[Help] [TOS6] Firewall rules and Tnas.online remote access

[gustang]

Hello,

I have configured firewall rules on my Terra-Master device. Only specific ports or IPs are allowed, and the final rule denies all other access.

Current Rules (simplified):

- Allow: 80, 443 - ALL //(HTTP/HTTPS)
- Allow: 8181, 5443 - ALL //(TOS ports) – ideally restricted by geo-location, but since Terra-Master does not support this, then currently set to allow all
- Allow: 474 - ALL //(WebDAV) – ideally restricted by geo-location, but since Terra-Master does not support this, it is currently set to allow all
- Allow: ALL - Local networks (192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8)
- Allow: ALL for Trusted external IPs
- Deny: All other traffic //DENY all if no rules in "Allow" are matched

Problem:
With this setup, TNAS Online Remote (tnas.link, tnas.online) does not work.

I tried adding “Allow” rules for the IPs resolved from tnas.link / tnas.online, but this had no effect.

The service only works if I disable the final “Deny All” rule, which makes the other rules meaningless.

Request:
Please help me configure the firewall rules so that I can use them as intended without affecting the TNAS Remote service, or provide the specific IPs/ports used by TNAS Online so I can create the correct firewall rules.

Thank you!

[CursaYang]

Hello, we need to understand if the current issue is that you cannot access NAS using the TNAS ID after TNAS online is enabled, or if it's another problem?

[gustang]

Hi,

After I configured the firewall rules as described, remote access via TNAS Online does not work with the TNAS ID. As I mentioned, if I remove the firewall rules or disable the final “Deny All” rule, then the TNAS ID connection works normally.

However, this defeats the purpose of having the firewall rules in place. I would like your guidance on how to configure the firewall correctly while still being able to use the TNAS ID for remote access.

Thank you.

[Gremlin]

Just my 2 cents, but I would not bother with firewall on the nas. Given the traffic you are allowing, any miscreant could well gat at the nas via a local deice. Much better to ensure firewalling at the main gateway to your lan(s) is effective. TM nas firewall has always been a bit confused anyway imo starting from a premice that all is allowed in/out, but as soon as you create a rule all else was denide. (as per "the early years", no idea what it does now.)