What are the FAQ (Frequently Asked Questions) about QuFirewall?

Applicable Products:

• QuFirewall

  
  

1. How to use QuFirewall?

   QuFirewall is a firewall management application for your QNAP device. Integrating a powerful and easy-to-use profile system, QuFirewall lets you control and review connections to your device. Click here for details.

2. Why do I keep receiving the message "The number of packets denied has reached the limit of 30" notification?

   This notification indicates QuFirewall has successfully blocked or denied access to your device. By default, QuFirewall sends this notification after blocking 30 attempts to connect.

3. Can I see which IP address was blocked?

   The blocked IP address can be found under QuFirewall > Firewall Profile > Basic Protection > IP access Protection and click [...]

4. What does PSIRT(3) means in QuFirewall rule?

   The QNAP Product Security Incident Response Team (PSIRT) regularly updates the list of ransomware that pose security threats and blocks any associated IP addresses. The following denied IP addresses are included

   • 93.206.246.22
   • 185.10.68.89
   • 185.198.57.185

5. Why still some IP address tries to access my NAS even basic protection is enabled.

   The default rules in basic protection will still allow the IP address originated in the same country. Try using use Geo IP location service (e.g.IP location to identify where the IP comes from.

6. Why System logs shows QuFirewall blocking packets from 127.0.0.1 (localhost)?

   The source IP is 127.0.0.1, but this does not mean that QuFirewall is blocking packets from the system (127.0.0.1). In this case the source IP does not correspond to the IP that has blocked the packet, the Source IP 127.0.0.1 corresponds to the Notification Center origin IP, which is the NAS. That means the system is generating the message, so it is correct to see displayed IP 127.0.0.1.

7. The packet denied message appears too often, can I enlarge number, so it doesn't need to send every 30 attempts.

   Change the Alert message threshold in QuFirewall setting to a large value. For instance, if you receive the message 1 time in a day (this means 30 access attempts were blocked in a day), you can enlarge the value from default value 30 to 210. You will receive the message 1 time in a week (this means 210 access attempts were blocked in a week)

8. How to check which IP address is currently blocked by QuFirewall?

   QuFirewall could record all blocked packets. If user wants to know the detail content of the blocked packets by QuFirewall, go to QuFirewall > Capture Events > Start Packet Capture, after the duration time then save the captured file for analysis.

9. How to view the PCAP file?

   The PCAP file type is primarily associated with Wireshark, you can use the online PCAPNG text viewer to view them.

10. QuFirewall is blocking packets however the NAS is not accessible from the WAN

    QuFirewall is blocking packets however the NAS is not accessible from the WAN and your firewall rules are configured as basic, this could be a complete normal behavior. Click here for details.

11. How to set up QuFirewall to allow VPN connections

    If you want to allow VPN connections to the NAS and you enabled QuFirewall, you will need to add a couple of rules to allow the traffic to go through.

12. Why does the region-based firewall rule fail to work when NAT is enabled?

    The region-based firewall rule works by recognizing network access sources. If the network is configured with a NAT loopback (hairpinning) on the device or the firewall, QuFirewall cannot recognize the original source connection. In such instances, a region-based firewall rule cannot work.

13. What are the default QuFirewall profiles? Why do third-party applications work abnormally after installing and enabling QuFirewall?

    Enabling the “restricted security” profile allows access only to QTS applications. In order to allow access to third-party applications, create an “allow” rule in one of the default QuFirewall profiles to explicitly permit certain traffic across the firewall.

14. If I install and enable the QuFirewall on NAS and it causes the FTP service to become not accessible, what can I do to fix this?

    The FTP service default port is TCP 20-21, you could go to QuFirewall Firewall Profiles > Add Profile > Create Profile, then add a new allow rule for FTP service and move it before “deny all” rule priority.