ClearFoundation

I believe the issue is ports not domains.

Agreed, this is a uPnP problem to be exact. You cannot open the ports and forward them to 2 separate Xbox 360's at the same time, uPnP is the only way this can work.

Having read this page

2 Xbox 360's at the same time

I suspect the issue is that the uPnP implementation in ClearOS isn't quite up to the job. I believe uPnP in Linux stopped development a while ago so there's much chance of this being sorted it would seem. Unless there is another Linux uPnP project which you could add to ClearOS.

Linuxigd

It looks like someone is picking up on this recently...

igd2 for Linux

By the way I had to bypass Squid at least in the past with older versions of the Xbox dashboard (Not tried removing it) otherwise it wouldn't access the marketplace correctly. This was the case even with dansguardian disabled. Seeing as I saw little need to cache or content filter it, allowing the 360 to bypass it completely seemed fine to me.

EDIT: See post 10 to explain why Linuxigd doesn't work

Seems Miniupnpd is what you need to solve this problem...

Miniupnpd

FastLaneJB wrote:
Add this in for the Xbox 360 as a custom firewall rule and it could well fix it. I certainly had no luck with my 360 without this line with Squid enabled.

iptables -t nat -I PREROUTING -s 192.168.0.360 -p tcp --dport 80 -j ACCEPT

It'll allow the 360 to bypass Squid completely.

I had to do this to get Live and Game updates to download and install. SO i would say +1 on bypassing proxy.

FastLaneJB wrote:


Seems Miniupnpd is what you need to solve this problem...

Miniupnpd

maybe Tim B could help us out with getting this running?

I sure hope so.

Ill donate to his cause.

Interesting comment regarding linuxigd, I'd be interested to know if that was actually true - and that it does incorrectly hand out the same port to multiple devices... anyone tested to confirm?

I'll take a look at Miniupnpd thanks for the link

Tim Burgess wrote:
Interesting comment regarding linuxigd, I'd be interested to know if that was actually true - and that it does incorrectly hand out the same port to multiple devices... anyone tested to confirm?


I would test it out. But my other xbox is getting fixed by microsoft right now.

Could someone else?

Turn on logging so you can see it hand out ports in the syslog

etc/upnpd.conf

Don't forget to start the service

Out of curiosity, if both xboxes are playing the same game and there is not a random element in the ports which the xbox requires to be open, then won't both xboxes end up requesting any upnp daemon to forward the same ports. In that scecario you could either end up with upnp handing out the same port to multiple devices or just to one of them and ignoring the other one. Have I got something wrong here or is this a general problem?

Well if the guy on the thread I found is correct it should work like this...

First Xbox 360 requests it's normal standard ports via uPnP and they are opened.

Second Xbox 360 requests the same ports. The uPnP service should say those ports are in use and hence this Xbox cannot have them. So the Xbox then goes back and requests a random port instead. Assuming this isn't in use the port is opened and this Xbox 360 also then works perfectly.

However it would seem that linuxigd according to the same guy doesn't check if a port is already open, it just makes another firewall rule. So there will be a rule for the same port twice but the first 360 got its rule inserted first so all traffic for the first and second 360 will actually get forwarded to the first 360. Hence the second one ends up in a firewalled state.

I imagine this should be quite easy to test. Just need 2 computers and any uPnP capable application like a BitTorrent app. Set them both to open the same port, fire it up on one and then on the other then check iptables.

@FastLaneJB,
What you say certainly sounds like it makes sense and could be possible.

I've had a look at miniupnpd and on a first pass did not get it to work. If you want to try yourself, apart from the normal development tools, you'll need the ipdables devel package.
Then follow the instructions in the INSTALL file. I had to edit netfilter/iptables_init.sh and netfilter/iptables_removeall.sh to change my external interface to eth1. Really these scripts should be rewritten to use functions-automagic or read /etc/firewall to determine the external interface(s). The rest of the build seems to be OK.

The next problem is the init script which uses /lib/lsb/init-functions which are not implemented in ClearOS. This will need to be rewritten to use /etc/rc.d/init.d/functions instead. This should not be a desperately difficult job but I don't really have the set up to test the end result as, having moved P2P to transmission, I no longer use any software requiring uPNP. For this I've only been playing round in a VM.