Blocking Ethernet access to QNAP NAS

[#1]

Hi, I have a Plusnet Hub One router, and I’m trying to setup my new QNAP NAS with it.

The NAS is connected to No3 Ethernet port. I wish to completely block all internet access to the NAS by blocking/disabling the Ethernet port it’s connected to. It will be accessible via my local network only, and eventually connected to my Nvidia Shield/Plex.

I’m really struggling to block internet access to the QNAP, as no matter what settings I select the router just keeps it connected to the internet.

I thought that the Plusnet Access Control feature was the key to this, but I simply cannot disconnect this device from the internet.

Can anybody please explain clearly and concisely how do I block off an Ethernet port on this model of router, so that a device is permanently disconnected from the internet?

Any help appreciated, as I’m struggling hugely with this issue.

Regards,

Toffeeman.

[#2]

To work the NAS has to be connected to the hub to communicate with your other network devices so you can’t block it. You should find the settings to stop the NAS having access to the outside world is in the NAS not the hub.

[#3]

Thanks for the reply. 

So, I’m looking in the wrong area then. I’m a noob at networking/etc.

I’ll shift my focus back to the NAS then. I did play with the settings, but I couldn’t disconnect it. I’ll try again. 

[#4 · Accepted solution]

@Toffeeman 

Have you seen this?  https://forum.qnap.com/viewtopic.php?t=138852

At the router you should switch off UPnP and make sure that no port forwarding rules have been set.

The key is probably UPnP because this tends to be set by default.

I will leave it to you to sort out other things that you can do in the QNAP.

[#5]

Yes, I did find this page. I have it bookmarked with a couple of others, and I’m going to work my way through them. I have uPnP disabled on both my router and my NAS, so I think I’m heading in the right direction.

I don’t think it’s worked thus far, as my QNAP firewall is still reporting packet attacks/blocks, my NAS browser/login page is showing “Not Secure” instead of HTTPS, and the NAS IP address still starts with 192 which I assume means that it’s still connected to the internet.

[#6]

@Toffeeman 

I’m assuming that your NAS IP address is 192.168.1.xxx? That’s because it’s connected to your Hub. What you have to realise is that to communicate with other devices on your home network you must have them connected together. What you have to do is block your external Internet connection from accessing the NAS. Have you checked that the router has not had port forwarding set automatically from the time that UPnP was enabled? If so delete this setting.

[#7]

Hi,

Yes, my NAS IP address is indeed 192.168.1.xxx.

I’ve checked my router settings. There are no port forwarding entries at all, that covers all aspects including devices, games and applications.

uPnP is disabled on my router and also my NAS.

I haven’t had chance to play with it today, but I’ll update this thread with the solution once I’ve sorted it out. 

I have another query for you, will my NAS IP address prefix change from 192 to anything else once it’s on my local network? The reason I ask is that I’ve seen a tutorial on YouTube of someone setting up a QNAP NAS without connecting to the internet, and his NAS had a 169 prefix. Would you expect mine to change or will it always be 192?

Thanks in advance. 

[#8]

Hi @Toffeeman 

In an earlier post you have made an incorrect assumption.

Any device connected to your Hub One (modem/router) via WiFi or the yellow LAN ports are on your local network and will have an IP Address assigned to them by DHCP service on the router within a range between 192.168.1.64 and 192.1568.1.253. The router IP Address is 192.168.1.254. From the router home page if you navigate to Advanced Settings >Broadband >Internet you will see the public IP Address.

None of your devices with an IP Address of 192.168.1.x are directly connected on the Internet, they are hidden behind the Hub One public IP Address, https://whatismyipaddress.com/ will prove this.

IP Address starting with 169.x.x.x are usually a result of a device not finding an active DHCP service on the network its connected to or it's not connected to any network.

Turning off upnp should prevent your NAS drive creating any port forwarding rules for it.

Firewall reporting BLOCKED traffic usual means it's working correctly, some example of the messages of concern would be useful.

Dan.

[#9]

Hi Dan,

I’m a noob with networking so I’ve made plenty of incorrect assumptions. Happy to be educated/corrected on the wrong ones.

The QNAP firewall, and general security, is supposed to be substandard hence my desire to go off grid. The hardware suits my needs, but the internet side of things does not.

I’ve read that a correctly setup NAS (ie one not connected to the internet) shouldn’t be receiving packets/attacks as this means it’s visible to outside parties. Is this correct?

Thanks. 

[#10]

@Toffeeman 

Have you got both the Plusnet firewall, set in your account and your hub firewalls both turned on?

[#11]

@Toffeeman 

Assuming you have not turned off the Hub One firewall or put the NAS drive in the DMZ it should not be seen on the internet, unless port forwarding rules have been setup and then the device would only be visible on the port which which has been opened on the forward rule.

example

If I had an IP camera on IP Address 192.168.1.20 which listens on port 65500  and I want to connect to it from the internet, I'd set up a port forward rule to pass any TCP connection to my public IP Address on port 65500 to IP 192.168.1.20. This would be open to everyone, but if someone tried to connect to my public IP on any other port it would be blocked.

You can test for open ports on your network

https://www.canyouseeme.org/  and https://www.yougetsignal.com/tools/open-ports/ 

Hope this helps

Dan

[#12]

They are both on. The router firewall is labelled/configured as below:

1. Port Forwarding - Nothing is setup under this section. 
2. UPnP - This is set to off. 
3. DMZ - This is set to NO.

4. IPv6 Pinholes - No options here as it says my network is not enabled for this. 
5. Configuration - Set to default. (Allow all outgoing connections and block all unsolicited incoming traffic. Games and application sharing is allowed.)

That’s all that is under the firewall tab.

[#13]

Dan,

I think I may have done it then. I think my port is 8080 for my NAS, which is showing closed on my network.

Is that all I need to do?

[#14]

Hi @Toffeeman 

I joined this thread to help clear your confusion regarding IP Addresses

Not having any idea which NAS drive you are using I would not like to comment on what port 8080 is used for.

You have confirmed the Hub One firewall is setup correctly and  that you do not want the NAS drive exposed to the internet then you will not be wanting to add any port forwarding or use UPnP

Wish I could help more, but I'd suggest you refer to the QNAP forum for advice. 

Dan.

[#15]

@Toffeeman - I have both QNAP and Synology NASs, and if they are anything like mine they will support 2FA for account login. To enable it on the QNAP login and select Options from the drop down list of options on your user name. There you should see the 2-step Verification tab use that to enable it.

I use the Authenticator app (by Matt Ruben) on my iPhone.