Device Preview security settings
Although Device Preview is an extension to Experience Manager, it does not communicate with the Presentation Server from the browser. Rather, Device Preview communicates directly from the Content Manager server to the Presentation Server, which has implications for your security setup.
Experience Manager itself relays instructions back to the browser, which accesses the Presentation Server itself. This means that by default, the browser needs access to the Presentation Server, but Content Manager server does not.
Device Preview does result in the need for direct communication between the Content Manager server and the Presentation Server. This means that your security setup needs to make such communication possible. If there is a firewall between your Content Manager server and your Presentation Server, or if access is secured in any other way, you need to ensure that access is enabled.