Skip to main content



Firewall Use Cases

Most common to use is Port Forwarding and Inbound Traffic Block.

Advanced firewall configuration

Port Forwarding

Set rules to forward incoming traffic (DNAT forwarding).

Add a Port Forward

On the Firewall page expand Port Forwarding and click Add Forward.


In the screenshot all traffic from source address with destination port 8080 is redirected to on port 8080.

Inbound Traffic Block

Block traffic coming into the network at the PREROUTING stage.

Add a Inbound Block

On the Firewall page expand Inbound Traffic Block and click Add IP Block.

firewall-inbound-traffic-block-add In the screenshot all traffic from source address with destination address will be blocked.

Forwarding Traffic Block

Add rules to block traffic at the FORWARDING stage.

Add a Forwarding Block

On the Firewall page expand Forwarding Traffic Block and click Add Forwarding Block.

firewall-forwarding-traffic-block-add In the screenshot all traffic from source address with destination address on port 8080 will be blocked.

An example use case would adding the LAN policy to a device but wanting to block access on some outgoing ports or IPs.

Custom Interface Access

Manage network access for custom interface names and control access for docker networks.


Use this to forward traffic to an interface running in a separate container.

See more in the repository for the spr-mitmproxy plugin for how this feature can be used.

Multicast Proxy

Set multicast ip:port addresses to proxy between devices. This allows discovery services such as SSDP/Zeroconf and mDNS in SPR. By dfeault only SSDP and mDNS are on. You may need to enable PTP or other services for streaming and device sync. If something is not working as expected, let us know, by filing an issue


A future release will enable tags to apply proxying to only a subset of devices.


Service Endpoints serves as helpers for creating other firewall rules, as well as one-way connectivity from devices to the endpoint when they share a tag.

When devices are in the same group they have full access to each other. Device with the LAN policy have one-way access to all devices via NAT.

Endpoints create a quick way to apply one-way connectivity a specific destination, by applying tags.

  1. Create an Endpoint definition


  1. Apply a tag firewall-endpoint-tag

  2. Apply the same tag to the device that should have access to the endpoint firewall-endpoint-tag

  3. Example of device access before and after it has the tag firewall-endpoint-tag

The other side,, does not gain access to the device on beyond receiving TCP connections on :22900.


The services view controls firewall settings for the SPR router itself. The Ping settings control if SPR can be pinged. These are on during setup but disabled by default after.

Working with Service Ports

The allowed SPR services are default on for all devices. In a future release tag support will be improved to further restrict port access to the API (tcp 80) and SSH (tcp 22) on SPR.

To remove access for LAN devices, delete the service entry.

To allow access to the service from the Uplink interface, turn the slider to on ("Upstream WAN").

Multicast Settings

SPR uses a multicast UDP Proxy to relay multicast traffic between devices.

Set the "Enable Multicast Proxy" to false to disable the proxy and all mDNS settings.

The "Advertise Router over mDNS" toggles whether or not the proxy will respond to mDNS name requests on the uplink interfaces.

This makes it possible to discover SPR with querying 'spr.local' on systems that are aware of mDNS.

The mDNS name can also be customized.