Firewall rules

Configure firewall access so the SASS backend can discover Sennheiser devices and transfer firmware on the local network.

The SASS backend must discover and communicate with Sennheiser devices on the local network. UI-to-backend traffic stays on the loopback interface and does not need a firewall exception.

Required network access

The rules below cover device-facing traffic only.

Purpose	Protocol / port	Devices
Discovery	mDNS over UDP 5353	all
Control and firmware transfer	HTTPS (SSCv2)	EW-DX receivers, chargers
Control and firmware transfer	SSC over UDP 45 (SSCv1)	L 6000 battery charger

The per-executable rules use protocol=any, so they already cover UDP 45 and HTTPS on a flat network. Consider UDP 45 explicitly only when traffic is filtered by port instead of by program, such as in Group Policy rule sets, VLAN or subnet ACLs, and third-party endpoint firewalls.

What the script creates

The bundled firewall_rules.bat creates two categories of Windows Firewall rules. All rules use profile=any and interfacetype=any, so they also apply on the Public profile and on link-local interfaces.

Per-executable allow rules

Each SASS executable receives one inbound and one outbound allow rule with protocol=any.

Rule name	Direction	Protocol	Scope
Sennheiser Device API - Inbound Communication	Inbound	any	per executable
Sennheiser Device API - Outbound Communication	Outbound	any	per executable

The rules apply to these five SASS executables in ...\resources\sass\win\:

Sennheiser.Application.Service.Suite.exe
sennheiserservicebus\Sennheiser.ServiceBus.exe
sennheiserapigateway\Sennheiser.ApplicationService.ApiGateway.Host.exe
sennheiserdeviceapihost\Sennheiser.DeviceApi.Host.exe
applicationservicedevicediscovery\Sennheiser.ApplicationService.DeviceDiscovery.Host.exe

mDNS port rules

These rules are not bound to a program because the multicast reply may be received by any child process.

Rule name	Direction	Protocol	Local port
Sennheiser Device API - mDNS Inbound	Inbound	UDP	5353
Sennheiser Device API - mDNS Outbound	Outbound	UDP	5353

The script deletes existing rules before it adds new ones. This removes leftover block rules that would otherwise override the allow rules and block unsolicited inbound mDNS announcements after a reboot or firmware update. The deletions are limited to the five Sennheiser executables.

Windows installation and manual setup

Automated configuration during installation

On a fresh install, the setup wizard prompts the user to add the rules. Yes runs firewall_rules.bat add with UAC elevation. No skips rule creation. Silent installations use No by default. The script logs to %TEMP%\sennheiser-firewall-rules.log.

Manual configuration after installation

The script remains available at %LOCALAPPDATA%\Programs\Sennheiser.FirmwareUpdater\resources\firewall_rules.bat.

Run firewall_rules.bat add %LOCALAPPDATA%\Programs\Sennheiser.FirmwareUpdater\resources\sass\win from an elevated command prompt to add rules. Run firewall_rules.bat del to remove them. The script self-elevates through UAC if needed. The uninstaller removes the rules automatically.

Group Policy and managed environments

If Windows Firewall is centrally managed, local rules from firewall_rules.bat may be ignored when AllowLocalPolicyMerge or AllowLocalFirewallRules is disabled. Deploy equivalent rules through Group Policy instead.

Allow inbound and outbound UDP 5353 for mDNS on all profiles, plus inbound and outbound UDP 45 for SSCv1 if L 6000 chargers are in use.
Allow inbound and outbound access for the five SASS executables listed above. This is the preferred option because it covers mDNS, HTTPS, and UDP 45 in one rule set.

Use Get-FirewallDiagnostics.ps1 on a target machine to confirm whether Group Policy overrides local rules and to produce evidence for the domain administrator.

Link-local networks and the Public profile

When a PC is connected directly to a device or to a small unmanaged switch with no DHCP server, both ends self-assign addresses in the 169.254.x.x range. Windows classifies the segment as a Public network and applies the stricter Public firewall profile.

Public-profile firewall rules or Group Policy block rules that target the Public profile can drop inbound mDNS. After a reboot or firmware update, the device may never re-announce itself and can appear offline.

This is why the bundled rules use profile=any and interfacetype=any.

Mitigations

Ensure the firewall rules are present through the installer, firewall_rules.bat add, or Group Policy so UDP 5353 is allowed on the Public profile.
Use Add device by IP to reach the device directly when multicast discovery does not work.

On slow or link-local links, firmware transfer can take a long time. The application uses extended or disabled network timeouts for uploads, so no configuration is required.

macOS

When the SASS backend starts for the first time, the macOS Application Firewall may ask whether to allow incoming connections. Select Allow. The application holds network.server and network.client entitlements in its code-signing profile, so no further configuration is needed.

Corporate and managed network considerations

VLAN segmentation

If workstations and Sennheiser devices are on separate VLANs, permit UDP 5353 for mDNS discovery, TCP 443 for EW-DX receivers and chargers, and UDP 45 for L 6000 battery chargers between the host running SFU and the device subnet.

An ACL that permits only 5353 and 443 often causes an L 6000 to stay discoverable but never controllable.

Manual IP fallback

The application supports adding devices by IP address directly. This bypasses mDNS discovery. The control protocol must still be reachable.

Loopback protection

Endpoint security software must not block localhost:8181. The SASS backend binds only to the loopback interface and is not reachable externally, but local traffic filtering can block communication with the UI.

Internet access

Internet access is not required for device discovery or firmware updates. All firmware data is served by the local SASS backend. Internet access is needed only to download the latest device firmware images.