double nat on console home internet

dispatcher21 wrote:

What firmware are you running on your can?  I have 1609 and have open NAT with my xbox.

Misleading status.  UPnP may be negotiating the forwarding rules so the console "thinks" you have open NAT... but as mentioned earlier, the XLAT464/CGNAT approach breaks the ability to forward ports from the internet to your local network... by design.  It was well documented in the RFC on it like a decade ago.

The same thing happens with PS4 when you set up a router in front of their modem--it negotiates and opens ports locally on your router and appears legit and all... but the higher TMO layers muck things up when the game NEEDS the UDP packets forwarded properly.

Because there is no initial outbound stateful inspection/logging that unsolicited inbound traffic gets filtered/blocked at the upper layers.

In the past some routers were found to track outbound UDP to get around some things in a way to bypass  the need for port forwarding to some degree (like we saw back in the day with the Destiny franchise on some WRT routers)... but highly doubt that will work here (there Nokia device appears very limited feature wise).

Regardless of how our/their routers/modems function  though, it still gets broken at a higher layer.

Again, because of how their XLAT464/CGNAT style setup works (or should I say, DOESN'T work).

Yeah, whatever.  I have 1609 and I have an open NAT and all chat functions work properly. Does it matter how the firmware fixed it?  Nope, just that it works.  

Run a scan for ports that are supposed to be open.

BY DESIGN their XLAT464 approach BREAKS this functionality.

https://datatracker.ietf.org/doc/html/rfc6877

From the introduction:

 This document describes an IPv4-over-IPv6 solution as one of the techniques for IPv4 service extension and encouragement of IPv6 deployment. 464XLAT is not a one-for-one replacement of full IPv4 functionality. The 464XLAT architecture only supports IPv4 in the client-server model, where the server has a global IPv4 address. This means it is not fit for IPv4 peer-to-peer communication or inbound IPv4 connections. 464XLAT builds on IPv6 transport and includes full any-to-any IPv6 communication.

So long as an application in question is reliant on unsolicited inbound v4 connections, their dual stack solution BREAKS THEM BY DESIGN, because they have yet to take proper measures to guard against it.

For example, I just set things up locally... even dropped some security to allow pings and whatnot, and this is the result I got testing to the first one of the UPnP requested ports for my PS4:

Port 9308 does not appear to be open.

Even connecting the PS4 directly via ethernet fails.

When running through my router, nothing registers as an attempt being made.  Not even a basic ping attempt registers.

TMO's topology clamps down on things before the packets reach this layer. 

My PS4 THINKS  I am on  NAT-2, because UPnP is negotiating the rule to open the port... but when something tries to actually get through directly on that port, it fails.  Because their topology does not support such inbound communication.

Only ways known so far to get around this is via a separate tunnel that allows such p2p traffic (like a GVPN and such), actual functional v6 delegation instead of relying on v4, or for the application in question to instead use a stateful v4 connection type like the typical more dedicated TCP server connections.

But the more direct UDP and other P2P models a lot of games have started integrating (and that consoles actually use in the background), it breaks certain functionality.

My NAT type is always moderate. No matter what and I am for sure double NAT'd.  But everything works for me. I'm plugged Ethernet into my Linksys which is hooked to the Nokia trash can router 

JayBo wrote:

My NAT type is always moderate. No matter what and I am for sure double NAT'd.  But everything works for me. I'm plugged Ethernet into my Linksys which is hooked to the Nokia trash can router 

Is the speeds slower when connecting to another modem/router and using that router also are you using the arch modem