Axiom Home Page Forums General Discussion Technical Questions router settings NAT/ upnp

Question- I recently hooked up my denon 3808 to my router (linksys wireless 54g). I saved my configuration settings from my denon before I did the firmware upgrade. Due to the reccomendations from denon I have disabled Upnp for my router.

I am not sure if this is related but when upnp was enabled with my denon I would constantly have to go back to my computer and restart my media server every time I powered on my denon. Now I just power on the denon and can start streaming flac files from the get go.

However, on my xbox 360 when I check my network status under NAT it says 'moderate', when it use to say 'open'. some games seem to be harder to find an acceptable online match now... and when I tried to play halo it gave me a message that "matchmaking may be slow due to router settings" please configure your router so that the NAT is set to open.

So basically my xbox 360 wants upnp enabled and NAT set to open, while my denon wants to have upnp disabled....

What should i do!?

Heh, well, do you love Denon or Microsoft more?

I would switch upnp back on and run some tests to see if you still run into the same media server reboot issues. If not maybe they can just play nice together with upnp; if you do, then I would consult Denon and deal with crappy gaming while you wait to see how important it is or if there is a workaround.

I am trying to think why Denon would want stricter settings; they can't really be that worried about security issues...although it would be pretty funny if I could hack into your receiver and start streaming any embarassing flacs I come across

Please keep me updated as to what happens because I am basically following behind in my setup process with a denon 3808 and a HTPC!

Greg

Thanks for the input. Yah when I get a chance I will change my upnp back to enabled and see if that causes problems with my TVersity media server... I don't see why it would, but all I know is that for some reason I use to have to restart my media server every time I turned on my denon- otherwise it would show up as "TVersity media server- (access not allowed)" on my denon gui.

and it does not do that anymore- probably changed about the time I switched my router settings to upnp disabled as per denons comments about going through the firmware upgrade.

I could care less about that message in halo3- I really don't play that much- but It seems that I am having a hard time finding games in rainbow six vegas2 with an acceptable ping and it seems to give me an 'unable to connect to host' error more often

You should check what ports the xbox is using and then open them in your router.
This is normally done under something called virtual server in your routers web interface.
If you check your manual this is mostly quite easy to do.

Many routers have an option to open up NAT for one single device while forcing NAT for any other devices.

NAT is good to have running because it goes a long way to help protect the computers behind your router by giving them a 'fake' local IP address that is generally not discoverable to others out on the Internet. This is the part that often messes up gaming systems that like to have a real internet based IP.

I'm betting that your router will allow you to assign a real internet address to the 360 box and you can leave the rest behind NAT. You will need to be able to identify what the MAC address on your 360 is. I don't have a 360 but it probably tells you this info somewhere in its network setup screens.

UPnP is usually your safest bet but if you can turn NAT off altogether for the 360 then that takes it out of the picture altogether. It leaves your 360 more exposed to the internet but it doesn't really need to be protected as much as your PC.

yah- I can view my MAC adress for my 360 from the dashboard. I will go into my router settings and see if I can't figure out how to upen the nat and enable upnp for the xbox.

So you would reccomend that I leave the nat closed and upnp diabled for all other ports/devices?

UPnP is not truly required for anything, as far as I know. It's purpose is to simplify the process of adding new devices in your network. When it works, it works nicely and everything becomes Plug and Play. That being said, if you are comfortable enough to set things up in NAT yourself, then you don't really need the help of UPnP.

I'm not an expert on UPnP so hopefully a better educated person will confirm this.

Your best choices for the xbox, considering you are experiencing issues with the current config is probably.

Open NAT. That requires some knowledge to set up but I Googled and this article should get you started.
OPening up NAT on XBOX
This leaves you more exposed than Closed NAT(only for the device you set it up on) but should work better.

If you still experience problems. Go into your router and see if you can set it up to allow for a single MAC address to pass through without any Network Address Translation at all. In other words, Your XBOX will get true IP address from your Internet ISP instead of an internal one from your router and essentially, it kind of bypasses your router altogether. ((Note: By 'bypassing', you are also totally bypassing all the routers security for that single device, but I don't believe that is as serious a concern on a gaming system, as it is on say a PC))

To do this you need to understand how your ISP assigns addresses, do they dish em out via the most common method using DHCP, do they recommend using upnp, and will they allow you to use up more than one internet IP per customer (you are already using one on your router.) Also, do they demand you authenticate with PPPoE (yet another protocol).

As you can see, it can get very confusing. If you can manage to configure your router to do open NAT for the 360, you can ignore the above questions, which is why it may be the best solution.

As for your last question. There is normally nothing wrong with leaving upnp enabled for everything else unless it causes problems, like on the Denon. If you can't turn it off for just the Denon, then sure, just disable it altogether. It adds no benefit except for simplifying putting new gear on a network and you already seem to know enough to be able to do that without it's help.

Also, upnp used to open up some security flaws due to the way it simplifies things. A serious vulnerability when playing an infected Flash file is one I can think of, but that may have been patched by now. I usually recommend it for less technical people as it normally solves more connection problems than it creates.

I did a quick check on my router settings during lunch- I see the option to completely disable or enable upnp for all devices at once- it is currently set to disabled. Would that cause my NAT to say 'moderate' on my xbox 360 or is there some other culprit?


I saw something in the config. for 'port bypass'- I think I can set up my 360 to bypass all of the 'routing' this way, but I don't think I could enter the mac address anywhere, just port #'s

I think at this point I just need to find my manual and consult it for further advice...

Of course Everything is working pretty much ok right now so I hate to change too much stuff around. My approach to network configuration is a trial and error 'brute force' method... eventually I get it right

Your correct. If it's working, why change it.

I'm unfamiliar with what "moderate" means on an xbox. I wish I had one!

Port bypassing is something completely different than bypassing the NAT feature. If things are working, you don't need to to make any changes there. If you want a further explanation of how ports work, I have a great diagram at home from a course I taught that I could post. Basically though, it is not relevant for you at this time.

I have no idea what a moderate NAT means either- I just know it use to say 'open', and now it says 'moderate'- and I have received the messages about my NAT settings in Halo that I mentioned above.

I think I will look around xbox.com/support and my router manual and see how to get it to say 'open' again on my xbox. The only thing I can think of that I had changed is that I disabled the UPnP- I might just turn that back on and see if my xbox changes to 'open'- I will also see if my media server messes up with my denon.

Thanks for all of the input though!

Moderate in my world just means that you are using less strict port blocking rules. In other words, you are using NAT, blocking some ports but not strictly restricting it to just web, email and such.

I suspect, but don't know for sure that it is simply doing as you have guessed. Letting you know that UPnP is turned off. It probably now considers the system as "moderate" because UPnP used to make it 'virtually' open. I say "virtually" because UPnP just kind of tricks thing out into working like it's open because it automatically connects everything as needed.

Unless you are having trouble connecting in your games, I wouldn't bother turning UPnP back on just to change the status back to Open. If it does help you to connect or connect faster for games, then I guess you have to make a choice. Denon issues or game issues.

Or invest in a router that allows you to bypass NAT altogether for a single device, as mentioned before. You will want to check with a knowledgeable friend on the same ISP to make sure that will work though. Good odds, it will.

I will look for my drawings of how IPs, NAT and ports work tonight. If nothing else, it will help you understand all those options in the XBOX network configuration screens. It can be very intimidating.

I am pretty good with computers/ect. but networking always seems to give me slight problems...Any drawings/ect. you have would most likely be helpful.

MY router (linksys WRT54G) may have the option to bypass NAT for specific device but I will have to check into it.
Thanks again for all of the input!

Sorry This took longer than I promised. I found the file but it was in an unusual format. I normally use Visio but I was experimenting with some freeware called "Dia" at the time. It took me a bit to remember what the extension stood for and re-download the program.

Pretty nice program for freeware too, I might add. Does great network diagrams and has tons of symbols including the Cisco ones, electrical, civil etc..

Anyways, here is the pic I was referring to that might help provide a visual reference for what i was talking about.

The Red connections are where the home PCs are directly connected through the modem to to thier ISP. They get an actual Internet based IP address and are more or less part of the Internet cloud with very little protection between them and the rest of the world (unless yuo add your own.)

The Blue connections represent home networks where the modem has one single direct connection to the Internet but everything behind it is on a separate local network using 'fake' IP numbers that are not part of the allowable range for true I'net use.

The router translates the local IPs on the home side into the one proper address facing the ISP. This helps to protect the home network because the PCs are not using IP numbers that can be seen out in the big bad Internet world. The MODEM/Router won't allow anything to be translated back through to the local (blue) side unless it is traffic that the blue side requested to get in the first place.

House C shows a couple of PCs protected by a modem using NAS but the modem is also set up to allow 1 PC to have it's own direct connection. This PC might experience less trouble playing games that sometimes get confused by NAS but it is much greater danger of being hacked or infected with viruses because it is exposed out in the wide open internet world.

It also becomes obvious that ISPs often prefer you to use NAS because it doesn't use up nearly as many of their priceless Internet addresses. The world is actually running out of these usable IP addresses as each one must be unique.

Hi Murph:
This is very nice representation. A question to add to this mix.

I have Household B scenario. I have the DSL modem , connected to a linksys 4 port router with wireless. To the router i connect a 8 port switch (wired through one port on router). The switch feeds to 5 rooms in the house and 2 ports on it are connected to a printer and SAN box(Netgear SC101).

With this config, my PCs cannot see the SAN..not sure why.
But when i move the SAN directly to the linksys router, i can see it in all other rooms.

Is the switch not able to give proper IP address to SAN?

Also what media servers are being used to stream to PS3?

Any insight is appreciated.

Regs,
Avi

Well, that's a question with a lot of possible answers. Here is a couple of things you could check. - A basic switch should not interfere with the drive unit talking to the router, but you have proved that somehow it does. So we will concentrate on that for now.

Your router should be the only DHCP server dishing out addresses to all your LAN devices, even if they are behind the switch. The switch, (unless its something a bit more complex) normally does not assign IP addresses. A basic switch's job is make sure that busy devices on one port don't bog down all the other devices on other ports and, of course, to give you more places to plug things into.

Based on that, here are some thoughts.

- Extremely unlikely, but could your switch actually be another router and not a switch? This would actually create yet another network segment and the SC101 stuff I read on their web page says that it will not easily work on a separate segment. Not likely the case. They may look similar but routers usually require more initial setup than a switch. Most switches are auto-sensing, plug and play jobies these days.

- Again a simple question, but have you tried different ports on the switch. Two reasons.
First is that it is not uncommon for a single port on a switch to go bad and just stop working. Sometimes this can be resolved, other times they just physically die.

Secondly, it may have one port (usually the first or last) that can be set up as the 'Uplink' port. That's the port that would normally connect up towards your router. Some switches do not allow you to use an uplink port as a regular port without making some config changes.

- Is your switch 'auto-sensing'? More complex or older switches required you to manually config each port for use. This is not likely a concern as all but really old consumer switches are usually fully automatic in this sense.

-- Sometimes the data tables in a switch get fouled up, specifically something called an ARP table. You may be able to go in and clear this table so it will rebuild itself from scratch. However, I bet you have already done this in a more simple manner by powering the switch down and turning it on again.

-- I read on the Netgear web sight that the SC101 is very sensitive to having all the important network devices turned on in a very specific pattern. Here is the link to the troubleshooting page where I read this.

NetGear SC101 TS Guide

I find it odd that it says you MUST turn on the SC101 before turning on the modem and router. Normally.....You want the DHCP server (the router in this case) to be turned on first. That is because most client devices like to send out the DHCP request (Hey! Can anyone out there give me an IP address?????) as soon the device is turned on. Many, only try once and then give up.

Obviously this one keeps repeating its request until it gets one. But why should it be turned on first? This part scares me a bit but then again, home-consumer devices are not my speciality so this could be more normal than I think.

It is very specific in it's instructions on the way to power things up though, so it might be something to try.

-- Documentation also says it doesn't talk well through a router (two different networks). All of your devices are on the same side of the router so the switch shouldn't make a difference in this manner. It still should all be the same network. It does make me wonder if maybe the switch is trying to do something a bit more fancy with the different physical segments it creates.

If you give me the make and model, we might be able to at least rule that out.

I have some other ideas but they would take longer to explain and I'm all out of my sandwich and chocolate milk so I'll let you make some confirmations on those things then maybe we can narrow it down further.

I also saw mixed up in the Netgear help files a way to connect to the storage device and confirm if and what IP it actually received. It's a command line interface so it's not user friendly. I wouldn't play around with it there unless you are fairly confident with the steps it lays out.

Hopefully this helps get you started. Sometimes these networked storage devices can be very cantankerous. You might find it's just easier to keep it plugged in directly to the router.

BTW, it's a NAS, not a SAN. Picky, I know, but I'm researching SANs right now. They seem to be starting out at around $20K...

Ha! I got all grumpy, searching my post to see where I might have accidentally typed "SAN". I even did a [Find] and then discovered that it was in the post above mine. I'll calm down now. LOL!!!

I'll bet ya that it was a case of his auto-correct feature changing words after he typed them. Sometimes I hate that thing.

Sorry, Murph, I should have been more specific!

I agree with your assessment--I suspect that switch is actually doing routing.