Cant access NAS after default port change

[DataGeek]

Long term DS418 user, love the product, I changed my default ports from 5000/5001 (and checked the convert http to https), but now cant access using previous local browser technique? Get error message:

The webpage at https192.168.1.199:50xx might be temporarily down or it may have moved permanently to a new web address.
ERR_UNSAFE_PORT

I can still access via Quickconnect ok. I cant bypass this error. Have I picked a restricted port? I did see a similar thread here that mentions a new cert is needed?

 

[Rusty]

The webpage at https192.168.1.199:50xx might be temporarily down or it may have moved permanently to a new web address.
ERR_UNSAFE_PORT

Accessing a custom port regardless of its number, presently, your internal connections are all being pushed to https. As such, in this case, you have 2 options.

1) get a cert and make sure it covers your FQDN or IP address you are trying to access, or
2) Simply make an exception in your browser and continue without an SSL certificate

Now, if atm you are having issues and are unable to get into option 2, then use QC to connect to your NAS and change a port to any value higher than 1027 (assuming the port that you choose is not already in use by some other service). After that, try and access the NAS locally again.

One last thing, make sure that the browser you are using is also not giving you extra issues as well, so feel free to try with another one just as a test.

 

[DataGeek]

TY Rusty for reply!!

Accessing a custom port regardless of its number, presently, your internal connections are all being pushed to https. As such, in this case, you have 2 options.

1) get a cert and make sure it covers your FQDN or IP address you are trying to access, or (How to add cert?)
2) Simply make an exception in your browser and continue without an SSL certificate - How do I do this? I see references to a modified target that allows specific ports?

Now, if atm you are having issues and are unable to get into option 2, then use QC to connect to your NAS and change a port to any value higher than 1027 (assuming the port that you choose is not already in use by some other service). After that, try and access the NAS locally again. I tried going back to default https port 5001 and still same error, tried to clear cache as well, no joy.

One last thing, make sure that the browser you are using is also not giving you extra issues as well, so feel free to try with another one just as a test. - I did try both edge and chrome, same errors.

I also tried to add a firewall rule to forward my new https port to my dsm - but still same error.

will try brand new port this evening...

 

[DataGeek]

an update..

I disabled redirect for http, left https at default 5001, left http to new port 50XX, and both are working. I do get the normal? warning about http access being unsafe but can use advanced to access dsm. will start adding back new ports later today

 

[DataGeek]

Now... tried a brand new https port #, used https ip/port browser address, I get past "unsafe port error!" but now get the dreaded "not secure" error, see attached pix...

 

[Telos]

You cannot avoid that when using a local IP, as there is no true certification possible. That's not an "error" but information.

 

[Rusty]

Ok, so now you have the setup behaving as expected. While accessing the HTTPS via a custom port (it doesn't matter which), the browser will always challenge you with this "not secure" message as long as there is a missing certificate that will back up this "secure" connection.

Considering that you are lacking the cert, the error is present, so as I said, all normal so far.

In order to solve this, you have several options.

One, get a cert that will cover the said IP address, apply it to your NAS (Control Panel > Security> Certificates), and continue to use the NAS. While it is not impossible to set a cert with a "local IP address", it is also not very common.

If you will be accessing the NAS via its local IP address internally (within your LAN), then you can simply accept the exception and move on. Meaning, you continue to access using it with the non secure option. Also, you can simply use the HTTP protocol and the port that you have set, and continue without error. The fact is that if this is for internal use, there is no real case to force https anyway, and to get around it, you will need a valid certificate one way or another.

So the question is, do you have any specific needs to force the https in the first place, or is this simply for internal usage, and maybe you can continue without it?

 

[DataGeek]

OK, after changing the https port to a new 20XX port, reverified, get the following results:

• Edge
• https Ip/Port 20XX gets “not secure” but can bypass
• http nasname/port 50XX gets not secure, but can bypass

• Chrome
• http/nasname/port 50XX get not secure but can bypass
• https Ip/port 20XX works fine

I think the http "not secure" flags are just an artifact of the redirect?

I am not sure why edge does not like the https syntax? (https 192.168.1.199:20XX)

Chrome looks golden.....

 

[akahan]

I think you're not understanding what https is about. It's checking for a certificate. A certificate is (except in rare cases) for a domain name, not a numeric IP address. You're connecting using a numeric IP address, and expecting assurance (via https) that the domain name you're (not) entering is secure; it's a non sequitur. This has NOTHING to do with ports. It has everything to do with you trying to use https to connect to a numeric IP address.

 

[DataGeek]

one more oddity, I am using a password manager (PM) to originate my dsm access, both browsers have extensions, depends on which browser I open and run password manager (PM) from, I defaulted settings for all browsers from my PM. Now I seem default to chrome whether I start from chrome or edge, this chrome session always connects to my dsm without the "not secure/advanced bypass" dialogue boxes, but in the URL field I do see the words "Not secure" and HTTPS has a "strike through".... REALLY WIERD......!!!!!! I don't think I'm getting a secure connection yet?

 

[akahan]

It's not weird, it's doing exactly what it's supposed to do. You're not going to get a "secure connection" using a numeric IP address.

 

[DataGeek]

Hi Akahan! TY for reply... yes i'm a newbie and may not be using the proper terms or relationships, I started this journey trying to implement the security recc's to change my default DSM access ports for http and https services, when I did lost access to my dsm... the error message was "unsafe port", I think I was always getting the "not secure" flag when using HTTP, but using HTTPS access worked without errors using the default port 5001, when I changed my dsm https port to a random number, it broke my access. My rudimentary thinking was https means encrypted communications, I'm learning about the role certs play in validating the "server" is authentic. My priority has been to restore secure communications with my dsm. The first hurdle appeared to be "unsafe port", now I can at least access directly, but I am still getting the "not secure" flag on my device connection. Yes, ports are not the root cause, and as Rusty said above, certs apparently are... why doesnt my dsm have a valid cert that my pc browsers can use? How do I solve this? Help!! ty Akahan for helping!!!

 

[DataGeek]

I was getting the same error using the domain name....

It's not weird, it's doing exactly what it's supposed to do. You're not going to get a "secure connection" using a numeric IP address.

Think I get that, also using name (https//synds418:50XX)

 

[akahan]

https//synds418:50XX is not a domain name. A domain name would be like domain.com or domain.org or domain.net or whatever. Why do you feel you need a secure connection when the communication is within your own local network?
If you want a secure connection, and don't mind the slower transfer rate, you could use your QuickConnect URL. Typically https://QuickConnect.to/yourquickconnectID

 

[DataGeek]

I was getting the same error using the domain name....

Think I get that, also using name (https//synds418:50XX)

Here is a pix of "not secure" and HTTPS strikethrough when using name/port syntax (but can login and access dsm):

 

[DataGeek]

Here is a pix of "not secure" and HTTPS strikethrough when using name/port syntax (but can login and access dsm):

View attachment 27532

and here is my NSLookup results on my DSM:

 

[Telos]

Here is a pix of "not secure" and HTTPS strikethrough when using name/port syntax (but can login and access dsm):

As @akahan stated. This is expected as there is no legitimate certification for your NAS name ( this is not a domain name).

Create a DDNS domain; obtain an Let's Encrypt certificate and use that if the broken padlock bothers you.

 

[DataGeek]

Ty Telos, I have a DDNS domain (FQDN?) with an active cert that I have used in past to access my NAS when I am travelling. See green lock above? I tried to use it to access my local server but it seems to be failing, I dont think it works unless im accessing from the external internet? It uses my public IP address. I tried to "test connection" from DSM "external network" and it failed? Should I be using this address versus my local device name with a new lets encrypt cert?

 

[Telos]

I dont think it works unless im accessing from the external internet?

Possibly. If so that would be a router issue. NAT hairpin. Does your router support that? Is it enabled?

Generally, I load the DDNS on my laptop browser and it takes me to the NAS login screen ... all at home.

 

[DataGeek]

My router Verizon Fios G1100, does have loopback/hairpin/reflection functionality, but I cant see where its configured.

I can use my DDNS Name with external IP locally, so it must be turned on.

This DDNS name is configured? using my Routers external IP address....? Do I need to add port number (port forwarding for nas ip .199 to get to my NAS?