General DS APPS and Quickconnect in past 2-3 Years

[Jan Janowski]

Been using DS APPS: DS FILE, DS CAM, DS Router, for between 2 to 3 years....
Always with QuickConnect.... NO Ports forwarded in Router.. QC is only way I connect..
Obviously when on LAN it just connects...
When outside the house Via whatever WIFI I can get to.... and if not...
Via Phone "LTE Data" (As it shows up on my phone) at a slower Data Rate......

Happy as Heck!!! I was in Venice, Italy less than a month after setting it Up, and had to get at a document on my NAS in North Carolina.... and DS File retrieved it... without an issue, from the Hotel WIFI... Cross-Eyed with Happiness!!

Access to cameras, (DS CAM), Files (DS FILE), Router (DS ROUTER) BEAUTIFUL

Then, I started to notice I'd go some places, and could not connect! (I'm leaving out the stuff I changed back when I thought it was a setting I did! and all the issues that caused! ! )

In past years, I've seen Airports, Cruise Lines, Hotels, Exercise Locations (attached to Hospital), and some stores, NOT give access to the DS APPS I love!
I was just at 3 different Airports, and 3 different Hotels, and a Cruise Ship.... None of Airports, Ship, and 1 of 3 hotels.... allowed access to DS APPS....
Now... on each of the ports we docked at (Cruise Ship Ports, not ports)... Access via Phone Data WORKS... but not WIFI of Ship or some Hotels... But others DO WORK.... ???
At one Hawaiian location we were at... I could access 3 different hotels from where I was sitting at bar..... 2 did not work, 1 did... as did LTE DATA on phone....
But, I have 2x NAS's and a Synology Router.... ALL DS APP's WORK, or, ALL DS APPS DON'T WORK on WIFI!
All or Nothing!!! But always works on LTE DATA !!! ????

It's getting to the point where where ever I go, I'm trying to access cameras, or Router from my DS CAM APPS.... And If they fail to connect via WIFI, I try again on LTE DATA..... That Always works!

I am wondering if either the port that DS CAM (what is it-- 5000 & 5001?) or maybe the High Port Number I changed NAS's & Router to is the cause.... But I certainly don't know.... for certain.... No one will talk.... or frankly don't know what's going on, because someone else set it up....

I'm incredibly Nosy about this, so, On Cruise Ship, talked to the IT Manager, and he could not confirm if they are blocking ports or not. "Company Secrets"

Yeah, Right!!!

So, since all APPS WORK on multiple NAS's and Router-- when they Work, and they all "Don't Work" -- when they don't.... And I have noticing this has been getting more frequent (Not to Connect) over the years..... I'm assuming that its the IT Staff at these locations, in a fear of all the hacking stuff going around.... That are locking down all ports they can.... out of 'hacker' concern.... But I have yet to be able to confirm it.....

Suggestions as to what might be happening...

 

[speedmaster]

Like you guess: In the last few years, many places, like companies, have startet blocking all other ports then 80 (http) and 443 (HTTPS).
Many ISP's block port 25 for private users.
You might be able to bypass that, by setting up a VPN server on your NAS, and connect to that, to get to your services. Depending on VPN port not being blocked "everywhere" too.
Or get into reverse proxy, and "link" relevant ports to 80 and 443.

 

[Jan Janowski]

I thought QC connects to Synology servers and they Connect, in turn, to my NAS/Router, etc... ??
So my guess that it's local "Lock Down" is possibly correct?
I understand the Port 25 block for obsolete email connections... but not DS APPS...
I'm unclear if port change for NAS & Router is only for Admin login, or if that ripples down to QC in DS APPS...
I think DS APPS are at 5000 & 5001.... Right? Don't have the smarts to attempt your suggestion...

Could you confirm it's port 5000 & 5001 that DS APPS all use? If I knew that for certain, I could then ask IT guys if they are blocking them.... For confirmation....

 

[speedmaster]

Log into your NAS, open Control panel, then "Info center" and then "service".
Here you can see default ports.
I honestly have not checked, if QC does a port 80/443 connect to synology servers, and then forward to 5000/5001.
Just assumed that they (Synology) do a straigth one to one portforwarding, set in Control panel setting "login Portal", since I had the same expierence as you, some time ago.

 

[Jan Janowski]

Looked.... Really doesn't tell me much

 

[speedmaster]

Looked.... Really doesn't tell me muchView attachment 9528

Try this Synology page:

What network ports are used by DSM services? - Synology Knowledge Center

Synology Knowledge Center offers comprehensive support, providing answers to frequently asked questions, troubleshooting steps, software tutorials, and all the technical documentation you may need.

kb.synology.com

 

[Jan Janowski]

Yep... all DS APPS I'm using are 5000 & 5001.....

Probably IT Folks, fearing the worst.... locked down all ports, as a "Make Damn Sure", and DS APPS are just "Collateral Damage"!

 

[Telos]

Yep... all DS APPS I'm using are 5000 & 5001.....

By default... but no need to keep the NAS http/s defaults at those ports... You can change http/s port nos to anything proper, so... to 5555/6666 and then append the port number onto your DS app logins... for example:

jan.synology.me:5555

And all should connect.

 

[Jan Janowski]

I mentioned that before.... I moved NAS ports to high 49,000's a year ago
the login on DS APPs are just the QC Login.... Not synology.me
After the NAS & Router ports moved to high #'s, there was neither more or fewer failure's....
It's been the last few months where failures have grown more frequent...
But just tried following on DS CAM:
QCLogin.synology.me:NASPORT# and it immediately failed... before it attempted to connect anywhere... on LAN.
Also tried QCLogin:NASPORT# and it would not connect either..
But QC login by itself... No synology.me or synology.me:Port# works... and has for years, unless blocked...

Wait.... You mentioned 5555/6666 I'm 49,000 and some... ??

-- post merged: 13. Apr 2022 --

Obviously bogus QC login (flyakite), but that’s the line where synology.me:port# won’t work

 

[leriak]

If you are using quickconnect relay, I doubt your internal ports for DSM matter, as the connection through which your data gets to the NAS is actually an outbound connection from the NAS to synology's quickconnect servers.

My limited experience with "public" wifi services from airports, hotels etc... is that many of them just use a DNS sinkhole to block unwanted traffic, which can be bypassed by switching the DNS server provided through DHCP to an external DNS service like google's (8.8.8.8) or cloudflare's (1.1.1.1). The train line I usually take has this DNS sinkole, and I used to use the 1.1.1.1 app on ios and android to be able to watch netflix.

In any case, I doubt you'll find a "silver bullet" that allows you access to your stuff from all networks, there are many ways a network can be configured to block traffic and each one you encounter will be different.

 

[Jan Janowski]

Thanks for the info folks!
I didn't expect a 'silver bullet' from this.... I had 'kind of' determined what was going on, from the long term symptoms I was observing..... I was just missing the confirmation information.... that my idea's were somewhat correct....

However, a Quick question on DNS info you just posted...
At home, (Static IP) I point iPhone's DNS at Router, which in turn is set for cloudfare.... I can do anything I want... No Limitations... Because I'm not limiting myself other than the Firewall and Packet Sniffer rules....

Say I go back to a location that blocks access. via their WIFI... (Local Exercise location by Hospital is nearby one)... Are you suggesting to open up the current WIFI settings I connected to, and manually change DNS to Cloudfare (1.1.1.1) and then try that??? Thanks for your info...

 

[leriak]

Say I go back to a location that blocks access. via their WIFI... (Local Exercise location by Hospital is one)... Are you suggesting to open up the current WIFI settings, and manually change DNS to manual at Cloudfare (1.1.1.1) and then try that??? Thanks for your info...

In essence yes, however I'm not sure if android and ios allow you to do exactly that. On android you can set a "private" dns in settings with a custom url. I've used "one.one.one.one" for cloudflare, I don't know for google... that makes the phone use 1.1.1.1 on all networks, which is not ideal if you have an internal dns at home.

What I actually did is use the 1.1.1.1 app which does the trick for the cloudflare dns with a convenient "on/off" toggle. However, now I'm using a wireguard vpn with pihole dns instead of the app.