Help needed running Roon in a segmented network (Ubiquiti UniFi)

Roon Software Discussion Networking
1

Hi,

has anyone experience running Roon in a segemented network setup?

I have changed my home network to Ubiquiti UniFi recently and decided to create
separate networks/VLANs for my AV equipment and (among a few others) my “trusted
clients”, eg. a MacBook, an iPhone and an iPad.

I have a Roon Server VM running on a Proxmox host in the AV network (using VLAN tagging on the vNIC).
I have a hifi streaming client on the same VLAN, which works perfectly (why wouldn’t it).

I have issues with all my “trusted” mobile clients.
The roon app works on all so far and I can eg. use the app on my iPad to control what’s playing on the streaming client.
Roon Arc works reliably with no issues so far, too.

Most of the times, though, the Roon app is showing “no playback devices found”
where there at least should be a “System Output” device available.
In very few occasions when launching the app it works out of the box.
Sometimes the available audio devices appear only a few minutes after the app has been launched.
Or they disappear over night.
And other times the device is shown stuck in the “enabling” phase until it disappears again.

In the RoonServer_log.txt file I can observe unsuccessul connection attempts:

Info: [raatserver] [iPhone] connecting (attempt 1)
Warn: [raat_ll/client] [iPhone] failed to connect(0) Connection refused
Trace: [raatserver] [iPhone] client connection failed. Retrying in 500ms
[…]
Info: [raatserver] [iPhone] connecting (attempt 8)
Warn: [raat_ll/client] [iPhone] failed to connect(0) Connection refused
Trace: [raatserver] [iPhone] client connection failed. Giving up

I have firewall rules set up, allowing the Roon server to communicate with the client VLAN unrestricted (eg. any/any, IPv4 and IPv6).
The same goes for the client VLAN to the AV network (where the Roon Server VM resides) - everything should be open.
I have IPv6 ULA addresses set up for all the networks and can ping the Roon Server VM from the clients and vice versa on their IPv6 addresses.

I don’t see anything that could still be blocking communications here.

Regarding the UniFi network settings, I have enabled the mDNS proxy on the
gateway, IGMP snooping is off (to my understanding, this would only restrict
potentially unwanted multicast traffic when enabled).

I don’t see anything else that I could try.
Is anyone maybe using a similar setup and has gotten this to work?

Sebastian

1 Like
2

I had a learning curve when I started using unifi and managing the network … when you get it all right its extremely robust. These days I use AI whenever I hit an issue …this is nicely answered by Gemini (artificial intelligence beats my real stupidity). I’ll be interested to see if this helps you. Hope it does. I have slightly edited the response to remove references - you would get much the same if you googled using AI setting. The networking experts on the forum might be able to add / challenge but I thought this would not be harmful in the meanwhile,

The reason your devices intermittently fail to connect is a known architectural limitation of Roon’s RAAT protocol across asymmetric VLANs.

While you can successfully force the Roon Control app to see the server via your open firewall rules and mDNS, the Roon RAATServer (the engine responsible for managing local device outputs like “System Output”) operates independently. When you open the app on your iPad or iPhone, the Roon Core attempts to initiate a separate TCP connection back to the client device on a dynamic port to stream audio data.

Because UniFi is a stateful firewall, your “any/any” rule should technically allow this. However, the handshake fails (“Connection refused”) because your Apple clients periodically rotate or drop the ephemeral ports RAAT tries to bind to across subnets, or UniFi’s advanced wireless features drop the return packets.

To stabilize your setup and get your system outputs working reliably on your UniFi network, apply the following adjustments:

1. Fix the Wireless Multicast Settings (Most Common Culprit)

Even with firewall rules wide open, UniFi’s default Wi-Fi settings will aggressively optimize or block the asymmetric broadcast packets Roon relies on. [1]

  • Go to your UniFi Network Console → Settings → WiFi.

  • Click on the SSID used by your “Trusted Clients”.

  • Scroll down to Advanced and verify that Client Device Isolation is completely Disabled.

  • Locate Multicast and Broadcast Control (sometimes labeled “Block LAN to WLAN Multicast and Broadcast Data”) and ensure it is Disabled.

2. Turn ON IGMP Snooping

Your assumption that keeping IGMP snooping off helps is actually hurting cross-VLAN discovery. When turning on mDNS across multiple virtual networks on a UniFi Gateway, you must enable IGMP Snooping on both the AV VLAN and the Trusted Client VLAN.

  • Without it, the UniFi switch fabric struggles to map where the multicast/mDNS registration queries are coming from across the virtual boundaries, leading to the “disappearing overnight” or “stuck in enabling” symptoms you described.

  • Navigate to Settings → Networks, click on each of your respective networks, and toggle IGMP Snooping to On.

3. Deploy a Multi-Cast Relay

Because Roon officially does not support cross-subnet architectures, the built-in UniFi mDNS reflector often falls short for RAAT endpoints. The most reliable way to fix this permanently is to deploy an actual SSDP/UDP proxy. [1, 2, 3]

Since your Roon Server is already running as a VM on Proxmox, you can easily deploy a tiny helper container or utility:

  • udp-proxy-2020: This is the gold standard for UniFi/Roon split networks. You can run it on your firewall (via community scripts) or on a lightweight Proxmox LXC container that has vNIC interfaces sitting on both your Trusted VLAN and your AV VLAN. Configure it to relay UDP port 9003 (Roon discovery).
2 Likes
3

Thanks, Peter!

My Multicast settings are as suggested and I turned on IGMP snooping again - I already tried both options before without any permanent success, but I might experience a combination of factors that lead to the behavior I am seeing.

I will try and deploy a dedicated udp proxy as suggested and see if that solves the issue.

I’ll report back…

Sebastian

4

So, according to the author, udp-proxy-2020 needs to run on the firewall to work, not just anywhere.
I don’t have that option.

I added a secondary network interface connected to my “trusted clients” VLAN to the Roon Server VM and it seems to have solved the issue. I read about this solution in the past and it was stated that this causes issues with Roon ARC – so far I have only done a quick test with ARC and everything seems fine.

Having the Roon Server VM multi-homed is diluding the concept of having segmented networks a bit, but I guess it’s better than nothing.

Sebastian

5

is a concept that I have found is more trouble than help in a home network …

1 Like
6

Well, so far - aside from the Roon issue - it’s working pretty well.
And I do like the idea of keeping, e.g., my IoT devices separately.

But in some environments it might cause more trouble than in others.

1 Like