Thanks, Craig. I did finally get it working this morning. Unfortunately I'm not sure what I did to make it work (sigh), but the dynamic entries are now being added to the dstnat chain by UPnP and the Xbox is working fine. I didn't change any of the UPnP settings since yesterday, but the problem may ...