Hacker News Reader

I doubt anyone is running a browser on their router.

But still, you could do the same for stun, turn, sdp. Disallow local host.

That's literally what browsers have done (for STUN) and are working on (for TURN).