Fix natpmp port-forwarding
It was working great for years (natpmpc), but yesterday (2026 oct 24) it started failing. I'm not using any apps so I couldn't find a better place to report this issue, because your articles only describe how to report issues using apps. I only use wg config files. Here's what I started getting in my logs yesterday:
Sat Oct 24 13:15:39
Port 1 unchanged: 58795
Port 2 unchanged: 45523
Port 3 unchanged: 41055
Sat Oct 24 13:16:24
Port 1 unchanged: 58795
Port 2 unchanged: 45523
Port 3 unchanged: 41055
Sat Oct 24 13:17:10
Could not extract port 0 (tcp rc=1 udp rc=1)
--- tcp output (stdout+stderr) ---
readnatpmpresponseorretry() failed : the gateway does not support nat-pmp
errno=11 'Resource temporarily unavailable'
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
--- udp output (stdout+stderr) ---
readnatpmpresponseorretry() failed : the gateway does not support nat-pmp
errno=11 'Resource temporarily unavailable'
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
Could not extract port 1 (tcp rc=1 udp rc=1)
--- tcp output (stdout+stderr) ---
readnatpmpresponseorretry() failed : the gateway does not support nat-pmp
errno=11 'Resource temporarily unavailable'
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
--- udp output (stdout+stderr) ---
readnatpmpresponseorretry() failed : the gateway does not support nat-pmp
errno=11 'Resource temporarily unavailable'
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
Could not extract port 2 (tcp rc=1 udp rc=1)
--- tcp output (stdout+stderr) ---
readnatpmpresponseorretry() failed : the gateway does not support nat-pmp
errno=11 'Resource temporarily unavailable'
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
--- udp output (stdout+stderr) ---
readnatpmpresponseorretry() failed : the gateway does not support nat-pmp
errno=11 'Resource temporarily unavailable'
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
Sat Oct 24 13:30:41
Port 1 updated: 55335
Port 2 updated: 64250
Port 3 updated: 64713
Sat Oct 24 13:31:27
Port 1 unchanged: 55335
Port 2 unchanged: 64250
Port 3 unchanged: 64713
Here's how I'm calling it:
#!/usr/bin/env bash
# natpmp_port_forward.sh
# Keep NAT-PMP mappings alive with native natpmpc on Gentoo/OpenRC.
set -u
GATEWAY="10.2.0.1"
NUM_PORTS=3
TIMEOUT=60
PORT_FILE_PREFIX="/home/ivxvm/.vpn_port_"
PROBE_INTERVAL=45
START_PORT=30000
echo "Starting NAT-PMP probe: gateway=$GATEWAY mappings=$NUM_PORTS timeout=$TIMEOUT"
while true; do
date '+%a %b %d %H:%M:%S'
for i in $(seq 0 $((NUM_PORTS - 1))); do
MAP_INDEX=$i
INTERNAL_PORT=$((START_PORT + i))
FILE_INDEX=$((i + 1))
OUT_TCP=$(natpmpc -a 1 "$INTERNAL_PORT" tcp "$TIMEOUT" -g "$GATEWAY" 2>&1); OUT_TCP_RC=$?
OUT_UDP=$(natpmpc -a 1 "$INTERNAL_PORT" udp "$TIMEOUT" -g "$GATEWAY" 2>&1); OUT_UDP_RC=$?
COMBINED_OUTPUT="$OUT_TCP"$'\n'"$OUT_UDP"
PORT=$(printf '%s\n' "$COMBINED_OUTPUT" | awk '/Mapped public port/ { port = $4 } END { print port }')
PORT_FILE="${PORT_FILE_PREFIX}${FILE_INDEX}"
if [[ -n "$PORT" ]]; then
PREV="$(cat "$PORT_FILE" 2>/dev/null || true)"
if [[ "$PORT" != "$PREV" ]]; then
printf '%s\n' "$PORT" > "$PORT_FILE"
echo "Port ${FILE_INDEX} updated: $PORT"
else
echo "Port ${FILE_INDEX} unchanged: $PORT"
fi
else
echo "Could not extract port $MAP_INDEX (tcp rc=$OUT_TCP_RC udp rc=$OUT_UDP_RC)"
echo "--- tcp output (stdout+stderr) ---"
printf '%s\n' "$OUT_TCP" | head -n10
echo "--- udp output (stdout+stderr) ---"
printf '%s\n' "$OUT_UDP" | head -n10
fi
done
sleep "$PROBE_INTERVAL"
done
1
vote