Actually if your router is using UPnP then only the 1st one turned on needs 3074, the 2nd one will get another port, the details of the port selection the Xbox'es use is not listed in a doc.
thus if you want multiple Xboxes to all be open-nat then you sadly have to use UPnP. -- »Death Star Petition
Just wanted to add that if you're using pfSense and its UPnP service, you can configure it to only accept traffic from specific addresses. This way, one can use the benefits of UPnP while reducing security issues.
