7 ms·

Apparently you only _need_ to forward 45000~65535: https://www.reddit.com/r/NintendoSwitch/comments/6qjhjy/i_have_figured_out_the_actual_range_of_ports_to/ http

Apparently you only _need_ to forward 45000~65535: https://www.reddit.com/r/NintendoSwitch/comments/6qjhjy/i_have_figured_out_the_actual_range_of_ports_to/ https://www.reddit.com/r/NintendoSwitch/comments/6qjhjy/i_ha... I went through this when setting up the switch to talk to someone behind heavy NAT over the holidays. 45000+ worked for me. ....which makes this even more ridiculous if it never uses them.

the_mitsuhiko 5y ago
That makes it worse. That means this is not actually a mistake in the documentation. JFC. Does it not support UPnP?
- Macha 5y ago
  It does, these docs are for people for whom upnp has failed. The wide port range I think is Nintendo throwing their hands in the air and not actually knowing what ports third party switch software uses
  - cat199 5y ago
    > not actually knowing what ports third party switch software more than likely i'd think this is for enabling inbound responses to outbound ephemeral ports given the port range
    - Macha 5y ago
      Even a restricted NAT should allow for this without explicit port forwarding configuration? Unless you're doing something like active FTP where it's replying to a different port than the one the request originated from. Which would be a interesting choice for a console designed in like 2018.
      - laumars 5y ago
        It’s a firewall thing not a batting thing. You need a stateful firewall to do that kind of smart port forwarding. Which, to be fair, all consumer routers should have. Stateless firewalls, however, need to have explicit rules for UDP traffic. So that’s what Nintendo are addressing here.
      - fulafel 5y ago
        NAT functionality especially for UDP can be incredibly flaky in a lot of consumer hardware, mangling payloads, randomly dropping associations or having extremely short timeouts, and other plain buggy behaviour.
        deleted 5y ago
        [deleted]
  - Hamuko 5y ago
    I think even their first-party games use random ports.
  - the_mitsuhiko 5y ago
    If it supports UPnP why do the docs not say: turn on UPnP? If you search for UPnP in the docs, you get exactly zero results back.
    - Macha 5y ago
      I don't think anybody here (including me) claims these are _good_ docs.
      - the_mitsuhiko 5y ago
        Is there any evidence that the Switch supports UPnP? Because some quick googling did not suggest it does.
        TingPing 5y ago
        My router has never seen the switch use upnp.
    - SkyPuncher 5y ago
      IMO, because they're trying to keep it simple. Most readers of HN will understand (or at least understand the goal of) the checklist for debugging network issues. Skipping straight to Port Forwarding eliminates any issues on whether UPnP is actually working correctly. Growing up, some of my friends had routers struggled to handle UPnP correctly. If I knew they were the only one needing port forwarding, I'd simply turn that on for them instead of trying to figure out if UPnP was actually working correctly.
- loup-vaillant 5y ago
  Probably because of this: https://duckduckgo.com/?t=ffab&q=UPnP https://duckduckgo.com/?t=ffab&q=UPnP Among the 4 first links, 3 explicitly tell me that UPnP is dangerous.
  - yardstick 5y ago
    Came here to say this. UPnP is a security vulnerability, not a feature.
    - solarkraft 5y ago
      Worse than forwarding all ports?
      - yardstick 5y ago
        Neither is an acceptable solution. Although I will say that if you are forwarding all ports, at least it’s to a device you know about. Not some random IoT or PC software or whatever opening up ports without your knowledge.
  - the_mitsuhiko 5y ago
    UPnP is significantly less dangerous than forwarding all UDP ports to a single device.
- criddell 5y ago
  Who has UPnP enabled anymore?
  - JAlexoid 5y ago
    My Verizon Router resets and defaults to it. (Oh.... and it resets randomly...)
    - criddell 5y ago
      My AT&T router (Arris) doesn't even have that setting. https://forums.att.com/conversations/att-internet-features/how-do-i-turn-on-upnp-for-pc/60bb18db256e9b7a007bc26e https://forums.att.com/conversations/att-internet-features/h...
      - thescriptkiddie 5y ago
        This is made doubly frustrating by the fact that AT&T does not allow you to use your own router.
        criddell 5y ago
        You can put your own router behind the AT&T gateway and then tell the gateway it's a DMZ. AT&T does a lot to make me angry, but removing uPnP is the right call IMHO.
        thescriptkiddie 5y ago
        Using DMZ doesn't completely solve my problem, the AT&T gateway is still routing every packet (at less than line speed) and randomly dropping some of them.
- bin_bash 5y ago
  is this maybe to get around a double NAT problem? I'm not sure how UPnP works with double NAT
- kelnos 5y ago
  UPnP is a security risk (as is forwarding all UDP ports to a single device). Nintendo should set up STUN servers so the Switch can do UDP hole punching.
  - WolfRazu 5y ago
    How is hole punching more secure than UPnP? They both achieve exactly the same thing.
    - kelnos 5y ago
      Enabling UPnP on your router enables a malicious app to permanently forward ports from the outside to the inside. The malicious app could also forward ports to other devices on your network. For example, installing a bit of malware on your laptop could set up a port forwarding rule from the internet to your NAS's web interface. UDP hole punching via STUN requires continuous work on the part of a malicious app to keep that port open. Work that could be noticed much easier than a rogue UPnP-using bit of malware. And it can't open ports to other devices on your network.
Someone 5y ago
_only_? That’s, give or take, ⅓ of the full range. If everything in your network did something similar, you couldn’t have more than 3 devices in your network (and with 3, the stars would have to align for there to be no overlap between the ranges. If, for example, your tv needs 15000-35000, the largest contiguous range remaining would have about 15000 ports.
- nolok 5y ago
  Try getting ~10 years old uplay game to work and despair. Not sure what network engine they used at the time but there is an entire set of games that basically can't connect properly without using random ports anywhere in the 10k/60k range, it's ridiculous. And let's not ever talk about two people in the same home playing the same game together. I loved splinter cell blacklist's multiplayer but damn did it take long to get anything connected. I'm not even sure why I mean this was with internet gaming already being the norm, I assume it's because they made games for console and then ported, and on console port issue are handled for them or whatever ? Anyway this was stupid
  - auto 5y ago
    "And let's not ever talk about two people in the same home playing the same game together." This is my fiance and I constantly struggling with Halo:MCC. At least once a night one of us fails to join a game, and I'm convinced it's some poor NAT punch through solution that doesn't always work.
  - letitbeirie 5y ago
    Ever wanted to relive the past by playing Red Alert 2? Get ready to relive the past by brushing up on the particulars of the IPX protocol...
brynx97 5y ago
That user has pfSense, and they are doing it wrong. I would follow the config and guidance from the pfSense dev on this one: https://forum.netgate.com/topic/112631/nintendo-switch-needs-static-port-on-its-outbound-nat?_=1642083327212 https://forum.netgate.com/topic/112631/nintendo-switch-needs... The most common problem I have seen over and over is double NAT or CGNAT. For the home networks I manage (my parents, in-laws, and my own), I put the ISP modems in bridge mode or passthrough mode.
bin_bash 5y ago
The linux kernel uses 32768-60999 for ephemeral ports so you've really cut into them

the_mitsuhiko 5y ago

That makes it worse. That means this is not actually a mistake in the documentation. JFC. Does it not support UPnP?

Macha 5y ago
It does, these docs are for people for whom upnp has failed. The wide port range I think is Nintendo throwing their hands in the air and not actually knowing what ports third party switch software uses
- cat199 5y ago
  > not actually knowing what ports third party switch software more than likely i'd think this is for enabling inbound responses to outbound ephemeral ports given the port range
  - Macha 5y ago
    Even a restricted NAT should allow for this without explicit port forwarding configuration? Unless you're doing something like active FTP where it's replying to a different port than the one the request originated from. Which would be a interesting choice for a console designed in like 2018.
    - laumars 5y ago
      It’s a firewall thing not a batting thing. You need a stateful firewall to do that kind of smart port forwarding. Which, to be fair, all consumer routers should have. Stateless firewalls, however, need to have explicit rules for UDP traffic. So that’s what Nintendo are addressing here.
    - fulafel 5y ago
      NAT functionality especially for UDP can be incredibly flaky in a lot of consumer hardware, mangling payloads, randomly dropping associations or having extremely short timeouts, and other plain buggy behaviour.
      - deleted 5y ago
        [deleted]
- Hamuko 5y ago
  I think even their first-party games use random ports.
- the_mitsuhiko 5y ago
  If it supports UPnP why do the docs not say: turn on UPnP? If you search for UPnP in the docs, you get exactly zero results back.
  - Macha 5y ago
    I don't think anybody here (including me) claims these are _good_ docs.
    - the_mitsuhiko 5y ago
      Is there any evidence that the Switch supports UPnP? Because some quick googling did not suggest it does.
      - TingPing 5y ago
        My router has never seen the switch use upnp.
  - SkyPuncher 5y ago
    IMO, because they're trying to keep it simple. Most readers of HN will understand (or at least understand the goal of) the checklist for debugging network issues. Skipping straight to Port Forwarding eliminates any issues on whether UPnP is actually working correctly. Growing up, some of my friends had routers struggled to handle UPnP correctly. If I knew they were the only one needing port forwarding, I'd simply turn that on for them instead of trying to figure out if UPnP was actually working correctly.
loup-vaillant 5y ago
Probably because of this: https://duckduckgo.com/?t=ffab&q=UPnP https://duckduckgo.com/?t=ffab&q=UPnP Among the 4 first links, 3 explicitly tell me that UPnP is dangerous.
- yardstick 5y ago
  Came here to say this. UPnP is a security vulnerability, not a feature.
  - solarkraft 5y ago
    Worse than forwarding all ports?
    - yardstick 5y ago
      Neither is an acceptable solution. Although I will say that if you are forwarding all ports, at least it’s to a device you know about. Not some random IoT or PC software or whatever opening up ports without your knowledge.
- the_mitsuhiko 5y ago
  UPnP is significantly less dangerous than forwarding all UDP ports to a single device.
criddell 5y ago
Who has UPnP enabled anymore?
- JAlexoid 5y ago
  My Verizon Router resets and defaults to it. (Oh.... and it resets randomly...)
  - criddell 5y ago
    My AT&T router (Arris) doesn't even have that setting. https://forums.att.com/conversations/att-internet-features/how-do-i-turn-on-upnp-for-pc/60bb18db256e9b7a007bc26e https://forums.att.com/conversations/att-internet-features/h...
    - thescriptkiddie 5y ago
      This is made doubly frustrating by the fact that AT&T does not allow you to use your own router.
      - criddell 5y ago
        You can put your own router behind the AT&T gateway and then tell the gateway it's a DMZ. AT&T does a lot to make me angry, but removing uPnP is the right call IMHO.
        thescriptkiddie 5y ago
        Using DMZ doesn't completely solve my problem, the AT&T gateway is still routing every packet (at less than line speed) and randomly dropping some of them.
bin_bash 5y ago
is this maybe to get around a double NAT problem? I'm not sure how UPnP works with double NAT
kelnos 5y ago
UPnP is a security risk (as is forwarding all UDP ports to a single device). Nintendo should set up STUN servers so the Switch can do UDP hole punching.
- WolfRazu 5y ago
  How is hole punching more secure than UPnP? They both achieve exactly the same thing.
  - kelnos 5y ago
    Enabling UPnP on your router enables a malicious app to permanently forward ports from the outside to the inside. The malicious app could also forward ports to other devices on your network. For example, installing a bit of malware on your laptop could set up a port forwarding rule from the internet to your NAS's web interface. UDP hole punching via STUN requires continuous work on the part of a malicious app to keep that port open. Work that could be noticed much easier than a rogue UPnP-using bit of malware. And it can't open ports to other devices on your network.

Someone 5y ago

_only_? That’s, give or take, ⅓ of the full range. If everything in your network did something similar, you couldn’t have more than 3 devices in your network (and with 3, the stars would have to align for there to be no overlap between the ranges. If, for example, your tv needs 15000-35000, the largest contiguous range remaining would have about 15000 ports.

nolok 5y ago
Try getting ~10 years old uplay game to work and despair. Not sure what network engine they used at the time but there is an entire set of games that basically can't connect properly without using random ports anywhere in the 10k/60k range, it's ridiculous. And let's not ever talk about two people in the same home playing the same game together. I loved splinter cell blacklist's multiplayer but damn did it take long to get anything connected. I'm not even sure why I mean this was with internet gaming already being the norm, I assume it's because they made games for console and then ported, and on console port issue are handled for them or whatever ? Anyway this was stupid
- auto 5y ago
  "And let's not ever talk about two people in the same home playing the same game together." This is my fiance and I constantly struggling with Halo:MCC. At least once a night one of us fails to join a game, and I'm convinced it's some poor NAT punch through solution that doesn't always work.
- letitbeirie 5y ago
  Ever wanted to relive the past by playing Red Alert 2? Get ready to relive the past by brushing up on the particulars of the IPX protocol...

brynx97 5y ago

That user has pfSense, and they are doing it wrong. I would follow the config and guidance from the pfSense dev on this one: https://forum.netgate.com/topic/112631/nintendo-switch-needs-static-port-on-its-outbound-nat?_=1642083327212 https://forum.netgate.com/topic/112631/nintendo-switch-needs... The most common problem I have seen over and over is double NAT or CGNAT. For the home networks I manage (my parents, in-laws, and my own), I put the ISP modems in bridge mode or passthrough mode.

bin_bash 5y ago

The linux kernel uses 32768-60999 for ephemeral ports so you've really cut into them