Constant Admin login failures from different IP addresses

[dolbyman]

as soon as the nas is behind a nat device (no matter if router or wifi mesh) no outside access should be possible without port forwarding

[keith.uk]

I logged into my QNAP NAS today and I noticed in the system logs that I am getting constant [warning] admin login fail http from different ip addresses by user admin.

Where are the logs that you checked? Thanks.

[jon96789]

Go to Control Panel, System, System Logs, System Connection Logs... Make sure you have it enabled...

[joishere]

Changing the connection ports solved my problem, no more intrusion attempts.

[fnie]

I want to access my NAS using the myQNAPcloud service. Can I still disaple auto router config and upnp? Thanks!

disable auto router config and upnp on your router

without portforwarding there will be no more login attempts

[dolbyman]

this can happen if you dont disable this:

viewtopic.php?f=50&t=160274

check into cloudlink ..no direct exposure (but limited in speed)

[fnie]

Worked. UPnP disabled on the router, auto router config disabled on QNAP. Access to the NAS from the internet still possible using myQNAP-cloud service. Should be safe(r) now. Thanks!

[Audiquattro]

Had the same issue. Every 30 seconds a login attempt from a different ip.
Not forwarding port 8080 (NAS web) solved it for now. Have some other ports that do need to be forwarded.

[AlastairStevenson]

Not forwarding port 8080 (NAS web) solved it for now. Have some other ports that do need to be forwarded.

So no longer letting the entire internet have access to your NAS.
A prudent move.

[apennismightier]

I've been getting this as well. Is there a way to block any IP addresses that try to log in using the "admin" account? I've disabled the admin account purposely for this reason and log in using a different username, but it would be easier to simply block all attempts with the UN "admin" instead of hoping they try to log in twice within a 60 minute period so they can be auto blocked. They're very smart about how much time they space between attempts.

[dolbyman]

do not expose your NAS ..as soon as an exploit is available, you get no notice, just an infection