Synology DiskStation

Thanks. That is a lot of ports if you look at all the services. UDP ports make me nervous. Do you just open 6690 to just the Synology box?

So the Synology box acts as a web server, and needs to be isolated like a web server, right?

Cloud Station - 6690 - TCP

What are you trying to prove Jim?

Nothing. I thought people were saying that Synology did all the security, and the user didn't have to worry about it. I don't see how that's possible. The user needs to open the ports the Synology needs open, and figure out a way to not have those ports open to other boxes than the Synology boxes. That sounds like the user needs to be responsible for the security of the network.

Jim is right. Security is complicated.

If we upload a lot of photos to Google, then we risk someone getting the photos, but not the personal data we keep on our laptop. But if someone jacks our Synology, then we risk all the data on the Synology and even our laptop and desktop computers.

Companies with highly skilled professional staffs get hacked all the time, so we can get hacked at home. At the least, we should understand how to configure out systems to minimize risk and maximize protection.

I thought you were saying that Google handles all your security? Do they not need an open port on your router? I told you before I trust Synology more than Google. I think we must agree that we have different views on the matter and further going back and forth is a waste of time, especially if you ignore time after time significant points raised that contradict your views. I guess that's your corporate education kicking in.

All the best.

And one of the first things I do with my firewalls is shut down all but the ones that I need open. Actually, I shut them all down and open the ones I need. I've never trusted the firewalls that come built into ISP-supplied routers, with the possible exception of the big Cisco routers, but I've never had an ISP let me program their Cisco router.

Leaving all outgoing requests wide open sounds to me like a bug, not a feature.

You ask me questions and then say that further conversation is a waste of time? Sorry I irritated you. OK, I'll not continue any conversation with you, if that is your wish.

This is key. Don't put servers that can be accessed from the 'net on the same network segment as your internal devices.

If your data is stored on a hosting service, that data is at risk, but only that data.

Well, obviously it's far less stressful that's for certain, reading your comments, worries and fears

If the system is hacked, and, for example, root access has been obtained, then you're beyond what can be managed with firewall rules, and everything on your LAN is at risk. I was talking about ways to manage dangerous interactions between devices on your LAN and the 'net in order to keep your devices from being compromised. It's been a surprise to me the outgoing traffic that I found unwanted that I've discovered through firewall logs.

Good luck to you. We all have different risk tolerances and attack modalities that we are concerned with, as well as tolerance for network management. My web sites are attacked 10,000's of times a day, and reading those logs is a bit scary.

On my web sites, anyone logging in with an invalid userid locks that IP address out for a few days. But people have figured that out, and I get strings of attempted log ins using the same bogus userid from 40 or 50 different IP addresses in the space of a few minutes. I also use whitelists of trusted IP addresses that avoid those hurdles, but I use them sparingly and watch the logs.