Roon ARC requires today that a port of the locally installed Core is opened to the Internet, e.g. by having port forwarding configured in firewall/NAT.
Instead Roon Core should create an outbound connection to a Roon hosted server, and Streaming should be coordinated accordingly, e.g. [UDP hole punching - Wikipedia](https://UDP hole punching) .
Why?
- Easier setup, no UPnP hassle, no manual port forwarding configuration
- More secure, with the current approach of open port there is a high chance Roon will end up in the press for security flaws in the next years.
Honestly, I am pretty astonished someone (here: Roon) designed a home device (here: Roon Core) in 2022 with an open port to the internet. The next log4shell is around the corner! I will not use ARC with current design and would give strong advise not to use it all, unless the user installs (security) updates daily (I don’t at home) and does not have other critical devices on the same LAN (I do).