Gateway 192.168.1.254 can't login FTP Error

[bjprice]

I've put this in the file sharing FTP category for lack of a better idea. In the wee hours of every Sunday morning I get dozens of these warnings emailed to me:
NAS Name: NAS-BJP
Severity: Warning
Date/Time: 2024/08/04 00:30:21
App Name: QuLog Center
Category: Connection Status
Message: [QuLog Center] Failed to log in. User: root. Source IP: 192.168.1.254. Connection type: FTP. Check the permissions and the connection.

and

NAS Alert
NAS Name: NAS-BJP
Severity: Warning
Date/Time: 2024/08/04 00:30:21
App Name: QuFirewall
Category: Security Levels
Message: [QuFirewall] Too many failed "--" login attempts. Added IP address "192.168.1.254" to the denied IP list. IP ban duration: 5 min.

Windows 10 ipconfig reveals:
Default Gateway . . . . . . . . . : fe80::5a60:d8ff:fe6b:1060%11
192.168.1.254
DHCP Server . . . . . . . . . . ... : 192.168.1.254

I have QNAP FTP Server turned on and the QNAP System default gateway is Adapter 1 - which if I understand this at all - is the single Ethernet adapter in my TS251+

These Sunday error messages - dozens of them - are not fatal - everything seems to be working normally - but I'd love to get rid of them.
Suggestions welcome about where to begin or what additional info you need. I use the TS-251+ as a NAS backup device.

Thanks in advance.

[dolbyman]

Does the router pentest? ..Some models do

[bjprice]

The router is an Arris BGW210 supplied by AT&T. I couldn't find mention of pentest or penetration in the manual and similarly couldn't find any mention of these terms in the various screens inside the router. Perhaps I've been looking in the wrong place. FTP passthrough isn't turned on in the router. I'm really out of my depth here.

[OneCD]

https://www.att.com/support/article/u-v ... KM1469600/

Reading this article, I'm unsure whether the router is performing active testing (which would show-up in QuFirewall), or passive testing only.

[dosborne]

Do you need ftp to be running?
Do you need qufirewall to be running?
Can you disable the notifications for events you don't need?
Can you filter to trash the notifications you don't care about?

[bjprice]

Dosborne thank you for your suggestions.

QuFirewall is set to Basic Protection - Enabled; Allow 192.168.1-1-192.168.1.254 I've no recollection whether I set that IP range or QNAP filled in those numbers for me. Event Counts within QuFirewall run ~750-850 every day, every hour. Captured Events and Denied IP Analysis have not been set up to capture anything. I see how I can turn off QuFirewall completely or turn off notifications. I've always assumed QuFirewall was something useful to me. Perhaps not?

I've turned off the FTP Service. Will have to wait till Sunday to see whether that makes any difference. Similarly, I'll try to remember to turn off QuFirewall Saturday evening so it's off Sunday mornings when all the notifications come through.

I'd of course like to figure out what's going on rather than just hide the notifications

[bjprice]

I turned off QuFirewall and QuFTP Service and the notifications, cited in the original post, stopped. I've turned both back on but as I don't know how to remedy the problem, I'll try to figure out how to kill the dozens of notifications I get. At first glance, it's not obvious how to do this. It seems I can specify what notifications I want to get but not how to suppress those I don't wish to see. These dozens of email notifications are easy enough to delete on my PC using the Shift key but a royal pain to individually delete on my Android phone.

[dosborne]

The main question is, do you need qufirewall to be running at all?

If so, what value is it giving you?

Worst case, create mail handling filters to move or delete specific messages that match keywords.

[bjprice]

Unless I completely misunderstand the purpose of QuFirewall, it appears to add another level of protection, beyond robust passwords, intended to keep the outside world from my NAS.

I've put in some mods inside my NAS to keep unwanted firewall and ftp notifications from going to my email. I'll see on Sunday whether they work as intended. I completely forgot about putting appropriate filters in my gmail account to accomplish the same thing. Good suggestion on your part - thank you.

[dolbyman]

The outside world should never be able to reach your NAS through your router NAT (no portforwards)

[bjprice]

I've turned off QuFirewall, made sure I've got the latest firmware and restarted my TS251+. I'm still getting multiple warning messages at 1:03 AM like this:

NAS Alert
NAS Name: NAS-BJP
Severity: Warning
Date/Time: 2024/09/24 01:02:29
App Name: QuFirewall
Category: Security Levels
Message: [QuFirewall] Too many failed "--" login attempts. Added IP address "192.168.1.112" to the denied IP list. IP ban duration: 5 min.
The .112 address is that of the PC I leave on overnight.

Similarly, but with SMB login specified:

[Warning][QuFirewall] Notification from your device: NAS-BJP
NAS Name: NAS-BJP
Severity: Warning
Date/Time: 2024/09/23 01:02:29
App Name: QuFirewall
Category: Security Levels
Message: [QuFirewall] Too many failed "SMB" login attempts. Added IP address "192.168.1.112" to the denied IP list. IP ban duration: 5 min.

Short of killing the messages in my mail filter, how do I stop them at the source?

Thanks for your help.

[dosborne]

If QuFirewall is still generating messages, then it isn't "turned off".

That sort of message is often due to windows credential caching.

[bjprice]

Thank you for your suggestion. Let me know if there is a way to turn off QuFirewall beyond what is shown here:
https://drive.google.com/file/d/1B9cBz4 ... sp=sharing

I never heard of Credential caching - something new to me everyday - but here is the entry I found for my NAS:
https://drive.google.com/file/d/1YjSJlx ... sp=sharing