Security - What do I need to do next?

[Huggy]

So I've just read @jeyare's thread that's pinned at the top of this forum. Great post btw, thanks @jeyare. However, like many "unskilled" users It's quite scary and quite overwhelming. I share my NAS with a few family members and might add a couple of friends in soon. I want to make sure all of our data is secure but I'm finding that being responsible for other peoples data is quite an additional responsibility. I've not had my NAS(920+) long but have tried to follow peoples advice on how to set things up securely. Here's where I'm at so far...

I've done everything on this Synology security checklist...

I've also setup reverse proxies with an SSL certificate for accessing the services I have running ie. bitwarden, tautulli etc.
My routers firewall is on and uPNP turned off.
I have 4 forwarded ports for 443, Plex and DSM (NOT 5000,5001). Shields up detects port 443 is open and Shodan detects 80,443 and 32400 as being open.

Photo's are important to me but currently they're backed up to google as well as the NAS. I know I need to sort out off-site backup for things like bitwarden data and users files but not sure how best to do this? (needs to be affordable).

1. So what's next? - What's the most important thing to start first?
2. Is a VPN or the NAS's firewall necessary?
3. I presume it's not possible to secure the open ports any further?
4. Any recommendations for affordable off-site backup storage?

I've seen lots of people advising to read through the posts on the security forum but when you are dyslexic, reading post after post can be difficult. Also, sometimes it's difficult to know what's relevant and what's a bit outdated. So would really appreciate links or just pointed in the right direction rather than just 'go and read stuff'.

Any advice is gratefully received, thanks.

 

[jeyare]

First, I like this approach.

VPN to data operation is a must for all connected to the NAS from WAN.

Re opened ports - here is one of the examples (except external firewall solutions):

I have also hardened some services in RP (Nginx RPM) controlled by access list and enabled just for my selected LAN subnets and fixed or mobile operator IP range.

This is an example from one of my home NAS.

You can find the exact range from this list of IP address blocks allocated for each country (country, then operator):

Major IP Addresses Blocks By Country

list of all major IP address blocks allocated for each country

www.nirsoft.net

Note: For United States, only IP blocks with 65536 addresses or more were added to the list.
Europe is complete here.

When you can't calculate the subnets, use this website:

IP Subnet Calculator for IPv4 | Online Subnet Mask Calculator - Site24x7

Subnet calculator performs network calculations using IP address, mask bits, determines the resulting broadcast address, subnet, and more. Try Site24x7's Online IPv4 subnetting calculator for free.

www.site24x7.com

an example:
Your operator is O2 CZ, then you will find the first range (plenty of them there):
start with: 80.188.0.0 .... Network Adress Block ... step 1
end with: 80.188.255.255 .... Broadcast Address
IP addresses: 65536 ..... No.of Hosts/Subnet ... step 2
then you need to use CDIR notation value: 80.188.0.0/16 ... for the approved range

It is quite better than GEO IP BLOCK in NAS Firewall (allowed entire country), because you can create a more specific range of allowed IP addresses than just "your country".
OFC: it is up to you what kind of service will be covered by what kind of connection.

 

[Huggy]

First, I like this approach.

VPN to data operation is a must for all connected to the NAS from WAN.

Re opened ports - here is one of the examples (except external firewall solutions):

I have also hardened some services in RP (Nginx RPM) controlled by access list and enabled just for my selected LAN subnets and fixed or mobile operator IP range.
View attachment 5017
This is an example from one of my home NAS.

You can find the exact range from this list of IP address blocks allocated for each country (country, then operator):

Note: For United States, only IP blocks with 65536 addresses or more were added to the list.
Europe is complete here.

When you can't calculate the subnets, use this website:


an example:
Your operator is O2 CZ, then you will find the first range (plenty of them there):
start with: 80.188.0.0 .... Network Adress Block ... step 1
end with: 80.188.255.255 .... Broadcast Address
IP addresses: 65536 ..... No.of Hosts/Subnet ... step 2
then you need to use CDIR notation value: 80.188.0.0/16 ... for the approved range

View attachment 5016


It is quite better than GEO IP BLOCK in NAS Firewall (allowed entire country), because you can create a more specific range of allowed IP addresses than just "your country".
OFC: it is up to you what kind of service will be covered by what kind of connection.

Hey @jeyare thanks for taking the time to reply in such detail, I really appreciate it. I think I get it and will have a go at tightening things up this weekend.

As my RP is setup through DSM control panel, I presume I can do this via Synology Access Control Profile, or is there an advantage if I download Nginx RPM?

VPN to data operation is a must for all connected to the NAS from WAN.

This maybe a stupid question but is this something that can be enforced ie. by running a VPN server on the NAS, users can only connect via VPN?

Thanks again