Locked out of my NAS!

Currently reading
Locked out of my NAS!

65
9
NAS
DS118
Operating system
  1. Windows
Mobile operating system
  1. Android
  2. iOS
OK, so I've been out of town for a week. Tried to access the NAS remotely with quickconnect but no-go. tried several time over several days but nada. Got home and sure enough, the NAS (DS218play) was off (I'm guessing a power outage but no other electronic items were flashing their clocks). Turned it back on and can access my files on the internal network but when I try to connect to the DSM interface (http://DS218:5000) I get a IP address blocked due to exceeding maximum number of login attempts. NO SH_T!

So how do I now access the settings on my NAS and how can I get it to resume power-on status after a power outage?
 
65
9
NAS
DS118
Operating system
  1. Windows
Mobile operating system
  1. Android
  2. iOS
Never mind, I was able to get access via the iphone app and cellular service. And I found the location to have the NAS resume after power failure.
 

fredbert

Moderator
NAS Support
Subscriber
2,595
1,053
NAS
DS1520+, DS218+, DS215j
Router
  1. RT2600ac
  2. MR2200ac
Operating system
  1. macOS
Mobile operating system
  1. iOS
You can add your LAN IP or IPs to the allow list in the Allow/Block List.
 
65
9
NAS
DS118
Operating system
  1. Windows
Mobile operating system
  1. Android
  2. iOS
Yes, so the “blocked IP address” was my internal router? That seems a little weird- you’d think it would be blocking the IP address of the external source trying to get access (?)
 

fredbert

Moderator
NAS Support
Subscriber
2,595
1,053
NAS
DS1520+, DS218+, DS215j
Router
  1. RT2600ac
  2. MR2200ac
Operating system
  1. macOS
Mobile operating system
  1. iOS
You would but is there any source NAT happening?

Can you run a VPN server on the router? That way you may be able to assign VPN clients to a different subnet.
 
65
9
NAS
DS118
Operating system
  1. Windows
Mobile operating system
  1. Android
  2. iOS
Yes, my router's external IP address is different from its internal address (192.168.1.1). I meant the hacker's (?) external IP address.
 

fredbert

Moderator
NAS Support
Subscriber
2,595
1,053
NAS
DS1520+, DS218+, DS215j
Router
  1. RT2600ac
  2. MR2200ac
Operating system
  1. macOS
Mobile operating system
  1. iOS
OK, I read it that you have two layers of routers and the internal router's IP address had been seen as the source IP by the NAS.
 
65
9
NAS
DS118
Operating system
  1. Windows
Mobile operating system
  1. Android
  2. iOS
Well, there was a router at the other location (100 miles away) that I was trying to access my home NAS from, I thought that would be the IP address that was blocked but it was my home router that was locked out. Is that how this works?
 

fredbert

Moderator
NAS Support
Subscriber
2,595
1,053
NAS
DS1520+, DS218+, DS215j
Router
  1. RT2600ac
  2. MR2200ac
Operating system
  1. macOS
Mobile operating system
  1. iOS
No, you're assumption is right. Can't see what reason that the block would be your home router's internal/LAN IP, unless you used QC relay and that (somehow) results in the NAS thinking the source IP is the router.
 
65
9
NAS
DS118
Operating system
  1. Windows
Mobile operating system
  1. Android
  2. iOS
Last edited:
OK, I'll stay on this post as I think my new issue may be related. I have a DS218play with 2x10TB WD Gold drives about 60% full. This morning I woke up to about 15 messages saying my volume was full. When I checked the NAS, sure enough, it was 99% full. I look at the files and there's only 5.6TB of file space occupied but when I look at properties, it say I am 99.5% full! It's like the drive has been filled with hidden files!

Have I been hacked since I temporarily turned off some security features because of the above issue or is there something else going on?

EDIT: I'm back to being blocked out from my local network since turning autoblock back on. WTF???!!!
 

fredbert

Moderator
NAS Support
Subscriber
2,595
1,053
NAS
DS1520+, DS218+, DS215j
Router
  1. RT2600ac
  2. MR2200ac
Operating system
  1. macOS
Mobile operating system
  1. iOS
I can't say either way. Be sure your backups are isolated, just in case.
 
65
9
NAS
DS118
Operating system
  1. Windows
Mobile operating system
  1. Android
  2. iOS
Fortunately, I have multiple backups but my DS218 is basically unusable right now and I don't know why.
 

fredbert

Moderator
NAS Support
Subscriber
2,595
1,053
NAS
DS1520+, DS218+, DS215j
Router
  1. RT2600ac
  2. MR2200ac
Operating system
  1. macOS
Mobile operating system
  1. iOS
OK, but 'new, big hidden files' isn't much information to work with.

R.e. being blocked again: Are you connecting directly using the NAS's LAN IP? That would ensure that the client device will be seen as its LAN IP. Also, you mentioned HTTP in the first post but I assume you really use HTTPS.
 
65
9
NAS
DS118
Operating system
  1. Windows
Mobile operating system
  1. Android
  2. iOS
"OK, but 'new, big hidden files' isn't much information to work with."

1. True, but I can't see anything so that's all I have to go on(?!)

2. Connected directly to the LAN router by ethernet cable, both computer and NAS (no wireless)

3. Connected directly to 192.168.1.4 ("not secure") on the local LAN.
 

fredbert

Moderator
NAS Support
Subscriber
2,595
1,053
NAS
DS1520+, DS218+, DS215j
Router
  1. RT2600ac
  2. MR2200ac
Operating system
  1. macOS
Mobile operating system
  1. iOS
"OK, but 'new, big hidden files' isn't much information to work with."

1. True, but I can't see anything so that's all I have to go on(?!)
File name / names, owner + group, time stamps , size /sizes, location / locations. Log data of access and activity.
 
65
9
NAS
DS118
Operating system
  1. Windows
Mobile operating system
  1. Android
  2. iOS
Well, I don't know if there is a hidden file because I can't see anything (so I don't know its file name, owner, time stamp, size, location, etc). I have Windows' "view hidden files" turned on but I don't know if that works on a network drive.

Here's the log since the drive was first put into service in May:

Well, it won't let me post the entire file so here's the log since weird things started happening: (too big).

System​

LevelLogTimeUserEvent
Information​
System​
2021/07/21 10:10:35​
Dad​
Disabled auto block service.​
Information​
System​
2021/07/21 08:06:32​
Dad​
Enabled auto block service.​
Information​
System​
2021/07/21 07:53:18​
SYSTEM​
[Synology Drive Server] service was started.​
Information​
System​
2021/07/21 07:52:57​
SYSTEM​
System successfully registered [24.211.xxx.xxx] to [xxxxxxx.synology.me] in DDNS server [Synology].​
Information​
System​
2021/07/21 07:52:36​
SYSTEM​
System started to boot up.​
Information​
System​
2021/07/21 07:50:34​
SYSTEM​
[Synology Drive Server] service was stopped.​
Information​
System​
2021/07/21 07:50:31​
Dad​
System started counting down to reboot.​
Warning​
System​
2021/07/21 05:58:37​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Warning​
System​
2021/07/21 05:35:09​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Warning​
System​
2021/07/21 05:13:19​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Warning​
System​
2021/07/21 04:53:35​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Warning​
System​
2021/07/21 04:36:03​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Warning​
System​
2021/07/21 04:18:36​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Warning​
System​
2021/07/21 03:52:08​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Warning​
System​
2021/07/21 03:25:05​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Warning​
System​
2021/07/21 02:58:25​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Warning​
System​
2021/07/21 02:31:59​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Warning​
System​
2021/07/21 02:18:21​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Warning​
System​
2021/07/20 22:14:26​
SYSTEM​
Space of [Volume 1] was reaching the limit.​
Information​
System​
2021/07/20 18:11:15​
SYSTEM​
System successfully registered [24.211.xxx.xxx] to [xxxxxxxx.synology.me] in DDNS server [Synology].​
Information​
System​
2021/07/20 14:03:32​
SYSTEM​
[Synology Drive Server] service was started.​
Information​
System​
2021/07/20 14:03:13​
Dad​
Package [Synology Drive Server] has been successfully installed.​
Information​
System​
2021/07/20 14:01:56​
Dad​
Package [Synology Application Service] has been successfully installed.​
Information​
System​
2021/07/20 14:01:39​
Dad​
Package [Node.js v12] has been successfully installed.​
Information​
System​
2021/07/19 19:59:59​
Dad​
Package [Log Center] has been successfully installed.​
Information​
System​
2021/07/19 19:52:43​
Dad​
System successfully started Power Recovery​
Information​
System​
2021/07/19 19:49:51​
Dad​
Disabled auto block service.​
Warning​
System​
2021/07/19 18:11:20​
SYSTEM​
System booted up from an improper shutdown.​
Information​
System​
2021/07/19 18:11:18​
SYSTEM​
System successfully registered [24.211.xxx.xxx] to [xxxxxxx.synology.me] in DDNS server [Synology].​
Information​
System​
2021/07/19 18:10:55​
SYSTEM​
System started to boot up.​
Information​
System​
2021/07/14 18:37:57​
SYSTEM​
[LAN 1] link down.​
Error​
System​
2021/07/14 11:38:57​
SYSTEM​
System failed to get External IP.​
Information​
System​
2021/07/13 13:37:29​
SYSTEM​
System successfully registered [24.211.xxx.xxx] to [xxxxxxx.synology.me] in DDNS server [Synology].​
Information​
System​
2021/07/12 13:37:29​
SYSTEM​
"​
Information​
System​
2021/07/11 13:37:29​
SYSTEM​
"​
Information​
System​
2021/07/10 13:37:29​
SYSTEM​
"​
Information​
System​
2021/07/09 13:37:50​
SYSTEM​
"​
Information​
System​
2021/07/08 13:37:58​
SYSTEM​
"​
Information​
System​
2021/07/07 13:37:29​
SYSTEM​
"​


 
65
9
NAS
DS118
Operating system
  1. Windows
Mobile operating system
  1. Android
  2. iOS
I'm beginning to think that the only way out of this mess is to reset the NAS, wiping the drives clean, and then reloading all my files (about 5.6TB - will take about a week)!!!
 
375
152
NAS
DS212J, DS214play, DS216, DS216play, DS414, DS918+, RS816
Router
  1. RT2600ac
  2. MR2200ac
Operating system
  1. Windows
Mobile operating system
  1. iOS
Do you have Download Station or Drive running on the DS218? Either could account for large numbers of big hidden files. In Download Station's case, local copies of downloaded torrents; and in Drive's case, older versions of changed backups or files.
 
65
9
NAS
DS118
Operating system
  1. Windows
Mobile operating system
  1. Android
  2. iOS
Yes, I did install Drive yesterday (the day before the drive filled itself). But I haven’t made any significant modifications to files since then, so there shouldn’t be any huge backups (?). Unless the NAS tried to back itself up onto itself I don’t know what could have caused this.
 

Telos

Subscriber
1,717
573
NAS
DS418play, DS213j, DS3622+, DSM 7.1.4-11091
Yes, I did install Drive yesterday (the day before the drive filled itself).
Hopefully your unit is not ext4 formatted, as that could explain the capacity drawdown if you activated versioning.
 

Create an account or login to comment

You must be a member in order to leave a comment

Create account

Create an account on our community. It's easy!

Log in

Already have an account? Log in here.

Similar threads

Full factory reset returns you to an "out of the box" condition.
Replies
12
Views
121
Replies
12
Views
225
Not sure I have heard or seen a "red" power light on a Syno model before apart from the small LED on RS...
Replies
1
Views
139
There's nothing that makes an old NAS keep on working longer than buying a new one and re-purposing it as...
Replies
3
Views
128

Welcome to SynoForum.com!

SynoForum.com is an unofficial Synology forum for NAS owners and enthusiasts.

Registration is free, easy and fast!

Trending threads

Top