Running a service through a Cloudflare tunnel is not exactly the same as "exposing the service on internet". Its more towards a VPN/Overlay kinda approach and not exactly the same as forwarding ports and pointing DNS entries to actually "expose" your service on the wider internet (other users may feel free to correct me here). Still won't recommend this with any "sensitive data" but if all you have is a bunch of music and TV shows then you're good there. At the end it all depends on the level of security that you are willing to work with.
this post was submitted on 23 Nov 2023
6 points (100.0% liked)
Homelab
371 readers
3 users here now
Rules
- Be Civil.
- Post about your homelab, discussion of your homelab, questions you may have, or general discussion about transition your skill from the homelab to the workplace.
- No memes or potato images.
- We love detailed homelab builds, especially network diagrams!
- Report any posts that you feel should be brought to our attention.
- Please no shitposting or blogspam.
- No Referral Linking.
- Keep piracy discussion off of this community
founded 1 year ago
MODERATORS
It’s kinda like leaving your car unlocked and leaving your purse or wallet visible in your dashboard. Some may see it and choose not to exploit but some people will. What if you didn’t park your car there in the first place?
It's not unlocked though. A better analogy would be that it's locked but out in the open, instead of behind a garage door.
> how would someone be able to break in via the DSM login?
They probably couldn't. But, at the end of the day, the risk is yours to take. Nothing is 100% secure; it's all about degrees of security vs usability. You seem to have taken a reasonable approach to protecting the web service, so that's a good start. Other things would be to ensure that access is logged, and that failed attempts are delayed between retries (preventing brute forcing to be completed in a reasonable time) - not sure if Synology has that or not.
Baseline, STiG, Harden. Is you MFA SMS?
Use 2fa and you'll be fine.
your NAS runs software that is neither hardened for nor designed for direct internet access...
synology has had a plethora of exploits over the years... https://www.synology.com/en-global/security/advisory including but not limited to ransomware taking over the nas and encrypting all of your data... and that's just the exploits THEY KNOW ABOUT. synology often takes MONTHS if not over a year to resolve critical issues that normal customers won't be affected by with best practices...
synology's own guidelines clearly state
Do not expose DSM to the Internet unless necessary.
If you must access file services over the Internet, it is strongly recommended that you use a VPN to connect to your Synology device.
direct internet access to your nas is a timebomb. you will lose your data, others will view your data, and you put your entire network at risk by doing do.
It's a matter of risk management, and your personal situation and willingness to sacrifice convenience to reduce risk. There are many aspects that can affect risk, e.g. how often a software is updated, if it's open or closed source, how widely used it is, your personal level of relevant IT knowledge, the likelihood of a serious attack, what you are actually protecting, and so on.
One central rule is that more attack surface leads to a higher risk of security breaches (e.g. by discovering new vulnerabilities), and hiding everything behind a VPN reduces the attack surface to just one piece of software that's mainly focused on security. Additional public entry points add convenience but also increase your attack surface, so you have to find a level you are personally comfortable with.
In my opinion and experience, if an app is made for public access, in a production ready state and already widely used, if you trust the creator in general and with security updates in particular, and if you trust your own knowledge and ability to configure it correctly and keep all the relevant doors closed, then it's completely fine to make it publicly accessible in most cases. The security risk is not zero, but it's way overblown by some people in tech forums.
In your case, the login page behind a CF tunnel with 2FA enabled and yourself on the lookout for possible vulnerabilities sounds like an acceptable level of risk to me, unless the data on your NAS could start a nuclear war or something.
i almost couldn't tell this is an advertisement
Even if your login page is not easy to break, it will be indexed by robots or hackes in their list. And they will test on it every vulnerability that will be published for any DSM component. Using VPNs like ZeroTier or Tailscale is definetly MUCH more secure than all of those tweaks and easier to setup too.
But offcourse its YOUR data so ... good luck :)
With cloudflare authen it is probably gonna be fine with ip block filter etc. it would probably filter 99.999% of the malicious attack already.
But still why do you need to expose it? I only have my jellyfin expose cos idc much about jf data and network cos it on a separate vlan network and stuff. All my management and nas are only accessible through vpn cos i wouldnt need access outside that often only when something happends.
It’s a matter of risk tolerance and how much you trust Synology.
Zero day exploits.
Exactly this. I worked in a data center and when big zerodays hit, you could be certain you were wiping a few servers.
For a home lab, it could be anything from NAS access to the drives or access to your Voip cameras
It's basically the same as any other time people expose something to the internet.
Most don't know what they're doing or how to do it safely so they put a vulnerable device out in a vulnerable state.
The only reason a NAS is worse is because it's more common for a home user to have a NAS then it is to do something like host a WordPress, and a NAS has more personal stuff than a WordPress does (usually)
I'm by no means any security expert, but my 2 cents are these:
- Zero-day attacks, where the name refer to how many days a vulnerability has been known when first used. These are more or less impossible to safe-guard against. The only thing that would delay an attacker in your setup is 2FA. But can you be sure there aren't any weaknesses or vulnerabilities on your 2FA setup? Kaspersky mentions a few interesting zero-days on their resource center.
- Blocking all countries except the one you live in can create a false sense of security because VPS are a thing and hosted in most countries. That means that a malicious person could spin up a VPS in a country which is allowed to access your public-facing address.
- Depening on what kind of services you run, there could be privilege escalations which could grant an attacker with more leverage to find weaknesses in software. I think Darknet Diaries' episode on the LinkedIn incident explains this well.
Did you Google or ask chat gpt about risks of letting bad actors brute force or potentially use some zero day with some crazy url that can let them encrypt all your family pictures and other data? If you want to access from outside do that thru some reverse proxy like find proxy manager or traefik
load more comments
(2 replies)
From experience most NAS drives, cctv boxes are built cheap and dirty. They are often slow and the proud product of a shite company/software developer.
Bad actors are running scripts on their servers, automated looking for know exploits in pages, ports and software. They are actively scanning thousands of WAN facing devices a minute.
Web pages are often written with poor practices. There is little to no care for security but just enough to satisfy the end user.
Java script protected pages (may aswell just write the password on the page)
Usernames and passwords embedded into source code. Session variables stored in cookies in plain text. Vulnerable to session hijacking, man in the middle attacks, and more.
One device we pen tested a few years back allowed access to the settings page without logging in. This is due to a header redirect being incorrectly used. The page served the form and tried to redirect the browser. We just stopped the redirect. Changed the password and logged in normally. Potato Security at its best.
These devices often do not have any rate limiting or firewall, which means brute forcing is nothing but pure playground for a nice database of known usernames and passwords. GPUs are fantastic for brute forcing. The more you have the faster you can test usernames and password combinations.
If you must share file access. Setup a VPN. Tunnel into your network securely and then access your NAS.
Assume everyone is gonna get you.
If you open your login page to internet without security, someone one day will have a field trip inside your NAS files and will find all your "i know what you did last summer" photos.
I do have DS423+ and i am too using Cloudfare tunnel to access it from anywhere.
My CF Tunnel setup done like this:
Domain: nas.example.com points to http://1.2.3.4: and i have 2 access rules added.
One of these rules NEEDS to match otherwise - "You Shell Not Pass"
#1: Public IP needs to be matched as my public IP
#2: Person who wants to login needs to authenticate via Google Authentication. Google authentication needs to match test1@gmail.com or test2@gmail.com
While i am at home, i use nas.example.com to access my nas instead of using its local IP and cloudflare allows access with no questions asked.
While i am outside my home network i get asked to authenticate via google and gain access this way.
+CF Tunnel adds https automatically for me.
I don't use any firewall setup or any other rules inside NAS.
because attackers can now access it. this gives them unlimited amount of times to try and break in. this isn’t as safe as not exposing it to attackers.
Kinda like the others have stated, you’re trusting the company to have fixed any known vulnerabilities, but also that there aren’t any unknown exploits.
Ultimately the question isn’t should you or not, but is the risk worth it? If your home finances are contained there in, if those impossible to recover or reproduce pictures are stored on there, then if you were to have your system locked with ransomware, how important is that data? Do you have their camera system? Would you mind the random internet looking at those cameras? That’s the real question.
If you only have some downloads you could find again and if you lose everything on the system, then you’re not risking much, so it’s kinda why not?
The other risk to that is they’d possibly gain access to your internal network through your NAS. No telling what a bad actor would do.
Much more likely to gain access via a compromised desktop, or smart phone.
The NAS runs its own OS and is just as vulnerable as a desktop or smartphones. They’re all computers.
Yes, but the other computers I listed have a person behind them that will click things. Like a "close" button that actually installs malware. A NAS does not click things.
True, but, what if you host VMs on the NAS? Or data for some application? Those can result in an attacker running code on them, and from there, in most homelab networks, i assume is a short way from owning everything in your network
When you turn your NAS into a hosting platform, it is no longer just a NAS.
load more comments
(4 replies)
HEY MAN,
Just go ahead and get hacked and learn, there’s literally no point in even asking if you lean toward not taking anything anyone says with a grain of salt.
Otherwise VPN or Cloudflare tunnel into the machine.
Bye
load more comments
(2 replies)