SmartUnlink for VPN connections

Make sure you thank Brian! (I couldn't find his callsign)

FlexRadio's canned answer:

At this time, we do not have plans to allow SmartSDR to support direct IP addressing.

The primary reason is security. Enabling direct IP access would require users to open non-secure ports on their firewalls, which creates a significant risk of exposing the radio’s control port to the public internet. That scenario makes radios an attractive target for bad actors and is not something we are comfortable encouraging or supporting.

For users who require direct access, there are well-established VPN solutions that solve this problem correctly and securely. Options such as SoftEther and similar VPN technologies allow full, direct network access to the radio while maintaining proper encryption, authentication, and firewall protection.

We understand the desire for flexibility, but protecting customers and their stations from unintended exposure has to remain a priority.

That is a fair question, and you are correct that security always involves an element of trust somewhere in the chain.

The key difference is where that trust is placed and how broadly the exposure is created. With a VPN, the user is explicitly choosing to trust a specific piece of software whose sole purpose is to create an encrypted tunnel with authentication and access controls. The radio is never exposed directly to the public internet, and no FlexRadio service ports are opened to unsolicited traffic. From the radio’s perspective, the connection behaves as if it were on a private LAN.

Native direct IP addressing would require users to open and forward control ports on their firewall. In practice, many users would do this incorrectly or incompletely secure it, even with warnings and documentation. Once those ports are open, the radio becomes directly reachable by anyone who can find it. That is a fundamentally different risk profile than a VPN, even if the end goal of connectivity looks similar on the surface.

You are absolutely right that running third party software requires trust. The distinction is that this trust is intentional, limited in scope, and well understood, whereas exposing a device control port to the internet creates ongoing unintended exposure that cannot be meaningfully mitigated by the application alone.

We are not saying VPNs are perfect or that trust is eliminated. We are saying that placing trust in a mature VPN solution is a far safer and more controllable approach than encouraging users to expose radio control services directly to the internet. That balance is why native direct IP support remains a no at this time.