For the past few months I regularly see alerts on my Synology about SSH connection being blocked. Somebody (here a nice Chinese guy from 222.186.15.158) was attempting to connect to my NAS with the root account (Fortunately PermitRootLogin is disabled).
What I am a bit worried because if I see a public address here, it means my NAS is somehow reachable from the internet. However all ports are closed on my front router, NAT is disabled, DMZ is disabled.
When I try to nmap
my router from the outside I get this :
$ nmap -Pn -p- x.x.x.x
Starting Nmap 7.60 ( https://nmap.org ) at 2020-05-17 01:07 CEST
Nmap scan report for x.x.x.x
Host is up (0.012s latency).
Not shown: 997 filtered ports
PORT STATE SERVICE
113/tcp closed ident
2000/tcp open cisco-sccp
5060/tcp open sip
Nmap done: 1 IP address (1 host up) scanned in 8.23 seconds
So there is no SSH entry point.
How would it be technically possible to see a public IPv4 address attempting to connect to my LAN NAS?
From the Synology DSM I exported the last log entries from the Log Center.
System
Level,Log,Date & Time,User,Event,
Warning,System,2020/05/16 21:34:44,SYSTEM,Host [222.186.15.158] was blocked via [SSH].
Warning,System,2020/05/04 07:46:14,SYSTEM,Host [222.186.30.59] was blocked via [SSH].
Warning,System,2020/04/15 06:46:01,SYSTEM,Host [51.91.158.54] was blocked via [SSH].
Warning,System,2020/04/13 17:46:00,SYSTEM,Host [27.78.14.83] was blocked via [SSH].
Warning,System,2020/04/13 17:45:55,SYSTEM,Host [116.105.216.179] was blocked via [SSH].
Warning,System,2020/04/12 17:46:52,SYSTEM,Host [86.36.20.20] was blocked via [SSH].
This log is an SQLITE database directly connected to syslog-ng
.
My router is a Salt Fiber Box from my internet provider. The interface is very primitive. Even the Expert mode gives no transparency about the Firewall features. I don't even know what Medium means in this case:
Some thoughts
From symcbean comment three scenarios are possible:
- Something is already inside my network.
- Then I would probably see attacks from local addresses it is stupid to give me the information of what is the IP of my attacker.
- My router is compromised.
- Unfortunately this options is conceivable
- There is an issue with the information I gave.
- As I said, no NAT/DMZ options are enabled on my router (screenshots attached)
- The Synology has no DDNS configured, no tunnels, no VPN
From mti2935 comment
- The router could be compromised, the attacker could have punched a hole for himself only accessible from his own IP (or range of IPs).
- In this case I would expect this attacker to do a more massive attack, not few attempts every few weeks.
netstat
on the Synology to see if there is network activty you are not aware of./var/log
directory and maybe anauth.log
file in that directory ?