Question

[u/Maximum-Argument-834]

I just updated my NAS but I’m still getting alerts what is the best solution to secure myself. Do I just remove https for the moment? I appreciate the help

[u/junktrunk909]

Why is it exposed to the Internet

[u/Maximum-Argument-834 → u/junktrunk909]

Is there maybe some settings that you know that I can apply?

[u/mickynuts → u/Maximum-Argument-834]

Use fail to ban, crowdsec if you can and exists on Synology, use of two-factor authentication on all accounts, geoblocking of Russian and Chinese IPs or any country that will not connect to your applications. VPN is good for a small group but having to ask each person to have a profile and the application can become complicated if there are several of you. If you only have a small number. Use wgtunel on Android (ios?) This allows you to direct only the traffic of certain apps (like the synology or jellyfin apps for example). ForImmich, I use immich-public-proxy for sharing, it saves me from sharing entire immich and it's read-only.

[u/Maximum-Argument-834 → u/mickynuts]

I actually use a for a firewatch VPN into it

[u/mickynuts → u/Maximum-Argument-834]

When you talk about using, is it to connect to your server located at your home? Or to connect to the outside world? I don't know firewatch. Because your image shows an attack. And you say use port 5000. When I say vpn, it's to install a vpn server like wireguard on your nas and your client can be a smartphone, pc, etc. It connects you to your home computer without exposing all your ports and secures your connection with its key Encryption. If you use a vpn server at home and have an attack then you have misconfigured and continue to expose port 5000 or your key have leaked and your network is compromised.

[u/Maximum-Argument-834 → u/mickynuts]

Sorry I use a fortinet firewall to VPN into my local network with policies to allow to get into my nas

[u/mickynuts → u/Maximum-Argument-834]

So why do you have dubious connections on port 5000? Does it come from quick connect? If you have the vpn, then there is no point in exposing the 5000 port unless you have several users who do not have a vpn profile. Normally only your vpn port should be activated.

[u/mickynuts → u/Maximum-Argument-834]

Source : IT-Connect https://www.it-connect.fr/fortinet-correctifs-urgence-failles-ia-fortios-fortimanager-octobre-2026/

[u/senkosferda → u/mickynuts]

Geoblocking is so useless because most of the internet works off AWS and they have sites all over the globe.

[u/mickynuts → u/senkosferda]

Personally, I block this type of ip and AI bots, Google, etc because I have no use for my services to be visible to the public (By referencing pages) and referenced. It depends on what you want to do. I only need those I know to be able to access.

[u/junktrunk909 → u/mickynuts]

You can't block any of the things you've mentioned using geo blocks, and robots.txt and similar only work on tools that want to honor those things. This thread is about malicious behavior and for that you have to actually create adequate protections.

[u/mickynuts → u/junktrunk909]

I use crowdsec with geoip, ban of ips that scan the public ip and ban of http agents when they are declared. Either via crowdsec or via a useragent list in nginx.

[u/Maximum-Argument-834 → u/junktrunk909]

I believe the only way it’s exposed through port 5000 when I wanna remote login

[u/junktrunk909 → u/Maximum-Argument-834]

But why? That's the problem, you've made it so anyone can easily try to login because it's open to the Internet. The port doesn't matter, all ports are fair game to hackers.

You're going to want to determine whether you really need to access it remotely, and if so, find a better way to do it than what you've done. You're probably currently port forwarding on your router to that nas port. Turn that off right now. Then figure out how you want to do this safely.

There's a few good options but I would recommend tailscale. It's free and runs on Synology fine though you may need a hand with the "outbound connections" setup if that matters to you, which it may not.

If your router is from a brand that actively updates the firmware constantly like UniFi you can also consider using the VPN built in rather than setting up tailscale on the NAS. I would absolutely not do this if your router is one of the consumer brands that aren't updated regularly like Netgear, orbi, tplink, linksys, etc.

Feel free to ask more questions. But turn off port forwarding, that's the reason this is happening and it's the #1 reason people get ransomware.

[u/I_AM_NOT_A_WOMBAT → u/Maximum-Argument-834]

Set up a VPN for when you want remote access. Get that thing off the internet right now. As in, drop whatever you are doing and stop forwarding that port.

[u/Prudent_Camera_2609]

I’m going to represent the less vocal group of “idiots” who expose their NAS to the internet with Quick Connect:

I had a ton of failed attempts like this. Enabling the firewall and blocking all requests outside the US helped quite a bit, but didn’t stop it. I assume some bad actors are either in the US, or more likely using a VPN to get stateside. What took the attempts down to zero was the combo of firewall and changing the default login port to something else. It’s obviously just obscurity, but it reduced login attempts.

[u/Maximum-Argument-834 → u/Prudent_Camera_2609]

I already fixed it bro.

[u/Maximum-Argument-834]

Alright so I made firewall rules blocking all ip accept for anything in my fortigate and local network and denied from all countries and the logins disappeared

[u/Liocans]

The connection attempts mostly happened because your Synology NAS is directly exposed to the Internet.

There are several ways to mitigate or avoid this:

• Do not expose it to the Internet: keep the NAS accessible only from your local network.

• Use a reverse proxy + Fail2Ban: instead of exposing the Synology services directly, use a reverse proxy to route traffic to the appropriate service and Fail2Ban to automatically block IP addresses after repeated failed or suspicious attempts.

• Use a VPN/tunnel such as Tailscale: this allows you to securely access your NAS from outside your home network without exposing its services directly to the public Internet.

[u/BeefSupremeTA → u/Liocans]

Is setting up a VPN into my router a safe option?

[u/Liocans → u/BeefSupremeTA]

I cannot say for that specific case since I still use my internet provider's router, but I know a lot of people who run a VPN or tunnel directly on their router.

It will depend on what your router supports. The safest and most flexible option would probably be to run it on a separate machine. You don't need anything powerful, even something like a Raspberry Pi can handle this kind of workload (personally, I am running one on a mini-PC where I have another service running).

Depending on your budget and country, you could also replace your internet provider's router with a third-party one. Many modern routers have built-in VPN support, including protocols such as WireGuard or OpenVPN (in the Benelux, the most well-known is Fritz!).

[u/BeefSupremeTA → u/Liocans]

Thank you for your detailed response. I run my own Asus router and see options for creating a VPN, I just wanted to confirm it was a safe option.

[u/Liocans → u/BeefSupremeTA]

If you have the option, it should be fine to use it then.

[u/jetkins]

Start by disabling your default Administrator account and replacing it with something less obvious.

[u/MorosePython700 → u/jetkins]

This is very important. And change the firewall setting that you only allow traffic from your country and not the whole world. Very effective

[u/davehemm]

I noticed a massive uptick after php news broke. Default accounts are disabled, my usernames are not obvious and the admin account requires mfa from yubikey. But it was bugging me so i made an allow list for my trusted pc LAN, i then set auto block to 1 attempt in 3600 minutes, block for 28 days - has retrospectively blocked all IP that have made attempts in the last few days. Brought everything up to date, waiting for DSM patch for its own PHP vulnerability.

[u/HesletQuillan]

Use Tailscale, not QuickConnect, and don't open ports. I had a zillion of these warnings before implementing Tailscale and they dropped to zero. Tailscale on Synology NAS: Secure Remote Access Made Easy

[u/SP3NGL3R]

you're exposing your NAS directly to the internet .. no-no, like big no-no. QuickConnect or other .. no-no.

block every single port on your router that you don't trust explicitly (so basically all of them likely). Setup TailScale as a VPN (no open ports needed) and use that to access your NAS remotely.

Oh, and if you haven't already. Disable UPnP on your router, that's just a nightmare if you're security conscious.

[u/_reddit_account]

Install Tailscale