Access Control Profile still allowing remote login attempts

[bitbanger]

I have my firewall set to forward 5000-5001 for DSCam application access (and restrict based on GEO-IP) but want to deny access to the web based login pages for not only File Station and SS but also DSM, except from internal LAN.

I have set my Access Control Protocol, and set this profile to be used for FS and SS applications. However I'm still getting repeated hits on my DSM login page. I do NOT have any reverse proxies defined.

The auto-block (useless for random IP) and auto-lock have been set as a precautionary measure, along with 2FA, but I'd prefer to avoid these hits altogether.

Where is this functionality hiding (to block external access)?

Thanks in advance.

 

[Telos]

Because each web application uses 443 port it is impossible to distinguish them on FW

It seems you confuse firewall with port forwarding.

Rusty has given you a good answer using reverse proxy, which then you would use the firewall to allow only your approved external IP. Alternately...

Suppose I want to allow access to Photos only for some external network

Then using port forwarding rules on your router you would redirect the incoming connection from the external network IP:443 to your NAS_IP:Drive port.

And so on...

Note: Edited to prevent stupid emoji override.

 

[yodasad]

Thank you, @Rusty! It works!)

@Telos, I understand that FW and Port Forwarding are different things, The are similar in the sense that they both work on transport layer. ACP works on application layer.