NAT=Strict/Moderate/Open

2) Yes, that is correct. Even though only one system would be used at a time, you would have to go to the U-Verse gateway every time and redirect the ports to the other XBox. That's probably impractical, thus a UPnP router would be recommended.

1) The labels for NAT types of "Strict", "Moderate", and "Open" are terms invented by Microsoft and used by other gaming console manufacturers like Sony for the PS3/PS4. They are not official or defined networking terms, and thus do not appear in any router configuration. However, they do have specific meaning. They refer to how the security algorithm that the network address translation (NAT) code that is running inside the router treats incoming packets.

In a NAT router, the router must keep track of the "endpoints" of all conversations so that packets can be routed to the correct host. An "endpoint" is the combination of an IP address, a protocol (TCP or UDP), and a port number. The router uses this memorized information about each conversation to route packets.

Let's look at an example. Let's have an internal network of 192.168.1.0/24, and an outside IP address of 99.99.99.99. Let's say there are two hosts on the inside network, 192.168.1.10 and 192.168.1.20, and they both want to bring up the www.google.com web page.

Host #1 at 192.168.1.10 sends a packet to www.google.com, a TCP packet, with a source port of 10000, and a target of www.google.com with a destination port of 80 (HTTP). The router memorizes these two endpoints as conversation A:

Conversation A: 192.168.1.10:10000 -> www.google.com:80.

The router also chooses a port that it will use for this conversation on the outside IP address, let's say it chooses 30000. The memorized NAT entry now looks like this:

Conversation A: 192.168.1.10:10000 -> NAT to 99.99.99.99:30000 -> www.google.com:80.

Google's web site answers the web request, and sends back a packet to 99.99.99.99:30000. The router recognizes that incoming packet based on the port (30000), and uses the table entry above to translate the target IP address and port to 192.168.1.10:10000 and send the return packet to the correct host.

Now let's say that host #2 at 192.168.1.20 also needs to talk to www.google.com, and also happens to choose a source port of 10000.  The router makes a new NAT entry that looks like this:

Conversation B: 192.168.1.20:10000 -> NAT to 99.99.99.99:30001 -> www.google.com:80.

Return packets from Google will come to port 30001, which is enough for the router to differentiate this packet from the other conversation (conversation A).  The router will uses the NAT table entry to change the destination endpoint on the return packet to 192.168.1.20:10000 and send the packet to host #2.

Now, the question is, is there a security problem that would allow some malicious attacker to exploit these memorized conversation entries?  It turns out that different routers use different algorithms to handle incoming packets.

Security consideration X: Suppose that Conversation A has been memorized by the router, and I try to talk to host #1 from a different IP address.  Supposed I send a TCP packet to 99.99.99.99:30000 from my endpoint, 101.101.101.101:80 (same source port, but different source IP address).  Will the router let my packet through, even though it thinks that the conversation is supposed to be talking to Google?

Security consideration Y: Suppose I go further, and send a TCP packet to 99.99.99.99:30000 from endpoint 101.101.101.101:40000 (different source port AND different source IP address).  Will the router let this packet through?

The way the router handles these return packets based on the memorized conversation entry is very important to console gameplay, because the data streams for playing the game are mostly peer-to-peer, and everyone is behind a NAT router.  Each console has to communicate with the others, and there is no good way to open ports automatically for inbound traffic (exception: UPnP, but many routers do not have this).

Microsoft decided to label the different ways that the NAT routing code can handle these packets as follows:

If the router will allow inbound packets to a memorized conversation from any source port and any source IP address (i.e. In security consideration Y, the router routes the packet), then the NAT type is labeled as "Open".

If the router will allow inbound packets to a memorized conversation from any source IP address, but the source port must match (i.e. in security consideration X, the router routes the packet, but in security consideration Y, the router drops the packet), then the NAT type is labeled as "Moderate".

If the router drops any inbound packet that doesn't precisely match both the source port and source IP addrress (i.e. in both security consideration X and Y, the router drops the packet), then the NAT type is labeled as "Strict".

Since the NAT type is a function of the routing and NAT code, it is generally not a behavior that can be altered for any particular router.  The only way to create the equivalent of an "Open" type on a router whose native code presents a "Moderate" or "Strict" NAT type is to manually open ports on the router for inbound traffic, and direct those ports to the XBox (or other console).

Most consumer NAT routers, including the 2Wire/Pace and Motorola units that AT&T uses for U-Verse service all have NAT/routing code that results in a "Moderate" NAT type.  Opening ports will work on these routers for one console.  For more than one console, a UPnP router set up behind the U-Verse router is required.

Some business-class and enterprise routers have code that results in a "Moderate" NAT, but many, including the Cisco IOS, result in a "Strict" NAT type.