Brute Force Password Attack - but NAS has no external access set

[Robbie]

Started yesterday with multiple failed password attempts, which restarted again this afternoon.

The odd thing is that my NAS is not currently set to be externally accessible via DDNS or Quickconnect - both methods are disabled. I am not sure how these events are making it past the pfSense firewall either - allegedly from an external WAN address.

Anybody know how these external attempts are getting past my firewall and why my NAS is responding to an attempted login from an external address?

At the moment the attempts are only being blocked by the failed login Auto Block - a very late stage of protection!

️

 

[ragnarok]

That’s alarming tbh. Cross check your NAT settings, firewall rules and log files asap!

 

[Robbie]

Everything looks ok. According to the log files pfSense is blocking them under the default rule, so not sure why DSM gets a sniff of them:

Just to be sure, I blocked the /24s for these IP ranges using an easy rule:

Looks like Iran has a beef with me but it still seems odd that DSM is allowing an external IP to get as far as an attempted login.

️

 

[fredbert]

Do you have any port forwarding to the NAS? Using DDNS is just a way to resolve a name to the nearest Internet-routable device's IP address, usually the firewall/router for home users. Any port forwarding in the router will then take care of directing connection requests from its WAN port to a LAN device.

While we live in a world where VPN services allow connections to appear to be from a different country to the initiating device, you can still try setting up NAS firewall rules to block access from countries you know will never have a reason to be trying. That will stop some attempts.

Using non-standard ports for Internet access will make the job of finding them harder. Many scans will be for a range of known ports, not all 65k of the possibilities.

If you are using reverse proxy, even internally (I use an internal DNS so my URLs work at home and away), then you can apply access controls. Like this...

 

[Robbie]

I'd not considered setting an ACP. I'll have to be careful not to lock myself out!

A few services run on my NAS, including Home Assistant, Homebridge and Plex.

️

 

[Gerard]

I’d say you have some misconfiguration on your firewall. That indeed is alarming if you don’t have it opened to the outside but are seeing that in your logs.