Noob alert: How to "secure" my NAS/Network

Goose · 9 Dec 2015 at 10:59

I put together my own little Xpenology NAS a few weeks ago and it was my first experience with proper home networking, i'd only ever setup a couple of routers before.

Being completely new to using Synology DSM and configuring both the NAS and connected devices i've had to follow a lot of guides as well as just blindly clicking buttons in order to setup DS Cloud Sync, Plex, Sabnzdb, Sonarr, Kodi etc etc.

My concern is that having made changes to permissions and opening ports in my router and allowing devices outside my network to connect to it (my brother's phone and laptop) I may have inadvertently left the NAS and/or the devices connected to it vulnerable. I thought i'd include a few screenshots of various settings i've changed in the process of trying to configure the NAS, installed packages, devices, router etc in case i've done some something obviously wrong.

Control Panel:

Typical Shared Folder Options:

File Services:

Control Panel > User:

Typical User Settings:

Control Panel > Group

Control Panel > Network:

Control Panel > Info Center

Control Panel > Web Services

Router Port Forwarding (this was for Sab and Sonarr i believe)

Ok so that turned out to be a lot more screenshots than I thought i'd do, hopefully someone might given them a quick glance

Any other general advice would be most appreciated.

Thanks

leigh_boy · 9 Dec 2015 at 11:11

i see you opened 5000 as a http service, and also enabled https but didnt do the port forward for it, i would change 5000 to 5001 and change the protocol from all to tcp

KIA · 9 Dec 2015 at 18:26

Enabling remote web management is incredibly risky.

http://www.theregister.co.uk/2014/08/05/synologys_synolocker_crisis_its_as_bad_as_you_think/

Use VPN if you need remote access. Keep the Synology software patched!

Goose · 9 Dec 2015 at 22:11

KIA said:
Enabling remote web management is incredibly risky.

http://www.theregister.co.uk/2014/08/05/synologys_synolocker_crisis_its_as_bad_as_you_think/

Use VPN if you need remote access. Keep the Synology software patched!

Thanks for that. Should I simply removed to port(s) from my router's port forwarding list and/or disable the HTTP service in the Synology DSM?

KIA · 10 Dec 2015 at 19:05

Removing the port forwarding rule should be enough.

Do you need local web access to the unit?

Goose · 11 Dec 2015 at 00:35

KIA said:
Removing the port forwarding rule should be enough.

Do you need local web access to the unit?

All i was looking to do was setup DS Cloud/Sync to run on my brother's iPhone and laptop in order to sync a folder for photo's and whatnot. I'd like to allow him access to my Plex server too but that's of secondary importance.

HungryHippos · 15 Dec 2015 at 01:03

Yeah I wouldn't open the web admin login myself if I could avoid it, I have port forwarded a few things but not the ability to logon to my NAS and change anything that way.