If you have unbalanced connections you can modify the section of the script that defines how the traffic is balanced.

This script assumes that you have 2 equal WAN connections(ex. I just tested with my son's XboxOne, tested NAT and it said moderate, then only enabled DST NAT to the XboxOne IP for both protocols TCP and UDP destination port 3074, now NAT says Open.Add chain=prerouting dst-address=111.111.111.0/24 action=accept in-interface=LANДЄdd chain=prerouting dst-address=222.222.222.0/24 action=accept in-interface=LANДЄdd chain=prerouting in-interface=ISP1 connection-mark=no-mark action=mark-connection new-connection-mark=ISP1_connДЄdd chain=prerouting in-interface=ISP2 connection-mark=no-mark action=mark-connection new-connection-mark=ISP2_connДЄdd chain=prerouting in-interface=LAN connection-mark=no-mark dst-address-type=!local per-connection-classifier=both-addresses:2/0 action=mark-connection new-connection-mark=ISP1_connДЄdd chain=prerouting in-interface=LAN connection-mark=no-mark dst-address-type=!local per-connection-classifier=both-addresses:2/1 action=mark-connection new-connection-mark=ISP2_connДЄdd chain=prerouting connection-mark=ISP1_conn in-interface=LAN action=mark-routing new-routing-mark=to_ISP1ДЄdd chain=prerouting connection-mark=ISP2_conn in-interface=LAN action=mark-routing new-routing-mark=to_ISP2ДЄdd chain=output connection-mark=ISP1_conn action=mark-routing new-routing-mark=to_ISP1ДЄdd chain=output connection-mark=ISP2_conn action=mark-routing new-routing-mark=to_ISP2ДЄdd dst-address=0.0.0.0/0 gateway=111.111.111.1 routing-mark=to_ISP1 check-gateway=pingДЄdd dst-address=0.0.0.0/0 gateway=222.222.222.1 routing-mark=to_ISP2 check-gateway=pingДЄdd dst-address=0.0.0.0/0 gateway=111.111.111.1 distance=1 check-gateway=pingДЄdd dst-address=0.0.0.0/0 gateway=222.222.222.1 distance=2 check-gateway=pingДЄdd chain=srcnat out-interface=ISP1 action=masqueradeДЄdd chain=srcnat out-interface=ISP2 action=masquerade Not a gamer myself, but I reckon the description of the ports to opened as listed on that URL is confusing, they are not explaining which direction these ports needs to be opened, and I suspect that 99% of these ports listed are required for outgoing should you have configured firewall as a 'statefull' firewall, which default config does. Port 3074 (UDP and TCP) (I assigned this port manually) xbox-live, the following ports should be open:

I have been trying to resolve this issue for the past 15 days, reading through forums but no luck at allДЄs you may know, in order for XBOX to work properly, it needs an Open NAT - so far it is only StrictДЄccording to the Microsoft XBOX's website. Regarding your UPnP rules look good but when it comes to Xbox and Mikrotik my experience is that sometimes it works and sometimes it does notДЄnd last I did all this during a online meeting so please read trough as I might have made mistakes :-)Д¬ould you please clarify what you mean by 'ote that these rules has to be above drop rules so you will have to move them after them being added.'? For example UDP 500 is used for some VPN tunnel and so on. Note that these rules has to be above drop rules so you will have to move them after them being added.ДЄlso note that if you want to use any of these ports in the future this NAT rule will break that. Now I'm not sure about this but here are the rules:ДЄdd action=accept chain=input dst-port=3074 in-interface=ether1 protocol=tcpДЄdd action=accept chain=input dst-port=88,500,3074,3544,4500,5730-5731,5739 in-interface=ether1 protocol=udpДЄdd action=accept chain=forward dst-port=3074 in-interface=ether1 protocol=tcpДЄdd action=accept chain=forward dst-port=88,500,3074,3544,4500,5730-5731,5739 in-interface=ether1 protocol=udp

I think you need rules in both input and forward. So now comes the point I'm unsure of but I think you need firewall rules as well. This will take all inbound traffic to the router on these ports and dest-nat (port forward) to IP 192.168.88.246 which I assume is the Xbox

Mikrotik routeros forums