Sophos UTM and Xbox Live NAT issues

In a previous post about the Sophos UTM, I’ve received some comments about Xbox Live.

I’ve recently rebuilt my Sophos UTM and found that my backup configuration files were encrypted with a password I couldn’t locate… my bad. So I’m rebuilding all of my firewall rules again.

For the Xbox 360 Live and Kinect, there are some quirks that I hope these steps help you overcome.

1. Setup a DHCP reservation for your Xbox so that your UTM will create a network definition and the IP will remain the same.
2. Create new service definitions for each of the ports listed in the base article here
   1. Port 88 (UDP)
   2. Port 3074 (UDP and TCP)
   3. Port 53 (UDP and TCP)
   4. Port 80 (TCP)
   5. Port 1863 (TCP and UDP)
3. In my UTM, I’ve named them Xbox Live UDP 88, Xbox Live TCP & UDP 3074, etc. This helps keep your definitions clean and searchable.
4. Create a definition group and call it Xbox Live and Kinect (or whatever helps you keep organized).
5. Create a new Firewall rule
   1. Source Xbox 360 -> Services Xbox Live and Kinect -> Destination Any
6. Create a new NAT rule
   1. Rule Type: DNAT (Destination)
   2. Matching Condition
      1. For Traffic from: Any
      2. Using service: Xbox Live TCP and UDP 3074
      3. Going to: External (Address)
   3. Action
      1. Change the destination to: Xbox 360
   4. Automatic Firewall rule: Checked!
   5. Save

Save and don’t forget to turn on your Xbox 360 firewall rule before testing.

Here are some screen captures that may help show you what these all mean.