Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Synology DDNS not work

    Scheduled Pinned Locked Moved DHCP and DNS
    15 Posts 2 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      Guazo
      last edited by

      Hi,

      just installed pfsense and connect my Synology Nas to Lan. I can access to nas via lan and via Internet with http://name.synology.me:5000 but something goes wrong if i try to connect with name.synology.me.

      1 Reply Last reply Reply Quote 0
      • DaddyGoD
        DaddyGo
        last edited by

        Synology behind pfSense is a strange animal pairing, but it works if you consider a few things.
        https://www.synology.com/en-global/knowledgebase/DSM/tutorial/Network/What_network_ports_are_used_by_Synology_services

        To use Synology DDNS, you need port forward to port 443

        Since Synology uses CDN worldwide, make sure your Synology account is active in this menu.

        0b8d90c1-7188-4792-a00d-489c39d9bf5c-image.png

        d6afcb75-1bbc-4be7-8525-3087a2e075d5-image.png

        Cats bury it so they can't see it!
        (You know what I mean if you have a cat)

        1 Reply Last reply Reply Quote 0
        • DaddyGoD
          DaddyGo
          last edited by

          what I forgot: ☺
          in many cases it may be necessary and I suggest that:
          https://www.synology.com/en-global/knowledgebase/DSM/help/DSM/AdminCenter/connection_certificate

          Cats bury it so they can't see it!
          (You know what I mean if you have a cat)

          1 Reply Last reply Reply Quote 0
          • G
            Guazo
            last edited by

            Just did certificate.
            Synology working fine when i connect it directly to router\modem. Only when i connect it behind Pfsense i cannot use xxx.synology.me

            Just tried to forward port 443 but nothing change

            1 Reply Last reply Reply Quote 0
            • DaddyGoD
              DaddyGo
              last edited by

              This is perfectly normal since pfSense is a firewall, not a SOHO router.
              Try this trick, more of our Synology NAS works this way:

              hybrid outbound NAT for Syno

              5a956529-664e-4c0e-8871-8cee188ccf75-image.png

              if Synology can't reach its own CDN network, it can't do a lot of things, can't update packages, or antivirus package, for example....
              (this is a known problem or Synology wants just that)

              Above you mentioned you're trying to connect on http, That's why I suggested https + Let'sEnc / this can be seen in the linked description that it is also required for the DDNS provided by Synology, as it is Synology's own service, i.e. CDN .....

              Cats bury it so they can't see it!
              (You know what I mean if you have a cat)

              1 Reply Last reply Reply Quote 0
              • DaddyGoD
                DaddyGo
                last edited by DaddyGo

                Don't forget, if you are also running IPS / IDS or pfBlockerNG, keep an eye on the logs for what is preventing the NAS from accessing your own CDN network.
                This will be clearly visible in the logs....

                (jahhh and it varies from country to country and region to region.
                Synology tech support couldn’t even give me an IP range (for country CDN) when I first encountered this problem.) 😕

                Cats bury it so they can't see it!
                (You know what I mean if you have a cat)

                1 Reply Last reply Reply Quote 0
                • G
                  Guazo
                  last edited by

                  Ok seems snort blocked my public IP.

                  I quit snort and now, as before, i can reach Nas typing https://name.synology.me/5001or http://name.synology.5000. If i try with name.synology.me give me error 403

                  1 Reply Last reply Reply Quote 0
                  • DaddyGoD
                    DaddyGo
                    last edited by DaddyGo

                    This is not very good, if your Snort config have blocked the WAN public IP because it means it is misconfigured...

                    This parameter is important to Snort / Suricata (this setting does not allow blocking of WAN IP + gateways, DNS servers, etc.):

                    2ecf9777-8864-4893-b7f2-106085cbe19e-image.png

                    Yes, yes the DSM port (5000 or 5001) is also important in the connection header 😉

                    Cats bury it so they can't see it!
                    (You know what I mean if you have a cat)

                    1 Reply Last reply Reply Quote 0
                    • G
                      Guazo
                      last edited by

                      Check, Snort parameters are on default for each two voices

                      1 Reply Last reply Reply Quote 0
                      • DaddyGoD
                        DaddyGo
                        last edited by

                        What does the View List show?

                        b89d3bce-a353-4d8d-a6ae-e9829feb7d5a-image.png

                        and

                        087eda9e-e1e1-40de-ad85-f83cc2aa68be-image.png

                        Cats bury it so they can't see it!
                        (You know what I mean if you have a cat)

                        1 Reply Last reply Reply Quote 0
                        • G
                          Guazo
                          last edited by Guazo

                          No data here

                          1 Reply Last reply Reply Quote 0
                          • DaddyGoD
                            DaddyGo
                            last edited by

                            Then this is exactly the problem with the basic configuration, you have to think through where you made a mistake during the installation.
                            Only based on these parameters does the firewall know who is inside and who is outside (and who shall not be harmed), so the entire firewall is malfunctioning.

                            Cats bury it so they can't see it!
                            (You know what I mean if you have a cat)

                            1 Reply Last reply Reply Quote 0
                            • G
                              Guazo
                              last edited by

                              One problem is solved, the firewall in my modem was still active and blocked port 80 😡 now i can connect to nas via web using name.synology.me

                              About snort how i can solve the problem? Do you suggest to unistall and reinstall snort?

                              1 Reply Last reply Reply Quote 0
                              • DaddyGoD
                                DaddyGo
                                last edited by

                                It may be a good start at first,
                                since IPS / IDS works based on $ HOME_NET and $ EXTERNAL_NET, as shown here, for example the structure of a rule is such:

                                9aaec7e4-ec38-4353-a30a-e6fbd7ad082b-image.png

                                but I suspect there are several problems with NGFW configuration, interfaces, DNS setup, etc

                                Cats bury it so they can't see it!
                                (You know what I mean if you have a cat)

                                1 Reply Last reply Reply Quote 0
                                • DaddyGoD
                                  DaddyGo
                                  last edited by

                                  For security reasons only, external http (80) connections are not appropriate, especially for a NAS, use https, if you want to access the NAS remotely.
                                  Or use Syno's built-in OpenVPN package for external access

                                  Cats bury it so they can't see it!
                                  (You know what I mean if you have a cat)

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.