Trouble setting up Synology Drive web access over quickconnect

[dslamguy]

I want to access my DS216+, which is at work, from home using Quickconnect and Synology Drive. I cannot seem to set it up and I don't understand how to debug the problem.

At work, I use t-mobile wireless internet. I use the t-mobile box as an access point. Then I have a Synology RT6600ax router and next to it, the DS216+ running DSM 7.2.1 -69057 Update 5. At home I have Verizon FIOS and another Synology router.

First thing to realize is that I have been accessing my DSM from home using gofile.me over quickconnect and it works fine (although a bit slow). So the quickconnect must basically work. Also I am able to access the web portal of Drive using the IP address of my DSM from within the local network at work. So Drive is set up properly.

So now I enabled Drive using the Quickconnect advanced setting. From home, when I use the URL Access via Synology where QCID is my quickconnect ID, I get the error message: Unable to connect to QuickConnect. Permissions to access certain services via QuickConnect are not enabled. Please go to Control Panel > QuickConnect > Advanced > Permission and tick one or more services.
I also tried this from work on the local network using the quickconnect instead of the DS ip address and I got the same error.

When I read the documentation on using Drive over Quickconnect, it did say that you needed a port forwarding rule for port 6690. I tried both adding the rule manually on the router and then I tried using upnp (which I did not have enabled before this) to add the rule from the DS216+ side. Nothing has made any difference.

Does anyone have any ideas. I suspect that t-mobile might be blocking port 6690. Is there a way to work around this with remapping ports? This is where my knowledge begins to falter and I might need some help with configuration in testing remapped ports.

I also have a secondary question. When I enabled upnp on the router, and then looked at the port forwarding list, I see that ports 80, 443, 5000, and 5001 have been mapped to ports starting with 63530. This might be my example of how to test remapped ports, but I do not want external access for any of these services and that was why I had upnp disabled in the first place. Yet I see no way to disable these services to stop the DS216+ from pushing the port forwarding rules to the router. Very annoying!!!! I think I will have to go back and disable upnp even if port forwarding is necessary to fix the drive issue.

I would love to get the community's thoughts on all this.

 

[Rusty]

I tried using upnp (which I did not have enabled before this)

No need for it, and best to close that down

I suspect that t-mobile might be blocking port 6690. Is there a way to work around this with remapping ports?

This port is the default one and baked in. There is no need to change it. So the portal access goes via QC, reverse proxy via 443 for example or via default DSM ports (5000/5001 or any other that you have set). The 6690 is used for desktop and mobile client backup/sync tasks.

At work, I use t-mobile wireless internet. I use the t-mobile box as an access point. Then I have a Synology RT6600ax router and next to it

How are these two configured together? Is the tmobile one with a DMZ setting on it and configured as a DMZ address on the 6600 router? Where have you configured port forward?

While the ISP might be at fault here, it is also possible that you are behind cgnat by tmobile, and having multiple routers on your NAS location raises questions on the pass-through settings.

Yet I see no way to disable these services to stop the DS216+ from pushing the port forwarding rules to the router. Very annoying!!!!

Thats what upnp does, best not to use it. 80/443 are part of DSMs internal reverse proxy and will be accessible all the time as are 5000/5001 (best to change those btw) the default DSM http/https access ports.

 

[dslamguy]

This port is the default one and baked in. There is no need to change it. So the portal access goes via QC, reverse proxy via 443 for example or via default DSM ports (5000/5001 or any other that you have set). The 6690 is used for desktop and mobile client backup/sync tasks.

Now that I see your reply and now that I am thinking about it, all my thoughts about port forwarding may be a red herring. I am trying to access it over the web. That does not use port 6690 anyway. gofile.me works, so why wouldn't Drive work the same way?

How are these two configured together? Is the tmobile one with a DMZ setting on it and configured as a DMZ address on the 6600 router? Where have you configured port forward?

While the ISP might be at fault here, it is also possible that you are behind cgnat by tmobile, and having multiple routers on your NAS location raises questions on the pass-through settings.

The t-mobile modem is simply an AP for the 5G wireless. Only the SRM router is acting as a router. But yes, I have read that t-mobile uses cgnat, so I expect this is true. But see my previous statement. This is all over a web browser, so if gofile.me works over quickconnect, then why wouldn't Drive?

Agreed about upnp. I have disabled it again.

 

[Rusty]

am trying to access it over the web. That does not use port 6690 anyway. gofile.me works, so why wouldn't Drive work the same way?

If you are indeed not using the desktop client then 6690 is off the board. This could be an ISP or other network issue

This is all over a web browser, so if gofile.me works over quickconnect, then why wouldn't Drive?

What happens if you use QC address to connect to your DSM from outside and once inside DSM open Drive as an app? Does that work? Or not?

 

[dslamguy]

If you are indeed not using the desktop client then 6690 is off the board. This could be an ISP or other network issue



What happens if you use QC address to connect to your DSM from outside and once inside DSM open Drive as an app? Does that work? Or not?

I don't understand what you mean by open Drive as an app. I could try enabling DSM for Quickconnect and then seeing if I could connect to the UI using QC. That is an interesting test. Maybe that's now what you are suggesting?

 

[Rusty]

I don't understand what you mean by open Drive as an app. I could try enabling DSM for Quickconnect and then seeing if I could connect to the UI using QC. That is an interesting test. Maybe that's now what you are suggesting?

Correct that was the idea. So if you connect to your DSM using QC and then access the Drive, does it work that way?

Also, can you explain how you are currently trying to access Drive if this is not the method you have tried before?

 

[dslamguy]

I have done some additional experiments.

If I enable DSM under Quickconnect, I am able to access the DSM UI. I am still not able to access Drive over the web from Quickconnect using the URL qcid.quickconnect.to/drive, but the error message changes to 'Sorry, the page you are looking for is not found.".

If I disable DSM, then the same URL has the error message I mentioned before.

 

[Birdy]

Quick Connect is supported for "Synology Drive Desktop utility" and "Synology Drive Mobile"
Source.

 

[dslamguy]

I have more or less figured it out. I can't say that I like the way it all works though.

You must enable DSM under the advanced settings of quickconnect. In fact you do not have to enable Synology Drive there. I also wrote the word Drive in Control-panel->Applications->Synology Drive configuration for Alias. Then it works.

Of course you also then open up the DSM UI for possible login from outside. We are using MFA and complex passwords so I hope this risk is minimal, but I would prefer to be able to separately disable DSM UI access via quickconnect.

No port forwarding or mapping is required.

Thank you @Rusty for your questions. I had not fully understood your questions about trying Drive from the UI because I had never used it that way, so I didn't know that I could do that. But I did figure that out and it helped me debug the issue. @Birdy , your comment caused me to realized that the enable box only covered the desktop utility and drive mobile, so it probably had nothing to do with the web access. I verified that was the case.

 

[Gerard]

I also wrote the word Drive in Control-panel->Applications->Synology Drive configuration for Alias. Then it works.

Yes, The alias is what gives you the /drive in your quick connect (or any domain) url.

but I would prefer to be able to separately disable DSM UI access via quickconnect.

You could also deny DSM app access under the user profile, applications tab.

 

[dslamguy]

You could also deny DSM app access under the user profile, applications tab.

Good point. I have gone through and reviewed permissions and access so that only the one administrator account (no its not named Administrator) can log into DSM. Unfortunately I wish that it was not accessible via Quickconnect, but I don't think that can be turned off without disabling access to Drive.

I use Synology Directory Server, so I had to change domain users' permissions separately. The DSM administrator account is not a domain account.