Locking down ARC to one external ip

[TimW (Tim Wombwell)]

Roon Core Machine

QNAP 473 AMD RX421ND 64 Gig RAM OS QTS 5.0.1.2248

Networking Gear & Setup Details

Cisco CBS 250 switches Fortiwifi 60E router/Firewall
Ethernet not WiFi No VPN

Connected Audio Devices

All using ethernet. QUAD 22/II using HiFiBerry, Marantz/Yamaha amps

Number of Tracks in Library

170,000

Description of Issue

No problem setting up ARC but I want to lock the firewall down to a specific source ip. The source ip shown in the Foriwifi log is 148.252.128.21 unfortunately when I try to lock the firewall down to this ip ARC cannot connect-it only connects if the source is left open to “all”.

I suppose the question is Can ARC be locked down, if not then I probably won’t use it and will leave the policy disabled on the firewall. This is a shame since it looks great

[Martin_Webster]

@TimW

I suppose the question is Can ARC be locked down…

I doubt it can in the way you describe, since Roon’s infrastructure used multiple resources and IP addresses.

[TimW (Tim Wombwell)]

That’s a shame. Is ARC secure because it uses Roon’s credentials? In which case I will change the password and keep an eye on the firewall logs.

[Martin_Webster]

You wish to review this thread, among others.

Security with Roon ARC / Roon 2.0

Roon authenticates your user credentials and uses an encrypted transport. No unintended users can access your Roon. If Roon is not running, then no one listens on the port that is forwarded, so nothing external can access anything inside your network. It’s like a phone number that never answers. If somehow you already had rogue/malicious software on your network, it could access your network freely and it doesn’t need to open ports at all. It can tunnel traffic from the outside to the inside …