Question When your IP block list has single or more entry

[jeyare]

Check your Control panel/Security/Account .... Allow/Block list
when you have single or more IPs here in past 30 days something is wrong in your setup of:
- router firewall
- opened ports in router
- router IPS (if any)
- DSM Auto block configuration (Auto block must be enabled, max. 2 Login attempts, max. size of minutes within)
- you or your users frequently forgetting your usr/psw

Then it's a time to check it, because dark power is watching you.

 

[Shadow]

I haven't had a single unknown login attempt (from the Internet) ever since I closed ports 5000/5001 on my routers some time ago.

 

[WST16]

I have account blocks registered almost daily –after one wrong attempt to access mail as I set it– because port 25 is open. Sometimes even over 10 attempts/day.

 

[jeyare]

I have lot of public services running in my NAS farm. Also I have public fixed addresses. Till May it was 20-50/ daily blocked IPs by my NAS.
But from May when I was changed the network topology I have zero attempts from external IPs to be written in my NAS Block list.

 

[WST16]

I haven't had a single unknown login attempt (from the Internet) ever since I closed ports 5000/5001 on my routers some time ago.

Aren’t you running Mail Server?

 

[fredbert]

I generally have SRM's Threat Prevention blocking scans and various perceived threats. Sometimes I add a specific SRM FW deny rule for the class B subnet and monitor it for a while and later add just that IP to the block list if they come back again.

On DSM I don't get any automatic blocked IPs. I changed the default ports and don't allow SSH login from the Internet. For inbound Mail Server I've an SRM FW rule to permit forwarded mail from my email service and a second rule to block from everywhere else (in case the NAT rule enables forwarding from anywhere).

I use DSM FW but mostly SRM's since migrating from Apple Airport's 'everyone or no-one' approach to port forwarding.

 

[Shadow]

Aren’t you running Mail Server?

Oh yea that's right. For some reason I haven't seen much login attempts on that lately as wel...

 

[WST16]

Often times it’s like a drive–by shooting for me. Very intense and then it stops.
When a few days go by without a push notification of a block, I go check the Mail service to make sure it’s running

 

[itsjasper]

Closed ports + CG-NAT = Come at me, bros.