1000s of login attempts to my Synology NAS

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › 1000s of login attempts to my Synology NAS - how to stop them?

kiwifidget

"Cookie"
3425 posts

Uber Geek

Lifetime subscriber

#302002 21-Oct-2022 13:36

Over at least the last 3 days there have been 1000s of login attempts to my Synology NAS.

I remotely login to the NAS myself so I cant just turn QuickConnect off.

Is there a way to allow only certain devices to access remotely, or is there a better way to stop this?

I would like to stop the attempts, not just ensure that every attempt fails.

Delete cookies?! Are you insane?!

CYaBro

4589 posts

Uber Geek

ID Verified

Trusted

#2985855 21-Oct-2022 13:48

Why not setup a vpn instead and turn quickconnect off?

Opinions are my own and not the views of my employer.

kiwifidget

"Cookie"
3425 posts

Uber Geek

Lifetime subscriber

#2985858 21-Oct-2022 13:53

@cyabro that is a skill currently beyond my capability

Maybe I'll have to read up on it.

Delete cookies?! Are you insane?!

Jase2985

13465 posts

Uber Geek

ID Verified

Lifetime subscriber

#2985859 21-Oct-2022 13:54

what firewall rules do you have setup?

what port have your forwarded on your router for the NAS?

do you have auto block turned on for failed login attempts?

Are you using the default Admin account?

kiwifidget

"Cookie"
3425 posts

Uber Geek

Lifetime subscriber

#2985860 21-Oct-2022 13:57

Enable firewall is not ticked.

Port 5000/5001 I think.

Not home at the moment to check the router.

Delete cookies?! Are you insane?!

kiwifidget

"Cookie"
3425 posts

Uber Geek

Lifetime subscriber

#2985861 21-Oct-2022 13:58

I dont know about #3.

Admin account is disabled.

Delete cookies?! Are you insane?!

kiwifidget

"Cookie"
3425 posts

Uber Geek

Lifetime subscriber

#2985862 21-Oct-2022 14:01

That was enabled already.

Delete cookies?! Are you insane?!

gehenna

8520 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

#2985863 21-Oct-2022 14:03

kiwifidget:

Enable firewall is not ticked.

Oh dear

Sharesies

Trade NZ and US shares and funds with Sharesies (affiliate link).

dan

1134 posts

Uber Geek

Lifetime subscriber

#2985864 21-Oct-2022 14:05

you dont actually have to open those ports if using quickconnect, it has some kind of relay service, its a little bit slower but works

just kill the ports from port forwarding for now

or turn on the firewall and only allow NZ?

Jase2985

13465 posts

Uber Geek

ID Verified

Lifetime subscriber

#2985865 21-Oct-2022 14:06

1. look at setting up the firewall, good tutorial here: https://mariushosting.com/synology-how-to-correctly-set-up-firewall-on-dsm-7/

2. enable auto block, then at least they only get x attempts before being blocked

With the firewall thing, my NAS only allows connections from with NZ so if its not a NZ IP its blocked, except if its the VPN connection.

kiwifidget

"Cookie"
3425 posts

Uber Geek

Lifetime subscriber

#2985866 21-Oct-2022 14:06

I'm not sure if the router has those ports open or not, those are the port numbers I see in DSM.

I have now enabled firewall.

What rule should I create?

Delete cookies?! Are you insane?!

dan

1134 posts

Uber Geek

Lifetime subscriber

#2985867 21-Oct-2022 14:06

id also change it to 3 attempts in 180 mins so they kick blocked faster

kiwifidget

"Cookie"
3425 posts

Uber Geek

Lifetime subscriber

#2985870 21-Oct-2022 14:07

The IP address changes with every attempt so auto-block is not stopping it.

Delete cookies?! Are you insane?!

dan

1134 posts

Uber Geek

Lifetime subscriber

#2985873 21-Oct-2022 14:10

kiwifidget:

I'm not sure if the router has those ports open or not, those are the port numbers I see in DSM.

I have now enabled firewall.

What rule should I create?

follow that guide above looks correct

CYaBro

4589 posts

Uber Geek

ID Verified

Trusted

#2985875 21-Oct-2022 14:15

I would change those default port numbers too.

Opinions are my own and not the views of my employer.

kiwifidget

"Cookie"
3425 posts

Uber Geek

Lifetime subscriber

#2985877 21-Oct-2022 14:21

OK, I've setup 3 firewall rules as instructed.

Allow my default gateway.

Allow NZ

Deny everything

And the logins seem to have stopped!

Thank you so much everyone.

Delete cookies?! Are you insane?!