For the past few months I regularly see alerts on my Synology about SSH connection being blocked. Somebody (here a nice Chinese guy from 188.8.131.52) was attempting to connect to my NAS with the root account (Fortunately PermitRootLogin is disabled).
What I am a bit worried because if I see a public address here, it means my NAS is somehow reachable from the internet. However all ports are closed on my front router, NAT is disabled, DMZ is disabled.
When I try to
nmap my router from the outside I get this :
$ nmap -Pn -p- x.x.x.x Starting Nmap 7.60 ( https://nmap.org ) at 2020-05-17 01:07 CEST Nmap scan report for x.x.x.x Host is up (0.012s latency). Not shown: 997 filtered ports PORT STATE SERVICE 113/tcp closed ident 2000/tcp open cisco-sccp 5060/tcp open sip Nmap done: 1 IP address (1 host up) scanned in 8.23 seconds
So there is no SSH entry point.
How would it be technically possible to see a public IPv4 address attempting to connect to my LAN NAS?
From the Synology DSM I exported the last log entries from the Log Center.
System Level,Log,Date & Time,User,Event, Warning,System,2020/05/16 21:34:44,SYSTEM,Host [184.108.40.206] was blocked via [SSH]. Warning,System,2020/05/04 07:46:14,SYSTEM,Host [220.127.116.11] was blocked via [SSH]. Warning,System,2020/04/15 06:46:01,SYSTEM,Host [18.104.22.168] was blocked via [SSH]. Warning,System,2020/04/13 17:46:00,SYSTEM,Host [22.214.171.124] was blocked via [SSH]. Warning,System,2020/04/13 17:45:55,SYSTEM,Host [126.96.36.199] was blocked via [SSH]. Warning,System,2020/04/12 17:46:52,SYSTEM,Host [188.8.131.52] was blocked via [SSH].
This log is an SQLITE database directly connected to
My router is a Salt Fiber Box from my internet provider. The interface is very primitive. Even the Expert mode gives no transparency about the Firewall features. I don't even know what Medium means in this case:
From symcbean comment three scenarios are possible:
- Something is already inside my network.
- Then I would probably see attacks from local addresses it is stupid to give me the information of what is the IP of my attacker.
- My router is compromised.
- Unfortunately this options is conceivable
- There is an issue with the information I gave.
- As I said, no NAT/DMZ options are enabled on my router (screenshots attached)
- The Synology has no DDNS configured, no tunnels, no VPN
From mti2935 comment
- The router could be compromised, the attacker could have punched a hole for himself only accessible from his own IP (or range of IPs).
- In this case I would expect this attacker to do a more massive attack, not few attempts every few weeks.