DB-유

Securing Your Synology: Firewall, Auto Block, and 2-Step Verification

· synology, security, firewall

A few days after I forwarded port 5001 on my first NAS, I opened the log and found a wall of failed logins. Password guessers find an exposed Synology within hours. DSM ships with three defences that cover most of it, and all three are off by default: the firewall, Auto Block, and 2-step verification.

This is the order I set them up on every DSM 6.x box, roughly from most protection to least risk of locking myself out. You'll need an administrator account, your LAN subnet (say 192.168.1.0/24), and a phone with Google Authenticator or any other TOTP app.

1. Get rid of the default admin account

Before touching the firewall, create a new administrator and disable the built-in one. Every bot on the internet tries admin first.

Control Panel → User → Create. Name it something non-obvious, add it to the administrators group, then select the original admin user → Edit → tick "Disable this account". Log out and back in with the new account before continuing.

2. Firewall

Go to Control Panel → Security → Firewall and tick "Enable firewall". Then click Edit Rules for the default profile and add rules in this order. Rules are evaluated top to bottom and the first match wins.

  1. Allow all ports from source IP 192.168.1.0/24 (your LAN).
  2. Allow the specific services you actually publish, for example "DSM (HTTPS)" 5001 and "VPN Server (OpenVPN)" 1194 UDP, source All.
  3. A final rule: All ports, Source All, Action Deny.

Without the last rule the firewall allows anything that didn't match, which makes the whole exercise pointless. Without the first rule you'll lose access from your own workstation the second you apply the deny rule. I learned that one by walking to the NAS with a paperclip.

The firewall is per interface. If you have both LAN 1 and LAN 2 connected, or use a bond, check the interface dropdown and apply the profile to each one, or select "All interfaces".

A quick sanity check from a Linux machine on a different network:

nmap -Pn -p 22,80,443,5000,5001 nas.example.com

Only the ports you intentionally allowed should come back as open.

3. Auto Block

Control Panel → Security → Auto Block → tick "Enable auto block". My usual values:

Login attempts: 5
Within (minutes): 10
Enable block expiration: yes, 30 days

Auto Block covers DSM, SSH, FTP, SFTP, WebDAV, File Station, and the VPN Server package. Add your own LAN and any fixed remote IP to the Allow List tab, so a colleague mistyping a password on the office network does not lock out the whole subnet.

I keep the window short on purpose; a longer one just locks out people who forgot a password. Blocked addresses appear in the Block List tab and can be removed there. You can also see the underlying hosts.deny style list from the shell:

sudo cat /etc/hosts.deny
sudo synologset1 sys info

4. 2-step verification

Two-step verification in DSM uses time-based one-time passwords, so any TOTP app works. Each user turns it on for themselves under Options (the person icon top right) → Personal → Account → "Enable 2-step verification". The wizard shows a QR code to scan and asks for an emergency email address, which is where backup codes are sent if you lose the phone.

Do this for every account in the administrators group at minimum. An administrator can also force it for all users, or for administrators only, under Control Panel → User → Advanced → "Enforce 2-step verification for the following users".

Note that 2-step verification protects DSM logins only. SSH, SMB, and FTP still authenticate with the plain password, which is another reason to keep those ports off the internet.

5. Let Security Advisor nag you

Open Security Advisor from the main menu and run a scan with the "Home and personal use" or "Work and business" baseline. Typical findings on a fresh box are: default HTTP port 5000 still enabled, SSH enabled, DSM auto-update disabled, and weak passwords. Fix the first two under Control Panel → Network → DSM Settings and Control Panel → Terminal & SNMP, then rerun the scan.

Testing it

  • From an outside network, try to open http://nas.example.com:5000. It should time out if you allowed only 5001.
  • Log in with a wrong password six times from a phone on mobile data. The seventh attempt should return "Your IP address has been blocked" and the address should appear in the Auto Block list.
  • Log out and in again with the new administrator. You should be prompted for a six-digit code after the password.

When it goes wrong

  • Locked out after enabling the firewall: press and hold the RESET button on the back for about four seconds until it beeps. This resets the admin password, network settings, and firewall rules but keeps your data. Then redo the rules with the LAN allow rule first.
  • "The verification code is invalid" on every code: the NAS clock is off. Set Control Panel → Regional Options → Time to synchronise with an NTP server such as pool.ntp.org. TOTP tolerates only a small drift.
  • Auto Block never triggers for SSH attempts: confirm SSH is actually listed in the Auto Block scope by checking /var/log/auth.log for synoscgi entries, and make sure the client is not on the Allow List.
  • Your phone was lost and you have no backup codes: another administrator can disable 2-step verification for the account under Control Panel → User → Edit. If you are the only administrator, the reset button procedure is the way back in.

None of this replaces the basics: install DSM updates promptly and keep as few ports open as you can. Honestly, if you only do one thing here, do the 2-step verification.