat's the reason not to open all ports btw? Outing myself as naive by asking
- 3np 5y agoIt’s about redirecting. Following these instructions means that the Switch, and only the Switch, can receive UDP on behalf of the other network. Which will break a lot of things. Supposedly this also means that more than one Switch on the same network is a no-go.
- foxtrottbravo 5y agoIn a normal NATed setup your ports are closed from the outside until a client from inside your network Starts sending packets to the outside. The Router will keep track of network package going through to the Internet and store it in a table. in case there is an answer from outside of your network the router will look up whether a client started this conversation (there is a corresponding entry in his table) and will forward the incoming packet to the client that started the conversation. What nintendo is asking you to allow here is to allow any outside packet coming in over UDP to get to the switch whether it first asked for it or not. This means in practice you won't be able to run any other service which needs an UDP port fowarded in your network. It also means anyone can talk directly to your switch on any port they like whether you want to or not. And it means, that should something ever take/get the same IP as the switch it will be exposed to the Internet directly
- grayfaced 5y agoIt's not a firewall acl, it's a port forwarding rule. In a NAT, UDP connections you initiate will be added to NAT table temporarily to handle replies. Nintendo's port range covers all the ephemeral ports that OS will naturally give to UDP connections. So your computer may attempt to start a UDP communication but the reply traffic will be forwarded to your switch instead of using NAT table. So nothing else can use UDP properly. That DNS request to port 53 has a source port of 42981 (for example), and the switch gets the reply. I'm not sure if most routers prioritize port forwarding rules or NAT tables. That's really up to implementation.
- smcleod 5y agoPlayStation is pretty bad too, they want 80, 443 (and 1935, 3074, 3478-3479), if you don't you can get all sorts of really annoying problems joining games, delays joining voice chats etc....
- sneak 5y agoCox (US residential ISP) recently started blocking all port 80 inbound to residential IPs.
- smcleod 5y agoThat's common in Australia and New Zealand along with some other potentially high risk ports, usually you can opt out of it in your settings.
- KronisLV 5y agoDon't most ISPs already use NAT and therefore disallow all inbound traffic to devices behind it? I personally had to use WireGuard to work around it for some of my homelab servers that i wanted to publish: https://blog.kronis.dev/tutorials/how-to-publicly-access-your-homelab-behind-nat https://blog.kronis.dev/tutorials/how-to-publicly-access-you...
- smcleod 5y agoSome use CGNAT, but you can disable it if you need to run servers.
- IntelMiner 5y agoYou can disable it IF the ISP has an opt-out
- smcleod 5y agoSorry yes that is what I should have said
- 5y ago
- ZiiS 5y agoIf they need all your incoming traffic they should probably have called it a "router" not a "switch".
- cookiengineer 5y agoBa dum tzz... sigh take my upvote.
- hamasho 5y agoI'm sure "Nintendo Router" would be much more terrible product...
- theginger 5y agoNintendo Firewall sounds good though.
- leshenka 5y agoSomething straight out of bowser's castle
- trembonator 5y ago
- toyg 5y agoAmong other problems, it would be pronounced differently in different countries...
- gorpomon 5y agoA joke that could really only happen here, I happily give my upvote.
- sdiupIGPWEfh 5y agoI am ashamed that this has never occurred to me and shocked that I have never heard it elsewhere. Brilliant. Apparently, the "Nintendo WiFi Network Adapter" was once a thing in Japan, and it did have a router mode. https://www.wired.com/2008/09/nintendo-announ-2/ https://www.wired.com/2008/09/nintendo-announ-2/ https://www.famitsu.com/game/news/1217892_1124.html https://www.famitsu.com/game/news/1217892_1124.html https://kotaku.com/nintendo-announces-wii-ds-wifi-router-bwah-5046565 https://kotaku.com/nintendo-announces-wii-ds-wifi-router-bwa...
- icf80 5y agodoesn't ipv6 fixes those issue?
- foxfluff 5y agoIt will, I guess. In the same sense that fusion power will fix our energy issues.
- fulafel 5y agoDo you mean the need to configure your CPE to allow incoming traffic to specific devices? Not really, with v6 you have to put in allow-rules too if you have the normal default-deny firewall rules in the CPE. It could be automatic with UPnP, but it could be automatic with v4 + NAT too. The article doesn't say if the Switch supports that.
- vorticalbox 5y agodoes anyone know why? I don't have this set up on my network haven't had any issues.
- goodlinks 5y agoI have only seen this issue when running pfsense. and then to fix it i set up rules for the switch to ahve the type of NAT it wants. When i use a router from my ISP it always just works.
- vorticalbox 5y agomakes sense but what happens if you have multi switch's? do routers support forwarding to multiple hosts?
- goodlinks 5y agoI know very little about networking, but i know that my kids can play multiplayer at the smae time together that wont work until i set up thier NAT correctly. My naivity says that its either NAT handles it or the swithces are choosing random ports (or maybe negotiating through plug and play).
- MauranKilom 5y agoThis whole article is... optimistic. > 4. Enter the IP address you found on the network device, but add 20 to the last section of digits, and then select OK. > As an example, if your computer's IP address displays as 192.168.2.5, enter 192.168.2.25 on the Nintendo Switch. Hope you don't have more than 20 devices on your network (after your PC), and that they're not configured to be close to 255 there...
- willis936 5y agoIt also assumes that your DHCP range is the top half of the last byte. That's a de facto convention in consumer routers, but not codified anywhere and the kind of thing that could change and probably isn't even correct for some routers shipping today.
- yardstick 5y agoDefinitely not codified anywhere, and not in any of the routers I’ve used (to be fair they are more prosumer). The main dhcp server used in most routers, dnsmasq, also assigns IPs using a MAC algorithm by default for consistent IP addressing of devices in a LAN. You would need to explicitly configure it for sequential first come first serve.
- toyg 5y agoTbf, this is the fault of network people, not the poor support guys left holding the bag of shit. The whole stack is still dangerous and obscure, 25 years after the internet went mainstream. UPnP was an effort at simplifying the situation and seems to have failed, so now we're back trying to teach IT toddlers to spell "characteristic" when they don't even know the ABC (nor do they care about it). It's inevitable that shortcuts will be taken.
- thrdbndndn 5y agoJust curious, what if you have another layer of NAT, or your router is out of your control (and no UPnP)? You just can't play networked games with Switch, or what?
- zibzab 5y agoThat's not portforwarding, that's moving to the DMZ...