QuickConnect and Firewall

[gboy13]

Hello,

Does anyone here know the details for how quickconnect actually works? I have a rule in my firewall blocking all inbound ICMP and that seems to make it so quickconnect does not function properly. Disabling the rule makes it work but don't really want to open it all the way. Thinking maybe whitelist a few IPs for it?

 

[Birdy]

Yes: Synology QuickConnect White Paper

 

[Jan Janowski]

Thanks!

 

[gboy13]

Yes: Synology QuickConnect White Paper

I skimmed that but don't see ICMP or ping mentioned. My guess is it's using ICMP to poke the holes in the firewall but don't see that in the documentation nor have an easy way to put a sniffer on it.

 

[fredbert]

There are different mechanisms that QC uses. I guess the central Internet servers of QC might ping your WAN IP as one of its tests to see if there’s a response, rather than using a UDP or TCP test.

Even though the white paper may not mention ICMP, if you give it more than a skim you will learn how QC works. The only ways it pokes holes in your firewall is when using QC Relay service, in that the NAS initiates the connection out and this is then used to enable inbound traffic.

 

[Jan Janowski]

Have yet to look at document (Thanks), but your incoming block of ICMP in firewall got my attention.
I’ve 4 ICMP rules. In firewall:
Topmost of 4:
Range of LAN IP’s blocking I/O ICMP for security cams,
A range of LAN IP's allowing I/O ICMP for computers,

Forgot! One LAN IP to another WAN IP Allow (This is my check on ISP connection)
and lowest in list- block all ICMP.

With those no QC issues, and in fact have used it worldwide, me and others.

 

[gboy13]

Have yet to look at document (Thanks), but your incoming block of ICMP in firewall got my attention.
I’ve 4 ICMP rules. In firewall:
Topmost of 4:
Range of IP’s blocking I/O ICMP for security cams,
A range allowing I/O ICMP for computers,

Forgot! One LAN IP to another WAN IP Allow,
and lowest in list- block all ICMP.

With those no QC issues, and in fact have used it worldwide, me and others.

Thanks that helped me go down the correct path.

Using packet capture, I noticed that during the QC startup the DS reaches out to global.quickconnect.to and one of the TLS packets triggers an ICMP message to be sent from my ISP - Type 3 code 4 (Destination unreachable fragmentation needed). This behavior is consistent everytime I reboot the DS.

I allowed unreachables through the firewall from the /8 my ISP usually assigns me and boom QC working as intended.

I have no idea why it behaves this way after reading the other document however. Not sure if this is a bug or "feature". IMO this should be documented.

 

[Jan Janowski]

My last entry:the allows for ‘computers’ includes phones and pads in that list. Amazing! now considering phones and pads as computers as much as phones/pads!

 

[Jan Janowski]

Thank you, Birdy for the QC White paper!! Had a smattering of info on it.. Your link filled in the blanks.