Synology DS918+ & Netgate 2100

netboy

@SteveITS said in Synology DS918+ & Netgate 2100:

What Bill said but to expound a bit Windows defaults networks to Public unless they are marked Private when first connected. Annoyingly they don’t use those words it asks something like “do you want your PC to be discoverable” and if you say no it’s marked public. Which triggers a different set of firewall rules often even with third party a/v.

How to make it private? Can you kindly illustrate to how can I achieve this?

netboy

@netboy
History
This all started when I tried to connect my sonos (LAN2) to synology which is on LAN2 - I was uaable to ....So it appears like synology is blocking the connection ....Then I tried PC in LAN2 to connect to synology in LAN2 and same thing...unable to connect

bmeeks

@netboy said in Synology DS918+ & Netgate 2100:

How to tell...Can you please let me know how to figure out if they have the WRONG netmask?

That is networking 101 ... . Here is a good tutorial from CloudFare: https://www.cloudflare.com/learning/network-layer/what-is-a-subnet/#:~:text=A%20subnet%2C%20or%20subnetwork%2C%20is,routers%20to%20reach%20its%20destination.

johnpoz

@netboy said in Synology DS918+ & Netgate 2100:

How to make it private?

This wouldn't really have anything to do with accessing your nas from your PC.. But it would have to do with your PC being accessed by other things on your network.. When in public mode, firewall is going to be more restrictive for inbound traffic, etc..

If you can not ping or access your smb shares on your nas - by IP.. And they are on the same network that screams firewall on the nas.. Even more so if you can access dsm via your browser.

Personally I have little use for the "nas" firewall, its on my trusted network.. Pretty much just my PC and the nas on this network - and the management IPs of my switches.. I have the nas firewall turned off.

netboy

@johnpoz I think you NAILED it - My assumption is if I disable firewall in my NAS this should work - Let me try this and get back

netboy

@johnpoz It worked!!!! Thanks a ton to ALL for help - Sonos can see my library!!!

johnpoz

@netboy Just to be clear, just because I have mine disabled, doesn't mean its a good idea for your network.. You have to make that decision based on your own concerns for the security of your network..

But this shows you for sure it was firewall on your NAS, so depending on your needs/concerns you may want to re-enable it and set appropriate rules for your neeeds.

netboy

@johnpoz I completely understand....my NAS is on the trusted network (LAN1) and any user on LAN2 has ONLY read priviledges....I do understand

netboy

@netboy Another question....

When my NAS firewall was ON, how come my kodi which is on LAN2 was able to access my shares in the NAS?

johnpoz

@netboy from what you posted you have 2 different Ips on your nas - so depending on what IP you were hitting, and what the firewall was setup to allow, etc.

netboy

@johnpoz My kod is on LAN2 (172) and my "secondary" LAN in synology has a LAN2 ip address. So both are in the SAME network and naturally my kodi was able to access the shares (firewall was on in synology) but I do not have any special configuration in my nas (allow or block in my synology NAS firewall is not configured). I do have some "applications" like audio, video etc configured on my synology nas that all source IPs can access.

My question is how kodi (with nas firewall ON) can access my shares and not SONOS? btw kodi and sonos are on the same LAN2 subnet.

Obviously synology is blocking but I am unable to figure this out

SteveITS

@johnpoz said in Synology DS918+ & Netgate 2100:

This wouldn't really have anything to do with accessing your nas from your PC.. But it would have to do with your PC being accessed by other things on your network.. When in public mode, firewall is going to be more restrictive for inbound traffic, etc..

FWIW I would normally agree but Bitdefender for instance blocks printing to a public network, because otherwise the PC may detect and try to install drivers off an untrusted printer/print server. In any case that wasn’t the issue here.

johnpoz

@SteveITS said in Synology DS918+ & Netgate 2100:

Bitdefender

Did I miss where he said he was running bitdefender, and not just default windows firewall?

netboy

@johnpoz said in Synology DS918+ & Netgate 2100:

Bitdefender

I agree with PC but sonos is direct smb connection to nas - bitdefender does not come into this picture....Similarly Kodi is direct connection to nas using smb. Kodi works but not sonos.....I am pulling my hair and unable to figure this out

SteveITS

@johnpoz no, read as “third party a/v, for instance Bitdefender.” I would hope most do…? It was a thing to check, that’s all.

johnpoz

@SteveITS agree for sure.. I just didn't recall seeing that he was running any sort of 3rd party security software on his pc.. But sure - depending what security software your running the setting of private/public could come into play with more than just inbound connections into the pc, etc..

netboy

@SteveITS I am showing my firewall rules in my nas where kodi works but sonos did not . BTW the firewall is ON in nas. My kod is in a different box and not using pc. I am "removing" pc from the picture

the other

@netboy hey,
is that listing complete? For I cannot see any allow for CIFS there...
Can you go and try out setting CIFS to allow and then try again with your sonos system? :)

netboy

@the-other said in Synology DS918+ & Netgate 2100:

Can you go and try out setting CIFS to allow and then try again with your sonos system? :)

Wow that worked!!! Sonos can see the shares NOW with NAS firewall ON - So much shit and flavors about various protocols gets one confused!!! Thank you very much

the other

@netboy btw...you have some rules on your NAS with "source all" and such...might think about either disabling the firewall altogether or define those rules...but thats just my 2 cents... :)
Glad that worked out for you...strange that your kodi can reach via smb/cifs...is there another ruleset for the kodi machine? Is CIFS allowed there?