I have dd-wrt installed on my router. That router does NAT from 192.168.7.0/24 to a WAN IP of 192.168.100.33. Yes, I know NAT is evil, and I know double NAT is worse. However, XOHM's Ethernet home modem won't *@)$ing disable NAT and just bridge the WAN IP to the Ethernet port. Whatever. I have made my peace. I just set 192.168.100.33 to be the "DMZ" IP of the XOHM modem and this usually works well.
However, my 360 complains that NAT on my network is "strict" and I should enable UPnP. No problem; dd-wrt has this. I enable it. NAT is still "strict." Restart dd-wrt and 360; no change. UPnP discovery is working. Find ports I need to forward (3074/tcp, 3074/udp and 88/udp) to 360. Give 360 a static DHCP lease and forward said ports. Tada, 360 now says NAT is "open." Disable UPnP like paranoid-techie would want me to do. Oops, NAT is back to "strict." Reenable UPnP, life is good.
So, I learned:
* The 360 wants ports 3074/tcp, 3074/udp and 88/udp forwarded to it in Some Way.
* It also want UPnP on.