6

...without snark or jumping down my throat. I genuinely want to know why it's so unsafe.

I'm running a Synology DS920+, with my DSM login exposed through a Cloudflare tunnel. I have 2FA enabled, Synology firewall enabled with these rules in place. I also have this IP blocklist enabled.

After all of this, how would someone be able to break in via the DSM login?

you are viewing a single comment's thread
view the rest of the comments
[-] zedkyuu@alien.top 2 points 11 months ago

If your DS920+ is completely inaccessible to outside your network except for the Cloudflare tunnel, then the Synology firewall and IP blocklist aren't going to do squat for you since all connections will appear to originate from either inside your network or from Cloudflare. So you're 100% dependent on Cloudflare to keep bad actors out.

I'm not familiar with Cloudflare but the impression I had from looking at it was that you can decide which authenticated Cloudflare users can access your tunnel. So it's a matter of credential management. Supposing some bad actor gets your credentials, they would then be able to access the entirety of your NAS, and you're now hoping that there isn't some undiscovered or unpatched security hole that they can use.

[-] wavehockeysandwich@alien.top 1 points 11 months ago

Not true, cloudflare will forward the real IP in the headers, and if your nas is correctly configured (trusts the forwarded header), it can block the source based on IP.

this post was submitted on 23 Nov 2023
6 points (100.0% liked)

Homelab

371 readers
2 users here now

Rules

founded 1 year ago
MODERATORS