Roon with Firewalla UPnP

[Ronald_Claiborne]

Roon Server Machine

Latest Mac OS on a mac mini M3

Networking Gear & Setup Details

1. Who is your internet service provider?
   Optimum

2. Please list the make and model of your modem and router?
   Motorola

3. Do you have any additional network hardware, like additional routers or managed switches?

4. Does your network have any VPNs, proxy servers, or enterprise-grade security?

Firewalla

Connected Audio Devices

Description of Issue -

What is the exact port forwarding error message you see in the Roon Settings → ARC tab?

I just reactivated my Roon account after being gone a few months. I installed a Firewalla firewall and when I ran Roon for the first time since the firewall, ARC wasn’t working. Well, until I turned on UPnP and forwarded external port 55000 to my Roon Server port 55000. Everything works fine now. However, one of the options is to Set the ingress firewall settings.

When I have it set to “All Sources” everything works. However, I believe this setting would let the entire world probe my port 55000. There is an option to specify certain IP addresses only. I tried resolving the IP for api.roonlabs.net and when I put in that IP address for the only source, ARC doesn’t work again.

I’m assuming api.roonlabs.net resolves to more than one ip. Is there a list of all of the IP addresses that API could use so I don’t have to leave that port open to the world?

Thanks

[Martin_Webster]

@Ronald_Claiborne

When I have it set to “All Sources” everything works.

Most likely, you only have one source, i.e., WAN, which is the Internet connection.

@Ronald_Claiborne

I’m assuming api.roonlabs.net resolves to more than one ip.

There will be a series of Google servers, and this will probably change from time to time. Cloudflare may be involved, too. There is no published list of addresses.

[connor]

Hi @Ronald_Claiborne,

@Martin_Webster is correct - if you’re uncomfortable with port forwarding as a mechanism, alternatives would include switching your RoonServer and router to a native IPv6 connection and pinholing (if available) or installing a proxy-mesh VPN with robust NAT traversal, like TailScale.