NAT & Firewall Configuration - Juniper SRX

IPv6Freely · Jan 26, 2015

I'm trying to configure my home router/firewall to be able to connect to Xbox Live multiplayer. Signing in is no issue but I'm unable to play any multiplayer games. My Xbox Live NAT settings say "strict". I'm not sure if that changes to anything else once
I've configured the router correctly.

Here is the configuration I have, in set format. Assume my interfaces are configured correctly and my source NAT is also configured correctly. Thanks for the help.

set system services dhcp static-binding 4c:0b:be:85:7e:f0 fixed-address 10.0.1.22
set system services dhcp static-binding 4c:0b:be:85:7e:f0 host-name xbone
set security nat destination pool xbone address 10.0.1.22/32
set security nat destination rule-set DNAT rule xbone-tcp-3074 match destination-address 0.0.0.0/0
set security nat destination rule-set DNAT rule xbone-tcp-3074 match destination-port 3074
set security nat destination rule-set DNAT rule xbone-tcp-3074 match protocol tcp
set security nat destination rule-set DNAT rule xbone-tcp-3074 then destination-nat pool xbone
set security nat destination rule-set DNAT rule xbone-udp-3074 match destination-address 0.0.0.0/0
set security nat destination rule-set DNAT rule xbone-udp-3074 match destination-port 3074
set security nat destination rule-set DNAT rule xbone-udp-3074 match protocol udp
set security nat destination rule-set DNAT rule xbone-udp-3074 then destination-nat pool xbone
set security nat destination rule-set DNAT rule xbone-udp-3544 match destination-address 0.0.0.0/0
set security nat destination rule-set DNAT rule xbone-udp-3544 match destination-port 3544
set security nat destination rule-set DNAT rule xbone-udp-3544 match protocol udp
set security nat destination rule-set DNAT rule xbone-udp-3544 then destination-nat pool xbone
set security nat destination rule-set DNAT rule xbone-udp-4500 match destination-address 0.0.0.0/0
set security nat destination rule-set DNAT rule xbone-udp-4500 match destination-port 4500
set security nat destination rule-set DNAT rule xbone-udp-4500 match protocol udp
set security nat destination rule-set DNAT rule xbone-udp-4500 then destination-nat pool xbone
set security nat destination rule-set DNAT rule xbone-udp-500 match destination-address 0.0.0.0/0
set security nat destination rule-set DNAT rule xbone-udp-500 match destination-port 500
set security nat destination rule-set DNAT rule xbone-udp-500 match protocol udp
set security nat destination rule-set DNAT rule xbone-udp-500 then destination-nat pool xbone
set security nat destination rule-set DNAT rule xbone-udp-88 match destination-address 0.0.0.0/0
set security nat destination rule-set DNAT rule xbone-udp-88 match destination-port 88
set security nat destination rule-set DNAT rule xbone-udp-88 match protocol udp
set security nat destination rule-set DNAT rule xbone-udp-88 then destination-nat pool xbone
set security nat destination rule-set DNAT rule xbone-tcp-80 match destination-address 0.0.0.0/0
set security nat destination rule-set DNAT rule xbone-tcp-80 match destination-port 80
set security nat destination rule-set DNAT rule xbone-tcp-80 match protocol tcp
set security nat destination rule-set DNAT rule xbone-tcp-80 then destination-nat pool xbone
set security nat destination rule-set DNAT rule xbone-udp-53 match destination-address 0.0.0.0/0
set security nat destination rule-set DNAT rule xbone-udp-53 match destination-port 53
set security nat destination rule-set DNAT rule xbone-udp-53 match protocol udp
set security nat destination rule-set DNAT rule xbone-udp-53 then destination-nat pool xbone
set security nat destination rule-set DNAT rule xbone-tcp-53 match destination-address 0.0.0.0/0
set security nat destination rule-set DNAT rule xbone-tcp-53 match destination-port 53
set security nat destination rule-set DNAT rule xbone-tcp-53 match protocol udp
set security nat destination rule-set DNAT rule xbone-tcp-53 then destination-nat pool xbone
set security policies from-zone untrust to-zone trust policy permit-xbone-live match source-address any
set security policies from-zone untrust to-zone trust policy permit-xbone-live match destination-address any
set security policies from-zone untrust to-zone trust policy permit-xbone-live match application xbone-live
set security policies from-zone untrust to-zone trust policy permit-xbone-live then permit
set applications application xbone-udp-88 protocol udp
set applications application xbone-udp-88 destination-port 88
set applications application xbone-tcp-3074 protocol tcp
set applications application xbone-tcp-3074 destination-port 3074
set applications application xbone-udp-3074 protocol udp
set applications application xbone-udp-3074 destination-port 3074
set applications application xbone-udp-500 protocol udp
set applications application xbone-udp-500 destination-port 500
set applications application xbone-udp-3544 protocol udp
set applications application xbone-udp-3544 destination-port 3544
set applications application xbone-udp-4500 protocol udp
set applications application xbone-udp-4500 destination-port 4500
set applications application xbone-udp-53 protocol udp
set applications application xbone-udp-53 destination-port 53
set applications application xbone-tcp-53 protocol tcp
set applications application xbone-tcp-53 destination-port 53
set applications application xbone-tcp-80 protocol tcp
set applications application xbone-tcp-80 destination-port 80
set applications application-set xbone-live application xbone-tcp-3074
set applications application-set xbone-live application xbone-udp-3074
set applications application-set xbone-live application xbone-udp-3544
set applications application-set xbone-live application xbone-udp-4500
set applications application-set xbone-live application xbone-udp-500
set applications application-set xbone-live application xbone-udp-88
set applications application-set xbone-live application xbone-tcp-80
set applications application-set xbone-live application xbone-tcp-53
set applications application-set xbone-live application xbone-udp-53
Click to expand...

:)

taidara · Jan 26, 2015

Periodical DNS issue, 360 sending blank queries

May I ask, do you receive a DNS error message through your console, or do you exclusively use the monitoring tool on the juniper firewall, to determine this behavior?

When you say "It's sending 0-byte DNS queries!", are you able to see any activity on port 3074 from the same endpoint, at the same time?

Do you know if your juniper firewall/NAT support UPnP and more specifically IGD?

CouronneBcahi · Jan 26, 2015

Problème NAT modere sur numericable modem netgear cbvg834g

Sa me fait sa ( NAT strict ) depuis deja deux ans sa me fais trop chier srx !

taidara · Jan 27, 2015

Greetings freely!

Can you provide the make and model of your modem, and if you use a wireless router (make & model).

Thanks in advance!

ar32h · Apr 4, 2015

SRX randomizes source ports on source NAT to counter DNS poisoning attacks (among other things). This confuses XBL.

"set security nat source port-randomization disable" doesn't help.

You need to create a source NAT pool containing your public IP address and set "port no-translation" in the pool.

This worked for me to get Open NAT on a SRX100H running Junos 12.1X44-D40.2.

Unless you have a static IP you'll probably want a SLAX script to update the config whenever your public IP changes.

Source (and SLAX script):
forums.juniper.net/.../57762

Miss Diggz · Oct 31, 2018

Hey there ar32h,

Thanks for posting what worked for you and the helpful tips for your fellow gamers! If you have any Xbox Support related questions in the future, please feel free to create a new thread detailing what you're experiencing. This way you can receive support
catered specifically to you from our community. Thanks again!

Miss Diggz

Hey there ar32h,

Thanks for posting what worked for you and the helpful tips for your fellow gamers! If you have any Xbox Support related questions in the future, please feel free to create a new thread detailing what you're experiencing. This way you can receive support
catered specifically to you from our community. Thanks again!

ar32h

SRX randomizes source ports on source NAT to counter DNS poisoning attacks (among other things). This confuses XBL.

"set security nat source port-randomization disable" doesn't help.

You need to create a source NAT pool containing your public IP address and set "port no-translation" in the pool.

This worked for me to get Open NAT on a SRX100H running Junos 12.1X44-D40.2.

Unless you have a static IP you'll probably want a SLAX script to update the config whenever your public IP changes.

Source (and SLAX script):
forums.juniper.net/.../57762

taidara

Greetings freely!

Can you provide the make and model of your modem, and if you use a wireless router (make & model).

Thanks in advance!

taidara

May I ask, do you receive a DNS error message through your console, or do you exclusively use the monitoring tool on the juniper firewall, to determine this behavior?

When you say "It's sending 0-byte DNS queries!", are you able to see any activity on port 3074 from the same endpoint, at the same time?

Do you know if your juniper firewall/NAT support UPnP and more specifically IGD?

GMAN990

Hi,

Your problem is that you are "doubt NAT'ing"

Your Zhone is a router and running NAT

Your Juniper also runs NAT

Your best bet is to establish whether your can put the Zhone in "bridge mode" and hand off any PPPoE authentication (if your ISP uses it) to the Juniper

Then all you need to do is open the xbox live ports on the Juniper, but as it currently stands it won't work, the Xbox is hidden behind two many NAT'd layers.

NAT & Firewall Configuration - Juniper SRX