TerraMaster Forum

Hello,

I have configured firewall rules on my Terra-Master device. Only specific ports or IPs are allowed, and the final rule denies all other access.

Current Rules (simplified):

- Allow: 80, 443 - ALL //(HTTP/HTTPS)
- Allow: 8181, 5443 - ALL //(TOS ports) – ideally restricted by geo-location, but since Terra-Master does not support this, then currently set to allow all
- Allow: 474 - ALL //(WebDAV) – ideally restricted by geo-location, but since Terra-Master does not support this, it is currently set to allow all
- Allow: ALL - Local networks (192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8)
- Allow: ALL for Trusted external IPs
- Deny: All other traffic //DENY all if no rules in "Allow" are matched

Problem:
With this setup, TNAS Online Remote (tnas.link, tnas.online) does not work.

I tried adding “Allow” rules for the IPs resolved from tnas.link / tnas.online, but this had no effect.

The service only works if I disable the final “Deny All” rule, which makes the other rules meaningless.

Request:
Please help me configure the firewall rules so that I can use them as intended without affecting the TNAS Remote service, or provide the specific IPs/ports used by TNAS Online so I can create the correct firewall rules.

Thank you!

Hello, we need to understand if the current issue is that you cannot access NAS using the TNAS ID after TNAS online is enabled, or if it's another problem?

Hi,

After I configured the firewall rules as described, remote access via TNAS Online does not work with the TNAS ID. As I mentioned, if I remove the firewall rules or disable the final “Deny All” rule, then the TNAS ID connection works normally.

However, this defeats the purpose of having the firewall rules in place. I would like your guidance on how to configure the firewall correctly while still being able to use the TNAS ID for remote access.

Thank you.

Just my 2 cents, but I would not bother with firewall on the nas. Given the traffic you are allowing, any miscreant could well gat at the nas via a local deice. Much better to ensure firewalling at the main gateway to your lan(s) is effective. TM nas firewall has always been a bit confused anyway imo starting from a premice that all is allowed in/out, but as soon as you create a rule all else was denide. (as per "the early years", no idea what it does now.)