3

I have a Synology NAS at home (let's call it ananas), it is attached to my router via ethernet.
I also have a desktop (let's call it Aero), it is connected to the same router via wifi.
I configured in another country, a laptop (xps13), I could access the NAS without any problem (the ports were open and I used NAT) using https rsync over ssh and ssh.

Here is a map of the local network: network map

However now that I am back home, I just can't find the NAS by using nmap (without -Pn, it is just not listed while everything else is), can't ping it, and can't ssh into it. The twist is that this only happens on the laptop.

Running route -n on the xps 13 yields:

[soulthym@xps13 ~]$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    600    0        0 wlp2s0
192.168.1.0     0.0.0.0         255.255.255.0   U     600    0        0 wlp2s0

And on the Aero:

[soulthym@Aero ~]$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    303    0        0 wlp3s0
192.168.1.0     0.0.0.0         255.255.255.0   U     303    0        0 wlp3s0
192.168.1.0     0.0.0.0         255.255.255.0   U     600    0        0 wlp3s0

For debugging purposes I disabled the firewall on the NAS, disabled IP auto-blocking on the NAS, and set the exact same firewall on both the Desktop and the Laptop (using /etc/iptables/iptables.rules).

From the xps13 I get:

[soulthym@xps13 ~]$ nmap -Pn 192.168.1.17
Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-19 18:22 CEST
Nmap scan report for ananas-1.home (192.168.1.17)
Host is up (0.16s latency).
All 1000 scanned ports on ananas-1.home (192.168.1.17) are filtered

Nmap done: 1 IP address (1 host up) scanned in 8.88 seconds

Whereas I get all the ports from the Aero.

Same story goes for pinging, works beautifully from the Aero, but the xps13 yields:

[soulthym@xps13 ~]$ ping 192.168.1.17
PING 192.168.1.17 (192.168.1.17) 56(84) bytes of data.
From 192.168.1.13 icmp_seq=1 Destination Host Unreachable
From 192.168.1.13 icmp_seq=2 Destination Host Unreachable
From 192.168.1.13 icmp_seq=3 Destination Host Unreachable

And while ssh-ing:

ssh: connect to host 192.168.1.17 port $PORT: No route to host
[soulthym@xps13 ~]$ ip neigh 
192.168.1.1 dev wlp2s0 lladdr xx:xx:xx:xx:xx:xx REACHABLE 
192.168.1.10 dev wlp2s0 lladdr xx:xx:xx:xx:xx:xx STALE 
192.168.1.17 dev wlp2s0 FAILED xxxx::xxxx:xxxx:xxxx:xxxx 
             dev wlp2s0 lladdr xx:xx:xx:xx:xx:xx router REACHABLE 

(the above fragment was moved from a comment, and was broken there)

This only happens when using the local network. I can use a VPN and connect to the public IP but that is just a temporary fix that doesn't fit the use for backups...

Any idea of what I could have done wrong here?

15
  • Your nmap output for xps13 indicates that it knows the host is up, but ports are filtered by a firewall. Is it possible that there is a filter on your NAT that's blocking xps13? – Peschke Aug 19 '19 at 17:02
  • @Peschke not that I know of, and it would mean it only blocks this specific ip? Because it works when using a VPN or ssh-ing from the public IP – Soulthym Aug 19 '19 at 17:06
  • I'm not sure. I reread the nmap man page for -Pn, which says it treats all hosts as online. Therefore, I think my observation about xps13 seeing your NAT as up is incorrect. Can xps13 access or ping Aero while connected to your local network? – Peschke Aug 19 '19 at 17:11
  • No in fact it can not, and while scanning without -Pn it did not find the NAS. I'll edit and add this information to the post – Soulthym Aug 19 '19 at 17:14
  • If Aero's iptables allows pings, is your router not allowing xps13 to communicate on the internal network? Maybe check the router settings. I'm out of other ideas at the moment. – Peschke Aug 19 '19 at 17:23
0

Adding a DNS entry in the router's DNS itself allows to bypass the issue. As of now, I can not access the NAS by IP but at least I can by "nickname".

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.