When I encountered the RPi Bridge issue mentioned in my post above (and also here Roon Bridge for ARM: a beginner’s guide to Raspberry Pi and Cubox-i), I also had all of the Roon-recommended ports allowed through my firewall (UDP 9003, TCP 9100-9200), but that was not enough. The Synology firewall had to be entirely disabled to the RPI IP address in order for Roon Bridge to connect. From this evidence combined with the OP’s issue, it looks like Roon uses more ports than I could find specified here in the forum.
@brian, can you confirm the full range of firewall ports used by Roon, including the RoonBridge service?
Thanks.