· I use my ISP's router alongside a personal router.
ARC Status
· ARC is *Not Ready*
Roon Error Code
· None of these are listed. It simply says "TIMEDOUT" or similar.
System or third-party *firewalls *or *antivirus software* can sometimes block RoonServer from reaching ARC.
· Try adding RoonServer and its associated processes to the whitelist of any firewalls or antivirus software you have installed, including the Windows system firewall, if applicable. [You can learn more about firewall exceptions with Roon here.](https://help.roonlabs.com/portal/en/kb/articles/firewall)
Has the status in Roon -> Settings -> ARC changed after adding exceptions in your firewalls and antivirus software for Roon? ARC is still *Not Ready*
Don't give up yet.
· I'm stuck. I'd like to create a post to ask Roon Community for help.
Describe the issue
Can't solve the double NAT issue. Not with UPnP, Firewall, Port Mapping or anything. Tailscale seems to work, but not when I use another VPN service as well. Not prepared to use Tailscale VPN instead.
Describe your network setup
MacOS on Fritz!Box router (no bridge mode possible) and Unifi network. Running either NordVPN or Proton VPN
This sounds like your ISP is using CG-NAT. If so there is nothing you can do with your local network to resolve the double NAT issue.
If you post a copy of the Roon ARC diagnostic text we might be able to be more sure.
Whilst CG-NAT is being used, your only option is Tailscale. You may be able to ask your ISP to give you an IP address that supports port forwarding (and thus does not have CG-NAT associated with it).
As @Wade_Oram mentioned, the symptom indicates that the second layer of network address translation is above the level of your account in the form of carrier-grade NAT. If you search around Roon Community for the name of your internet service provider, you’ll likely find other users who have encountered a similar situation.
There are generally two options when your local network sits behind CG-NAT from your ISP.
First, you can reach out to the provider directly and inquire if a dedicated external address is available for your account. Sometimes, this will incur an additional one-time or monthly fee.
Otherwise, you’ll need to turn to a VPN for NAT traversal. We recommend Tailscale because it’s a proxy-mesh based on Wireguard and very secure. NAT traversal is generally only available on the paid plans for consumer VPNs like NordVPN or Proton.
Given these limitations, we do strongly recommend Tailscale. Is there a particular reason you’re hesitant to install it?
We’ll watch for your reply and we’re happy to assist either way. Thank you.
Thank you. Have checked and my ISP is not very willing to help. Regardless, all systems are behind VPN and I would not want to switch to a VPN provider based in a 5 Eyes country. So Tailscale is not an option. I already have paid accounts with Nord and Proton and will check for the NAT traversal. It would be great if you could point me to examples of how that has worked on other VPN services.
Thanks for checking with your ISP, and I understand the hesitation around jurisdiction. Let me set expectations honestly, because the news on the consumer-VPN front isn’t great for ARC specifically.
The core problem is that ARC needs a stable, inbound port that you enter under Settings → ARC and that stays put. Consumer VPNs are built to mask your outbound traffic, not to expose an inbound service, so port forwarding is either unavailable or a poor fit:
NordVPN doesn't offer port forwarding on its standard servers at all. The only exception is their separate Dedicated Server add-on, which isn't something ARC is designed around. So there's no working path here with a normal Nord subscription.
Proton VPN does support port forwarding, but only on its P2P servers and only via NAT-PMP, which hands out a random external port on a 60-second lease that has to be continually renewed. Because ARC expects one fixed port you set manually, a rotating port isn't something it can track, you'd be re-entering the port constantly. Proton also notes port forwarding isn't compatible with moderate/NAT type 2, which is likely what your Fritz!Box + UniFi setup produces. So while it technically exists, there's no reliable way to run ARC over it.
That's the reason we keep pointing people to a mesh/overlay approach, it's really the only category that solves NAT traversal cleanly.
On the Tailscale hesitation specifically, one clarification that may help: Tailscale isn’t a privacy VPN and wouldn’t replace Nord or Proton. It’s split-tunnel by default, so it only carries traffic to your own devices, everything else still goes out through your existing VPN. The ARC connection itself is end-to-end encrypted WireGuard directly between your phone and your Roon Server; Tailscale’s coordination server only brokers the keys and never sees your audio traffic. So the jurisdictional exposure is much narrower than it first appears.
If you’d still rather avoid it entirely, the same mesh concept is available from providers/tools outside the 5-Eyes framing or fully self-hosted, for example self-hosting WireGuard on a small VPS with a public IP (as a reverse tunnel back to your Roon Server), or overlay networks like NetBird or ZeroTier. These achieve the same NAT traversal without a US-based coordinator. Fair warning: these are more hands-on to configure and aren’t something we document or officially support, so you’d be on your own for setup, but conceptually they’re the same route as Tailscale.