Is it possible to not advertise the instance?

[Mastiffen]

I am using Shairport-Sync as a part of my whole-house audio system (for rooms that I can't run speaker wire to I have good Audio Pro Allroom AirOne active speakers and Pi's connected to that, running Shair-Port). But I don't want those to be advertised. The reason is that they are used solely for audio from the main server, with J.River Media Center music and Norwegian Internet radio with FooBar. So I don't want anybody to be able to break into the stream on any of these or even know that they are there. I have a program called TuneBlade on the server that sends to Shairport-Sync, and there I can choose to set it up with a manual IP address and port. So can I block advertising that there are AirPlay receivers with Shairport-Sync?

[mikebrady]

Thanks for the post. Shairport Sync doesn't have an option or similar to turn off advertisements, but maybe it can be done via a firewall rule -- the advertisements are carried on Bonjour.

[Mastiffen]

Thanks for answering! The problem is that because of range I need to keep the Pi's on the main network, the IoT network in my house does not cover all areas. Is it worth it asking for this as a new feature, or is it too much work to change?

[mikebrady]

Thanks. Can't promise it -- it's the first such request in many years, so definitely a minority interest 😬.

I was thinking of a firewall on the Shairport Sync device itself rather than the entire network... Anyway, it was just a thought. There's a little about firewall rules here.

[Mastiffen]

I am not surprised that not many else wants it, it sort of defeats the purpose for most. But smart thinking about blocking it on the Pi, thanks! I have a template for the setup, and I'll expand that to have the firewall as well. If I understand correctly I'd have to block the ports that Shair-Port uses from 5000 and belo, right?

[mikebrady]

I’m guessing just 5353 — it’s the mDNS port that’s used by Bonjour, I believe. All the others need to be open. But I haven’t tried this!

[Mastiffen]

Thank you! I will try that one of the first days and see what I get out of it!

[Mastiffen]

Quite weird. I set the Pi up with ufw and first tried blocking the all ports associated with AIrplay, like this:

sudo ufw deny 319:320/udp sudo ufw deny 3689/tcp sudo ufw deny 5353 sudo ufw deny 5000 sudo ufw deny 7000 sudo ufw deny 6000:6009/udp sudo ufw deny 32768:60999/udp sudo ufw deny 32768:60999/tcp sudo ufw deny 80 sudo ufw deny 554 sudo ufw deny 5001 sudo ufw deny 443 sudo ufw deny 5297 sudo ufw deny 5298 sudo ufw deny 49152:65535/tcp sudo ufw deny 49152:65535/udp
It still was found by TuneBlade (the Windows AirPlay Server software I use). Then I tried to set it to sudo ufw default deny outgoing sudo ufw default deny incoming, which blocked it from being discovered, and from playback, of course. I then opened port by port of the ports above, and after a few ports I could get it to play, but not to be autodiscovered. Then I tried port range by port range until I have allowed all ports from 1 to 65535 in both UDP and TCP, and it still does not autoupdate. I even tried with IGMP, ufw allow from 192.168.2.0/24 to 224.0.0.0/24 proto igmp. But no way. I was thinking about letting only one computer in, the Airplay server, but it doesn't seem like that will work. Any idea why this is happening?