…without snark or jumping down my throat. I genuinely want to know why it’s so unsafe.
I’m running a Synology DS920+, with my DSM login exposed through a Cloudflare tunnel. I have 2FA enabled, Synology firewall enabled with these rules in place. I also have this IP blocklist enabled.
After all of this, how would someone be able to break in via the DSM login?
Zero day exploits.
Kinda like the others have stated, you’re trusting the company to have fixed any known vulnerabilities, but also that there aren’t any unknown exploits.
Ultimately the question isn’t should you or not, but is the risk worth it? If your home finances are contained there in, if those impossible to recover or reproduce pictures are stored on there, then if you were to have your system locked with ransomware, how important is that data? Do you have their camera system? Would you mind the random internet looking at those cameras? That’s the real question.
If you only have some downloads you could find again and if you lose everything on the system, then you’re not risking much, so it’s kinda why not?
The other risk to that is they’d possibly gain access to your internal network through your NAS. No telling what a bad actor would do.
Much more likely to gain access via a compromised desktop, or smart phone.
The NAS runs its own OS and is just as vulnerable as a desktop or smartphones. They’re all computers.
It’s bad enough we have to trust VPN server code; but at least that should be the only thing you have to trust public facing.
VPNs are complicated enough that security experts are the only ones typically working on them… and they have a relatively small surface area with few 3rd party dependencies. So it’s about the best you could hope for. I agree there’s still a deep amount of trust. Your OS is generally a greater threat though… and your network gear probably a lesser one.
Where something like synology’s web admin involves a webserver running their software on a runtime (php? Python?) possibly with a database where the webserver, runtime, db drivers, db engine, orm, web framework, and all their third party modules are under continuous development and may not be patched. Plus they’re a targeted system because of their popularity. And they’re meant to be user friendly more than secure.
But having a Cloudflare reverse proxy helps a little. So would running something like fail2ban on the logs or a software level firewall configured to detect abnormal data.
Better would be to simply require a client certificate that you generate and distribute from an offline CA and have cloudflare do tls termination then whitelist only their IP(s) and your intranet IPs on the synology firewall.
Or… just use a VPN lol
I have setup a wireguard in server with dedicated ip. I followed the documentation and open few ports nothing else regarding security. I connect my home machine and my phone when needed to the wireguard serverso I can access jellyfin and other services.
Do I need to setup anything else, or is it already secure?
One more thing, is it recommended to connect my proxmox host to the wireguard VPN?
It’s a matter of risk tolerance and how much you trust Synology.
It’s basically the same as any other time people expose something to the internet.
Most don’t know what they’re doing or how to do it safely so they put a vulnerable device out in a vulnerable state.
The only reason a NAS is worse is because it’s more common for a home user to have a NAS then it is to do something like host a WordPress, and a NAS has more personal stuff than a WordPress does (usually)
I’m by no means any security expert, but my 2 cents are these:
- Zero-day attacks, where the name refer to how many days a vulnerability has been known when first used. These are more or less impossible to safe-guard against. The only thing that would delay an attacker in your setup is 2FA. But can you be sure there aren’t any weaknesses or vulnerabilities on your 2FA setup? Kaspersky mentions a few interesting zero-days on their resource center.
- Blocking all countries except the one you live in can create a false sense of security because VPS are a thing and hosted in most countries. That means that a malicious person could spin up a VPS in a country which is allowed to access your public-facing address.
- Depening on what kind of services you run, there could be privilege escalations which could grant an attacker with more leverage to find weaknesses in software. I think Darknet Diaries’ episode on the LinkedIn incident explains this well.
