Hacker News Reader

Comment by misnome | Hacker News Reader

Apparently you only _need_ to forward 45000~65535: https://www.reddit.com/r/NintendoSwitch/comments/6qjhjy/i_ha...

I went through this when setting up the switch to talk to someone behind heavy NAT over the holidays. 45000+ worked for me.

....which makes this even more ridiculous if it never uses them.

View on HN

_only_? That’s, give or take, ⅓ of the full range. If everything in your network did something similar, you couldn’t have more than 3 devices in your network (and with 3, the stars would have to align for there to be no overlap between the ranges. If, for example, your tv needs 15000-35000, the largest contiguous range remaining would have about 15000 ports.

Try getting ~10 years old uplay game to work and despair. Not sure what network engine they used at the time but there is an entire set of games that basically can't connect properly without using random ports anywhere in the 10k/60k range, it's ridiculous.

And let's not ever talk about two people in the same home playing the same game together. I loved splinter cell blacklist's multiplayer but damn did it take long to get anything connected.

I'm not even sure why I mean this was with internet gaming already being the norm, I assume it's because they made games for console and then ported, and on console port issue are handled for them or whatever ? Anyway this was stupid

"And let's not ever talk about two people in the same home playing the same game together."

This is my fiance and I constantly struggling with Halo:MCC. At least once a night one of us fails to join a game, and I'm convinced it's some poor NAT punch through solution that doesn't always work.

Ever wanted to relive the past by playing Red Alert 2?

Get ready to relive the past by brushing up on the particulars of the IPX protocol...

That makes it worse. That means this is not actually a mistake in the documentation. JFC. Does it not support UPnP?

It does, these docs are for people for whom upnp has failed.

The wide port range I think is Nintendo throwing their hands in the air and not actually knowing what ports third party switch software uses

If it supports UPnP why do the docs not say: turn on UPnP? If you search for UPnP in the docs, you get exactly zero results back.

I don't think anybody here (including me) claims these are _good_ docs.

Is there any evidence that the Switch supports UPnP? Because some quick googling did not suggest it does.

My router has never seen the switch use upnp.

IMO, because they're trying to keep it simple.

Most readers of HN will understand (or at least understand the goal of) the checklist for debugging network issues.

Skipping straight to Port Forwarding eliminates any issues on whether UPnP is actually working correctly. Growing up, some of my friends had routers struggled to handle UPnP correctly. If I knew they were the only one needing port forwarding, I'd simply turn that on for them instead of trying to figure out if UPnP was actually working correctly.

> not actually knowing what ports third party switch software

more than likely i'd think this is for enabling inbound responses to outbound ephemeral ports given the port range

Even a restricted NAT should allow for this without explicit port forwarding configuration?

Unless you're doing something like active FTP where it's replying to a different port than the one the request originated from. Which would be a interesting choice for a console designed in like 2018.

It’s a firewall thing not a batting thing. You need a stateful firewall to do that kind of smart port forwarding. Which, to be fair, all consumer routers should have.

Stateless firewalls, however, need to have explicit rules for UDP traffic. So that’s what Nintendo are addressing here.

NAT functionality especially for UDP can be incredibly flaky in a lot of consumer hardware, mangling payloads, randomly dropping associations or having extremely short timeouts, and other plain buggy behaviour.

I think even their first-party games use random ports.

Probably because of this: https://duckduckgo.com/?t=ffab&q=UPnP

Among the 4 first links, 3 explicitly tell me that UPnP is dangerous.

Came here to say this. UPnP is a security vulnerability, not a feature.

Worse than forwarding all ports?

Neither is an acceptable solution.

Although I will say that if you are forwarding all ports, at least it’s to a device you know about. Not some random IoT or PC software or whatever opening up ports without your knowledge.

UPnP is significantly less dangerous than forwarding all UDP ports to a single device.

Who has UPnP enabled anymore?

My Verizon Router resets and defaults to it.

(Oh.... and it resets randomly...)

My AT&T router (Arris) doesn't even have that setting.

https://forums.att.com/conversations/att-internet-features/h...

This is made doubly frustrating by the fact that AT&T does not allow you to use your own router.

You can put your own router behind the AT&T gateway and then tell the gateway it's a DMZ.

AT&T does a lot to make me angry, but removing uPnP is the right call IMHO.

Using DMZ doesn't completely solve my problem, the AT&T gateway is still routing every packet (at less than line speed) and randomly dropping some of them.

is this maybe to get around a double NAT problem? I'm not sure how UPnP works with double NAT

UPnP is a security risk (as is forwarding all UDP ports to a single device). Nintendo should set up STUN servers so the Switch can do UDP hole punching.

How is hole punching more secure than UPnP? They both achieve exactly the same thing.

Enabling UPnP on your router enables a malicious app to permanently forward ports from the outside to the inside. The malicious app could also forward ports to other devices on your network. For example, installing a bit of malware on your laptop could set up a port forwarding rule from the internet to your NAS's web interface.

UDP hole punching via STUN requires continuous work on the part of a malicious app to keep that port open. Work that could be noticed much easier than a rogue UPnP-using bit of malware. And it can't open ports to other devices on your network.

That user has pfSense, and they are doing it wrong. I would follow the config and guidance from the pfSense dev on this one: https://forum.netgate.com/topic/112631/nintendo-switch-needs...

The most common problem I have seen over and over is double NAT or CGNAT. For the home networks I manage (my parents, in-laws, and my own), I put the ISP modems in bridge mode or passthrough mode.

The linux kernel uses 32768-60999 for ephemeral ports so you've really cut into them

Reply on news.ycombinator.com