DS router Found a bug in DS ROUTER

[Jan Janowski]

Was trying an idea in Firewall Rules, and stumbled onto a couple bugs in DS ROUTER, in the FIREWALL AREA…. compared to what Router (2600) shows on the same firewall rule, in router Firewall area!

On FIREWALL IN Router, create a rule specifying a specific port or range of ports.
That Rule in Router will show individual specific port(s) in router Friewall list, as you just created!

Now examine that same Firewall rule using DS ROUTER!
That same rule that shows ports in rule - in router…. Will specify “ALL PORTS” as seen in DS ROUTER!

Also (found this out first, actually). Try to create a firewall rule Specifying ANY PORTS.. in DS ROUTER. Any new firewall rule created by DS ROUTER defaults to ALL PORTS! You Can’t even manually add or edit it!! (But in Router: YOU CAN)!

I’m hoping the bug is just in DS ROUTER, and Not Router firewall! If I could see HITS, I’d be FAR MORE CONFIDANT ITS: DS ROUTER and not the Router Firewall!
I Have yet to see any rule based on ports - created at router, generate 1 HIT. Yet!!! ?But this could be my issue: creating a rule that isn’t correct.

Anybody else see this — OR — create a firewall rule based on ports that GETS HITS??

 

[Jan Janowski]

Firewall rule created to test port theory: (This is with Routter at latest SRM and NAS at Lateest DSM 3.2) and all packages everywhere current!)

Since I have changed the default ports on my Synology devices… And:
Since default port for Router and NAS is 5000, 5001.. 8000, 8001 I wondered:

Is any of the HITS in the DENY ALL firewall rule at bottom including port scans looking for default Synology ports?

So I created a firewall rule;
TCP/UDP, source: INTERNET. ALL IP, ALL PORTS, destination: INTERFACE-ALL, ALL IP, port range 8000 - 8001 DENY

Did another rule for port range 5000 -5001

Put these 2 rule at top of firewall list - with the idea that they would catch (HITS) anyone attempting to do a port scans looking for default Synology ports.

This was how I found the 2 bugs in DS ROUTER. DS ROUTER will not let you create firewall rules with individual ports or ranges: OR display rules that were created with port or port ranges correctly. BUT ROUTER CAN! Which is correct?

No HITS have been encountered by those top 2 firewall rules!!! It could be: because no one has scanned. Or, it’s because the rule is invalid. This is not the first time I’ve created a firewall rule that would seem to be correct - yet was found out later to be an invalid rule. It just sits there - gathering No HITS! What this is doing!
So..
Are those rules VALID FIREWALL RULES?
Or is DS ROUTER CORRECT—OR IN-CORRECT?

“Who’s on First?”

Got side-tracked.... Bear on deck

 

[Jan Janowski]

Now that I’m not looking over my shoulder for bears……

I’m thinking that router might be correct, and DS ROUTER wrong, as:
Wouldn’t a:

TCP/UDP, source: INTERNET. ALL IP, ALL PORTS, destination: INTERFACE-ALL, ALL IP, port range ALL, DENY……….

Placed At the top of the firewall list…..

BLOCK EVERYTHING?

Those rules (with ports range) has been in place for 24 hours. And Neither me or Wife has had an issue!

If so, that puts the blame directly at DS ROUTER!
OR — Router Firewall lets you add illegal rules, without a warning! I don’t know which this is!!!

What say — sleuths? Am I wrong???

 

[Jan Janowski]

The AI reply arrived:

They indicate if firewall rule saves port, it is a legal rule.

Suggested: not to edit or save firewall rules with DS ROUTER.

As that was AI, awaiting human intervention, for further clarification.

“

1. Avoid Editing via App:
   Until we narrow this down, please avoid saving or modifying firewall rules through the DS router app if they require specific port settings. This will prevent the app from potentially overwriting your specific ports with an "All Ports" configuration on the router. “