How to block SA30 firmware updates

Features
1

This post describes how to block the (automatic) firmware update function of the SA30 by using the DNS blocking technique. There might be various reasons to block these firmware updates and stick to an old firmware version. The SA30 contacts an Arcam host on the internet which serves the firmware updates. DNS blocking makes it impossible for the SA30 to retrieve the ip address of this Arcam host.

The free DNS blocking software used in this article is AdGuard Home. There are other free alternatives like Pi-hole. The reason I used AdGuard is it supports the OS of my choice and it’s easy to setup.

From the AdGuard website:
“AdGuard Home is a network-wide software for blocking ads & tracking. After you set it up, it’ll cover ALL your home devices, and you don’t need any client-side software for that.”

Note that the device on which AdGuard is installed needs to be up and running constantly because it has to serve DNS requests.

How to setup up AdGuard to block the SA30 from retrieving firmware updates

  1. Determine on which device AdGuard will be installed, e.g. your NAS. AdGuard is supported on Linux, Windows, MacOS and FreeBSD. A good installation manual can be found here.

  2. After AdGuard up and running, configure your devices to use the AdGuard as DNS resolver, refer to the same web page how to do it.

  3. Configure Adguard to sinkhole the Arcam update host:

  • start a browser and go to AdGuard web configuration page
  • select filters, custom filtering rules
    image
    image893×350 22.4 KB
  • enter the next string in the input field and press apply: ||www.arcamupdate.co.uk^$important
    image
    image899×574 17.3 KB

  1. AdGuard will sinkhole the Arcam update host now. Test it by performing a manual SA30 firmware upgrade, e.g. by using the web client.

    image
    image695×444 20.7 KB

  2. Goto the AdGuard log and verify the URL has been blocked:

  • click on query log
  • in the search field enter arcam
  • www.arcamupdate.co.uk should show up as blocked. In the screenshot below it is not blocked (response is processed), the line should be red and the response should be ‘blocked’.
    image
    image1200×344 20.4 KB

Note that each device in the chain has a DNS cache. Once the URL has been resolved successfully it will be preserved in the local cache, no new DNS request will be send and AdGuard won’t be able to block it. If the SA30 or any other DNS resolver between your SA30 and the ISP, e.g. your router already knowns how to resolve the Arcam update host then AdGuard will be bypassed. If this is the case then you should reboot that device (SA30 or your router).

3

That’s indeed a simple method to achive the same goal. A rule to block all traffic to your SA30 means the SA30 has no access to streaming services like Qobuz, etc. If that is no problem then its a good and simple alternative.