Strict NAT and Teredo Tunneling errors on a university network

Greetings,

I am a tech support manager for a university in Texas. We receive support calls and emails from students regarding internet connectivity issues with the Xbox One that boil down to errors related to NAT and Teredo tunneling. Before contacting us the students
usually do some research and contact us wanting us to change the NAT settings on the network used in the residence halls.

We dont' use NAT on our network. All the devices on our network have public IP addresses. There are no NAT settings for us to adjust.

Also, we get frequent calls on Teredo related errors. Teredo is designed to work in a NAT environment. Again, something we do not use on our network.

The Xbox One seems to be hardwired to operate in a network environment where there are not public IP addresses, only those handed out by a router like in a residential setup.

The end result is we have a LOT of students with shiny new Xbox Ones that don't work and they are not happy about it. We don't like it either but there is nothing we can do about it. And that is why I am posting this here.

I have looked for some official way to contact MS on seeing if we can do something to resolve this issue but I have had no luck. I would be thrilled if we could get some of our engineers together with some folks from MS to see if something can be done to
fix this.

Thank you for your time and thank you for your help.

Tim

:)

 

"Can't get Teredo IP" error won't resolve

Malacath, I connected straight to my university network via ethernet and I am still getting a strict NAT type with Teredo error when testing multiplayer connection. I had previously contacted IT at my school, and they unblocked all firewalls for my IP address
already...

 

Strict NAT. Will not open after trying all options. Losing my mind.

Thanks for your feedback and the additional information.

Are you getting an error like "cannot get Teredo ip" sometimes in the multiplayer test? Would you mind asking your provider if you are on a native IPv6 connection and if they maybe block the teredo tunneling protocol?

Because if you setup the one being in the DMZ and still get a strict NAT it maybe a problem with the teredo protocol.

As the 360 is not using the teredo tunneling protocol you do not experience any problems there and get an open NAT on it. Might be another indicator that this could be the problem.

 

Hey there, Tim!

The Xbox One functions quite well with a public IP address, as we often suggest setting up the console under DMZ or directly connect to their modem; both of which will give the console a public IP address, as I am sure you are aware.

It seems the problem you may be running into is the Teredo IP address issue, and that is likely what is at fault for all the issues (as long as each device is getting its
own public IP address). Sometimes, the Teredo error will show up and

restoring the console to factory defaults is required. While we don't know the cause for this, if the factory reset doesn't happen, the error is a result of the ISP themselves.

Our
Network Connection Troubleshooter is quite in depth, and may be able to help you troubleshoot users that call you guys. Have you given it a shot yet? They should be able to work with you, this troubleshooter, and your access to their routing device to help
nail down any possible networking issues. I suggest trying it out, especially with any Teredo IP errors you guys may receive a call about.

My main suggestion is to try that out first. What I am going to do on my end is pass this along to the appropriate people and see what I can dig up for you. I will post back once I have more information from them.

 

Thanks for the reply.

We always suggest that the console owner restore to factory default. This has helped in some instances but usually not.

I look forward to hearing back from you. Thanks for your help.

Tim

 

Hey, GJB. Seems like what the students are likely running into is how the University gateway/firewall is setup for handling unsolicited, inbound connectivity for P2P communications, and possibly consoles failing to acquire a Teredo address. Party Chat and
many multiplayer titles use a P2P mesh topology for network communications, which requires open inbound communications to the Xbox One console. Teredo is used for a few things here, such as detecting the public IP/port of the console if it's behind a NAT (sounds
like it doesn't apply here), detecting what type of inbound/outbound connectivity is allowed to the console behind whatever network gear the console is traversing to reach the outside world, acting as an endpoint for bubble packets to hit, and securing network
communications between the console and its peers.

So first thing first, if any of the students are getting an error that their console can't obtain a Teredo address, that will block Party Chat and many multiplayer games. UDP 3544 outbound needs to be open, and the console will default to a source port of
UDP 3074 when targeting the Teredo server pool. If the console is getting a Teredo address, then next thing would be to see what Teredo is detecting as far as what inbound connectivity is allowed. If you go under Settings, and Network. The Open/Moderate/Strict
NAT detection will be present here. If you go to Test Multiplayer Connection on this page, it will re-detect the NAT type and run a few more tests. After the Multiplayer Test is run, and before selecting "Continue", press and release both triggers and both
bumpers on the controller at the same time. A more advanced test will run, and a more descriptive Teredo NAT type will show (IP Restricted, Port Restricted, Sequential Port Symmetric, etc.) What Teredo detects here will give us a good idea on next steps.

 

Looks like niceguy got back to you before I could post in here! He should be able to help you out further. I look forward to seeing what you guys can hatch from this!

 

Would it be possible for you to email me at my university address so I can get some other folks in on the conversation?

 

Shoot me your email address via Live message and I'll shoot you an e-mail to continue looking into this.

 

I am running into this same problem myself (I am one of the many unhappy students) . The network details I get back after holding both bumpers and triggers is something like "network is behind a firewall (or not connected)". Has any resolution to this problem
been found?

 

@FancyDevotee340 hey hey

The only resolution is contacting IT department, only them can reconfigure they network hardware.

 

I did contact the IT folks at my university. I was told that it is a hardware compatibility issue stemming from my Xbox One console. There is nothing they can do on the network side of things. They said several students have had this issue now over the past
year, that they (the IT department) have been in contact with Microsoft engineers, and it was ultimately resolved by sending the consoles back to be replaced by units with a different hardware and/or firmware configuration. I've been trying to follow up on
this but it always seems to just confound the tech support from Microsoft.

 

@FancyDevotee340

We all have the same firmware on our consoles and the same hardware, this problem is in nature of how is NAT implemented on sites or traffic filtering. Microsoft use some special protocols to help fight with NAT and firewalls automatically, but this not
always can be done without manual configuration.

 

There is no NAT on our system. It is the same issue that is referred to by GIJoeBob in the opening of this thread. I understand what you are getting at but there is no NAT to adjust. I have already been through all of this with several people when I tried
using the regular troubleshooting channels. As I already stated, I have talked to our IT department. In a bit more detail, they said it appears to have something to do with what the xbox console does the very first time it is set up. Why replacing the console
worked for other people, I don't know. But according to them it does.

 

So I spoke again with IT this morning. In a nutshell, the console replacement apparently works only if the console has never been connected prior to setting up in our network. It has something to do with how LAN card configuration takes place in that first
contact in the context of IPv6. I was told that this is the reason restoring the console to factory defaults doesn't work - because it doesn't reset the LAN so the expectation of an IPv6 address is still there. Or something to that effect.