Question When your IP block list has single or more entry

Currently reading
Question When your IP block list has single or more entry

jeyare

Subscriber
2,486
833
NAS
Synology, TrueNAS
Operating system
  1. Linux
  2. Windows
Check your Control panel/Security/Account .... Allow/Block list
when you have single or more IPs here in past 30 days something is wrong in your setup of:
- router firewall
- opened ports in router
- router IPS (if any)
- DSM Auto block configuration (Auto block must be enabled, max. 2 Login attempts, max. size of minutes within)
- you or your users frequently forgetting your usr/psw

Then it's a time to check it, because dark power is watching you.
 
2,192
928
NAS
DS220+ : DS1019+ : DS920+ : DS118 : APC Back UPS ES 700 — Mac/iOS user
I have account blocks registered almost daily –after one wrong attempt to access mail as I set it– because port 25 is open. Sometimes even over 10 attempts/day.
 

jeyare

Subscriber
2,486
833
NAS
Synology, TrueNAS
Operating system
  1. Linux
  2. Windows
I have lot of public services running in my NAS farm. Also I have public fixed addresses. Till May it was 20-50/ daily blocked IPs by my NAS.
But from May when I was changed the network topology I have zero attempts from external IPs to be written in my NAS Block list.
 

fredbert

Moderator
NAS Support
Subscriber
4,075
1,614
NAS
DS1520+, DS218+, DS215j
Router
  1. RT2600ac
  2. MR2200ac
  3. RT6600ax
Operating system
  1. macOS
Mobile operating system
  1. iOS
I generally have SRM's Threat Prevention blocking scans and various perceived threats. Sometimes I add a specific SRM FW deny rule for the class B subnet and monitor it for a while and later add just that IP to the block list if they come back again.

On DSM I don't get any automatic blocked IPs. I changed the default ports and don't allow SSH login from the Internet. For inbound Mail Server I've an SRM FW rule to permit forwarded mail from my email service and a second rule to block from everywhere else (in case the NAT rule enables forwarding from anywhere).

I use DSM FW but mostly SRM's since migrating from Apple Airport's 'everyone or no-one' approach to port forwarding.
 
2,192
928
NAS
DS220+ : DS1019+ : DS920+ : DS118 : APC Back UPS ES 700 — Mac/iOS user
Often times it’s like a drive–by shooting for me. Very intense and then it stops.
When a few days go by without a push notification of a block, I go check the Mail service to make sure it’s running :D
 

Create an account or login to comment

You must be a member in order to leave a comment

Create account

Create an account on our community. It's easy!

Log in

Already have an account? Log in here.

Similar threads

  • Question
PF will help you for sure much more then syno fw
Replies
4
Views
1,724
That's one way I suppose. For now, I just have a literally empty index.html file. As in NOTHING in it.
Replies
4
Views
1,521
If your router doesn't have an isolated guest network, just get another cheap wireless router, connect its...
Replies
11
Views
5,578

Welcome to SynoForum.com!

SynoForum.com is an unofficial Synology forum for NAS owners and enthusiasts.

Registration is free, easy and fast!

Top