How to get Xbox Live to stop complaing about “strict NAT” with a pfSense router
https://marco.org/2008/12/15/how-to-get-xbox-live-to-stop-complaing-about-strict
It’s not a UPnP problem (although UPnP does need to be enabled), nor will any combination of port-forwards work.
Switch to Static-Port mode, and it starts working immediately with no additional firewall or NAT rules.
This took me forever to find tonight.
(Information contributed to the internet for the benefit of other people looking for it eventually.)