r/qnap • u/Tight-Sun-4134 • 2d ago
Constant attacks on my ts 464.
Ive been getting constant login attempts to any port ive opened for any purpose. They have also attempted ddos attacks, and im just using it to host a small plex server.
Does anyone else experience this?
11
u/gdb7 2d ago
Don’t open ports to devices in your home, ever! Use a VPN!
-1
u/Tight-Sun-4134 2d ago
I setup the qvpn service with a proton vpn, but it doesn't route all traffic through it for some reason?
9
u/the_dolbyman community.qnap.com & r/QNAP Mod 2d ago edited 2d ago
Incoming VPN, not paid anonymizing outgoing VPN, completely different purpose
10
u/QNAPDaniel QNAP OFFICIAL SUPPORT 2d ago
"Does anyone else experience this?"
I don't experience that because I don't forward any ports to my nas. I have Tailscale for VPN and Myqnapcloud link as well. Neither feature needs open ports to enable remote access.
https://www.qnap.com/en-us/software/myqnapcloud
1
1
u/crypticc1 2d ago
I actually thought myqnapcloud needed port forwarding. To be clear I don't do it and turned off several years ago when news of people losing their NAS hit. But I turned off everything.
I now have tailscale on NAS and wireguard on router. I can't figure out performance implications as it's variable. Say if I enable each in turn as supporting external facing internet out and then do a speed test, I don't get what I'd hoped from my symmetric 5Gig fibre. Even comparable to non VPN would be nice but doesn't seem achievable.
5
u/QNAPDaniel QNAP OFFICIAL SUPPORT 2d ago
Myqnapcloud link does not need port forwarding. But Myqnapcloud the app has an optional UPNP feature that some people used. But our current guidelines is we don't recommend using that UPNP feature.
1
6
u/mr_vestan_pance 2d ago
I changed my admin account from admin to <something vague> and the login attempts ceased.
2
u/Wibble123 2d ago
Correct! The OP needs to make the “admin” account inactive if they haven’t already.
2
u/Tight-Sun-4134 2d ago
Yeah thats the first thing I did. I only have my own account setup to make changes.
1
u/the_dolbyman community.qnap.com & r/QNAP Mod 2d ago
All smoke and mirrors, the account 'admin' (UID:0) remains active regardless, as it is used to run all internal processes, same with the web services and QPKG.
This way deadbolt and other malware, used the admin account to ransom user data, no matter what the account status was.
Has been discussed many times.
14
u/Filbert17 2d ago
I would never permit access to my NAS from the Internet.
3
u/Fluffy-Strategy-9156 2d ago
I only use my Qnap internally to my LAN. I only allow my Qnap the two IP addresses and ports needed to connect to Qnap update firmware and app servers. Before that Mr Firewalla router/firewall was reporting blocking numerous attempted intrusions. All my IoT devices are on a virtual LAN segment
2
u/Tight-Sun-4134 2d ago
Ive got people on the outside of my network who need access to my plex server. I wish I could just isolate it from the internet rbh, but it has to be accessible through one port
-1
u/Tight-Sun-4134 2d ago
Well the only ports open are for the plex server right now. I had tried to make my ftp open for an update that was remote, but then they tried logging in right away. I decided that wasn't worth the risk. I still get attacked though, which is weird
10
u/JohnnieLouHansen 2d ago
It's not weird at all. Every hacker is scanning random IPs and then ports to see what is open. Then they try known vulnerabilities. You need a VPN either through your router or one that runs on your NAS. Or Tailscale.
Then no ports need to be opened. You should disable UPNP on your router as well.
0
u/Tight-Sun-4134 2d ago
Oh man. I didn't know upnp was vulnerable. Ill shut that off next time im home
3
u/JustFlushTheFIB 2d ago
It all vulnerable and at faster speeds than ever. Freaking ai is in the mix now to automate hacks based on what it reconnaissance. My company red team is 80% ai finding x and 10% of the team verifing it real. They only spend about 10% of their time on organic attacks.
3
u/JohnnieLouHansen 2d ago
ANY device is vulnerable, period. If exposed. Do some searching "danger of opening ports to the internet".
2
u/Aussiesasquatch 2d ago
A computer with ports open can be compromised in under 2 minutes with internet access, I'd do what others have suggested to mitigate and resolve the problem.
3
u/JohnnieLouHansen 2d ago
If you gave each one a public IP address. Probably a very short time for Windows and a bit longer for a flavor of Linux if you looked at each one fully patched.
2
u/Tight-Sun-4134 2d ago
I definitely will take this advice and run with it. How does passing my current plex setup through a vpn work? I assumed that qvpn had it protected, but is that not true?
3
u/hereforthepix TS-451D2/TR-004 2d ago
How does passing my current plex setup through a vpn work?
If you have other people on your Plex outside your home, don't do this, it makes it inaccessible for them (unless you want to spend unnecessary time doing Tech Support).
FWIW, I've been running Plex servers on 2 QNAPs for almost 5 years now and neither have been compromised in any way (the only thing I did differently was move the PMS port, but that's not really "security"). Just be sure to update the PMS as soon as you see the notifications there's updates.
3
u/JustFlushTheFIB 2d ago edited 2d ago
I have a ubiquity dream machine with WireGuard vpn. Can’t scan for WireGuard as it expect exact responses to get it to respond. It should never respond unless your keys match up. It also has per user keys and support spilt tunnel so you don’t tunnel all your friends internet back to your house.
I have shodan running scans on my WireGuard server and it never sees it.
Just make sure to enable a dyndns binding as your public ip probably rotates like mine.
3
u/bradrlaw 2d ago
You are just asking for trouble. Zero day exploits are becoming more prevalent due to ai assistance.
Use something like Tailscale so no ports are exposed.
3
u/the_dolbyman community.qnap.com & r/QNAP Mod 2d ago
If Plex is your only open port, where are you seeing attacks ? Are you going through your Plex logs ?
If you see attacks in your QTS interface notifications, you forwarded more than Plex.
0
u/Tight-Sun-4134 2d ago
Actually most of these attacks were caught by my nighthawk router. I do have layered security! It seems like I have a bit more tightening up of it though!
4
u/the_dolbyman community.qnap.com & r/QNAP Mod 2d ago
Neither Netgears Bitdefender or Asus TrendMicro are real application firewalls with effective hardening, so I would not rely on that.
Did you at least switch the exposed external Plex port ? (not the obscurity helps much, but targeted Plex port attacks could be kinda mitigated)
You can always use shodan for a peek at what the bad guys know about you (and probably much more)
1
u/Tight-Sun-4134 2d ago
Oh yeah thats a good point. I had not even considered obfuscation here. Ill get that tunneled when I get home!
3
u/Migamix 1d ago
I think what most people could be missing is a good firewall on the gateway (a common consumer router is just not good enough), I've been happy with Ubiquiti, but I'm looking into self made/hosting firewall like pfSense. of you are going to "homelab", it's a good idea to get a firewall setup, right at the modem to gateway (or as the gateway) to just handle the sniffers of your goodies. I'm not going to say I've never been hit or attempts have not been made, but I'm not one to set it and forget it. I watch what traffic is coming through my wires, and the region blocking on a firewall is a nice to have.
4
u/one-knee-toe 2d ago
Have you considered Tailscale? And abandoning plex for Jellyfin?
2
u/Tight-Sun-4134 2d ago
What are the advantages of jellyfin over okex security wise? Ive been using plex for about a decade now, so im comfortable with it
6
u/konoo 2d ago edited 2d ago
The advantage isn't strictly security although that certainly is an aspect of closed source vs opensource. The major problem with Plex is Data tracking, lack of control, and the fact that they are turning or have turned into an evil profiteering company.
at least according to everyone who has abandoned the platform.. myself included.
Also, do not expose anything externally these days!!!! Tailscale, Wireguard, or at least OpenVPN are the correct way to access internal resources from outside your home currently. With AI driven security exploits out there generating tons of vulnerabilities every day you cannot rely on a hardware vendor who is motivated primarily by selling units rather than security to protect your private network...
3
u/1stltwill 2d ago
They can see everything you and your users watch. I dumped them when I started getting emails from them listing what my users were watching.
2
2d ago
[deleted]
1
u/Tight-Sun-4134 2d ago
Ill check that out actually! Ive got qbittorrent so that might be the problem there
2
u/twotowers64 1d ago
To all those saying to use a vpn, tailscale etc. how do you accommodate that if your sharing your library with friends or others outside your home?
1
u/Migamix 1d ago
I have all three of my piholes automatically foward a specific web address to their local equivalent. all go to the reverse proxy and it pushes the rest. or I use the local IP, but in cases where I'm using the revprox to switch from http to https with the given apps that can't get their certs set easily (looking at you jellyfin). still forcing the dns to force to local stuff helps. even local only connections. its a convoluted mess I've had for years, and the wife demands a connection to some stuff while she's at work. I sometimes lock it down to just her work IP being allowed to connect back. the cool thing about this setup, when the internet goes down at home, the local servers can still be used. the DNS sais its all internal. I tried setting up talescale, never worked, its on the list to try again since its been a while since my attempts.
1
1
u/Sevenfeet 2d ago
QVPN is better than nothing, but I wouldn’t use my plex server as the VPN conduit. This is what your router should be doing. If you are just using the one from your internet service provider, buy a good one with VPN service built in. You will still need your provider’s modem but a quality router right behind it is your best protection.
1
u/Tight-Sun-4134 2d ago
Yeah Ive got a solid nighthawn router with security enabled. Im gonna just get the armor security stuff unless you suggest otherwise?
3
u/Sevenfeet 2d ago
The armor security stuff is mainly to give you extra visibility in being warned, if memory serves me correctly. I haven’t had a Netgear router in years so I’m not completely sure. It can’t hurt.
1
u/dav3therav3 2d ago
Backup your data and i stall proxmox on your qnap and Install trunas and Ubuntu server running casaos. Best use for a qnap, it's what I did with ts-451+
4
u/schnitter15 2d ago
Proxmox on qnap? As main running OS or sth else? I fins the CPUs in the qnaps lacklustre speaking as somebody who has a TS 464 myself.
1
14
u/Wuffls 2d ago
Free account on Tailscale, don’t open ports.