QuFirewall detects it is hacking itself and generates logs

Don't miss a thing. Post your questions and discussion about other uncategorized NAS features here.
Post Reply
Q-nap
Starting out
Posts: 45
Joined: Fri Jul 30, 2021 10:16 pm

QuFirewall detects it is hacking itself and generates logs

Post by Q-nap »

I've regularly had log files exceeding threshold even when the QNAP is the only thing on the network.

I've captured the traffic and it clearly shows that the NAS itself is generating the errors which it then logs and whines about by sending traffic on four different IPs from the same adapter. Not sure why it does that.

The IPs are;
253.253.253.253 --> 253.253.253.255
10.0.3.1 --> 10.0.3.255
10.0.5.1 --> 10.0.5.255
10.0.7.1 --> 10.0.7.255
With refs for NBNS and Browser.

If this is standard legit traffic why doesn't the firewall already allow it or ignore it? What is it for and can it be stopped?

I also got one IICMP traffic from;
0.0.0.0 --> 224.0.0.1
but I'm putting that down to an anomaly caused at startup of a client.

As they are internally generated I can live with them if I can stop the firewall triggering. How can I get the firewall to ignore them without allowing that traffic.

Any ideas?
Q-nap
Starting out
Posts: 45
Joined: Fri Jul 30, 2021 10:16 pm

Re: QuFirewall detects it is hacking itself and generates logs

Post by Q-nap »

For anyone that is interested. I performed some investigation.

The 253.253.253.253 --> 253.253.253.255 one is a standard internal broadcast message so I'm going to open that up as I set the NAS up to broadcast time messages.

The others are for the container station. One for each bridge.
10.0.3.1 --> 10.0.3.255 --> lxcbr0
10.0.5.1 --> 10.0.5.255 --> lxdbr0
10.0.7.1 --> 10.0.7.255 --> docker0

They are looking for a DHCP server to give them an IP. I've set one for them so they don't need one. Although they were in the application setting which I disabled because I can't edit.
Maik.H.
First post
Posts: 1
Joined: Sun Dec 12, 2021 9:17 pm

Re: QuFirewall detects it is hacking itself and generates logs

Post by Maik.H. »

Thanks I was wondering about the alerts as well.
So to say - it would be fine to mark them as good traffic and create a permit statement for each of them - that the firewall do not log and alert again - right ?
Post Reply

Return to “Miscellaneous”