Cisco Pix Firewall in front of a Playstation 3.
If you saw this tweet, you’ll see that a little while ago I had some fun with Playstation 3 online gaming; it’s probably my own fault because I’m possibly the only person with a version 6 Cisco Pix Firewall at home in front of their playstation.
If you want to get online gaming working though your firewall there’s a really good online reference here and my specific grumble about having to open up a shed load of ports for EA’s Burnout paradise is documented in their support area.
To summarize, this is what I’ve got open:
General Playstation Network Ports, these always need to be open.
udp 3658
udp 3478-3479
Open these extra ones for Motor Storm
udp 3659 – 3660
Open these extra ones for Burnout
udp 3659
udp 9600-9699
If you to have a cisco pix, you’ll need to open an entry on your outside access-list, something like
access-list outside permit udp any any eq 3658
and you’ll need a static entry….
static (inside,outside) udp interface 3658 playstation3 3658 netmask 255.255.255.255
For lots of ports the access-list command supports the range statement, so
access-list outside permit udp any any range 9600 9699
But you won’t be so lucky with statics, you’ll have to add an entry for each port, I created a small bash shell script to automate the task…
#!/bin/bash
#9600-9699
for i in `seq 9600 9699`;
do
echo "static (inside,outside) udp interface $i playstation3 $i netmask 255.255.255.255"
done
I then pasted the output into my pix. If you are having problems here are some references that might be useful are the cisco pix command ref and the pix nat guide.
Will a firewall in front of your ps3 prevent me from getting my mac address banned?
If it makes you feel any better, I’m probably the only one with a Cisco 2620 as my firewall.
HI I have a 1841 and am in the middle of doing the access lists for my sons PS3 nightmare!
Can you let me see how you configured your acess lists to be able to use the PS3 to connect to PSN.
My son is driving me crazy with this…I thought i new what I was doing…Wrong.
The ASA is easier than striaght ACL’s, but a good learning curve.
Regards,
David
Hi David,
On a router the ACL on your “outside” interface should look something like this…
ip access-list extended outside
permit icmp any any
permit udp any eq bootps any eq bootpc
permit udp any any eq 3658
permit udp any any eq 3659
permit udp any any range 3478 3479
permit udp any any range 3659 3660
permit udp any any range 9600 9699
deny ip any any log
You also need a nat command for each port…
ip nat inside source static udp PS3 3658 interface FastEthernet0/1 3658
Good Luck!
THanks Nick,
I will try this tonight.
Sorry for the next stupid question …
This is applied inbound on the external interface???
Appreciate this,
David
yep, inbound on ext interface
cheers,
Nick
you are not alone
I have a asa 5505 in front of my ps3