Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[johnfs04]

Wasn't sure if I should post in the old thread from last year, so I just made a new thread.

4500-A1 hw & 1.02 fw.

Can't connect to my NAS from outside of my network and I don't know where the problem is.

I followed the instructions from portforward.com for the dgl 4500 and opened ports in the advance tab under gaming.  Downloaded the port checker from portforward.com and it was able to see my computer but not the router i think.  From canyouseeme.org it says that my ports are not forwarded.

Following tips from the older thread about this, I made a static ip for my computer and my NAS.  Under the WAN section, I put the primary and secondary DNS server address in under the basic, manual internet setup.  I did not put the host name or mac address in the boxes, so not sure if that mattered.

I have a cable modem and a dynamic ip address.

Hopefully I have given all of the important info regarding this issue.

Thank you in advance for the help.

[fraggboy]

Do you have the Synology in the DMZ?  I personally don't have mine in the DMZ.  Granted, you can.  But, I lock mine down via IP address, with the 4500 in control.

Here are my settings for the different applications (These are the correct ports you need to configure). What you also need to configure (Which I won't show) is set up the Inbound filter (With IP's), and I personally use Dyn-DNS so if my IP changes, I don't have to worry.

Hope this helps..

[johnfs04]

Thanks fragg,

I'm not sure what you mean by DMZ? I have reserved the ip address on the 4500 if that is what you mean.

So you used the virtual server instead of the gaming section for port forwarding?  I literally opened every port possible i think.  I have no idea what to do with the Inbound filter, is there a guide to look at for that?  I used no-ip.com for my ddns and installed their dynamic update client to keep up with the changing ip address.

[fraggboy]

The inbound filter allows only certain IP's/computers to connect through your 4500 to the Synology.

Take a look here (I masked out my public IP's):


If you want to access your Synology at work, go to http://www.whatsmyip.com  (Write down the IP address).

Go to the Inbound filter page, and give it a name (Work/etc), select Allow under Action.
Click the first enable line, and paste in the IP address in the Remote IP Start AND Remote IP End. Click Apply.

You should see the new rule on the bottom.  This will allow your remote computer through the 4500.  After this, the 4500 will check to see if there is any ports redirected to a computer/device behind the 4500 (LAN).  That's when you want to fill out the Virtual Server section. The only thing you want to do is change the IP address (Use the Synology IP address).  The port(s) used is correct for everyone.  It all depends on what you want to access (DS Photo+, Audio, DS File, and actual access to the synology website.  I actually gave myself access to telnet into the Synology from work as well, which most users don't need to do.

Placing a computer/device in the DMZ, will allow ALL traffic (Every port is open to the internet) to that computer/device.  There will be NO firewall protection at all for it!!  As you know, the Synology has a built-in firewall/Brute force detection, as well as a webserver.  If they want to enable this, they would want to configure the firewall, set up their website/blog, and place the Synology in the DMZ.

If you are like me, and want to remote into your Synology and view pictures/stream music, transfer files, and have full control of the Synology, you don't need to put the Synology in the DMZ.

Does that help?  If not, I might have time this weekend to go over your settings via teamviewer.  Also, it would speed things up if we could talk over the phone..  If you are interested, we can PM the details.  In order to test this, we can check on your phone (With a different IP address, or you have access to a computer with a different IP address).

I have the DS audio, and DS photo+ on my android phone.  I have a static ip address for both cell phones, so I don't have to worry about the IP changing (Which cell phones always do once you close out the browser)..  It all depends on what you would like to do.

[johnfs04]

Thanks again fragg,

I wanted access to the synology in the ways that you describe but also wanted to give my extended family and good friends access to my photo's.  I also want to be able to access my files from any remote computer that I need to and through my android phone on mobile data.  Like on vacation or something.  So if I set up the IP filter, then I couldn't do that?

If I just forward the ports like you suggest in the virtual server without the ip filtering, would that still work? 

I am grateful for the help and I am willing to get more in depth over pm or phone, but I have a newborn and it makes it difficult to spend very much time all at once on this.

[fraggboy]

If you want *any* remote computer to have access to your Synology, then you will want to simply put your Synology in the DMZ.  (Easier than setting up individual ports for each application)

Go to: Advanced -> Firewall -> Under DMZ Host, check the box, and input your static Synology IP address.  Hit "Save Settings" button.

When you do this, you don't need to forward *any* ports.  All you have to do is specify the port depending on what you want to connect to (Photo, music, etc).

You will open up your Synology NAS to anyone, meaning they can easily try to brute force the username/password, and possibly crash the Synology.  There is no protection this way.  I would enable the firewall on the Synology, and set up user accounts for your family and such.  I can't assist you setting up the firewall, due to me not using it.

[johnfs04]

The DMZ sounds like it is the easiest solution but unsafe.  Is there anything in the middle?  Is it possible to forward some ports without the IP filtering?

I really appreciate all of your help on this fragg.

[fraggboy]

Yes, it's very unsafe.  If you want protection, I would lock it down via IP addresses.  You can forward just the ports Synology listens to, but still... You risk the chance of people scanning your IP and when they find the Synology 'answering', they will try their brute force tactics, and whatever else they do.

Also, uPnP should only be needed and maybe set Endpoint Independent under firewall instead of using port forwarding rather than using DMZ. If using PF configurations, uPnP needs to be disabled. I would also use GameFuel configurations instead of PF for the NAS if needed.

[johnfs04]

Thanks again fragg for all of your help.  I decided to just forward the ports so that I can share pictures with my family which is large and out of state.

To resolve my issue, I put the ip address of the nas into the forwarding rules instead of the pc's.  I thought that is what the instructions said to do from portfoward.com.  So I still used the gaming section instead of virtual server but I only forwarded certain port from the web applications.