Roast Me: Poke holes in my security approach
I've been reading through lots of posts here and elsewhere about security precautions against hackers and/or ransomware. There are obviously many threads, and many different options. The only thing everyone seems to agree on is that the only way to keep your Synology truly safe from hackers is to not plug in the network cable. Kind of like "the safest form of contraception is abstinence". But in both cases, what's the fun in that?
I want to access my Synology online, and want to be able to send links using Drive so that friends/clients can download shared files without any login. I also want my colleagues to be able to login to the NAS without needing a VPN or static IP. So my situation is based on that need.
1. First I did the obvious stuff:
* Disabled admin account * 2 Factor authentication on all accounts * Auto-block and anti-DDOS enabled * Synology DDNS enabled
1. Then I disabled Quick Connect. I want to like Quick Connect, but feel like it's a very obvious target. Both in terms of data passing through the Synology servers, as well as being a central point in which a lot of Synology boxes are accessed and connected. I just don't like the unknown and black-box feel to it. 2. I registered a domain with CloudFlare and have it privately pointed to a static IP address through AWS (e.g. my AWS IP is never revealed). I have the CloudFlare geofence service enabled to only proxy traffic to my AWS IP that is originating from my home country, in addition to the usual threat filtering they do. 3. The AWS IP is mapped to an EC2 instance. I have HAProxy running on the instance, and configured to only respond to my domain name, on ports 443 and 8443. The requests must come from a CloudFlare IP. SSL is terminated by HaProxy using Lets Encrypt. For port 443, there is a http user/pass authorization request. Valid requests are then proxied over SSL to my Synology DDNS address. Inbound 443 requests are proxied to port 5001. All other ports and access to the server is firewalled, except for key-based SSH for me. 4. My router forwards requests on ports 5001 and 8443, only that originate from my server's static IP, to my Synology box (on a static internal IP). All other ports and/or sources are closed. 5. My Synology box has its firewall enabled, and only accepts requests from my computer's internal static IP, and from my AWS IP on the two ports mentioned above. All unnecessary ports are disabled. 6. My Synology Drive is configured to use a custom port, 8443. This means that any file links will look like [https://mydomain.com:8443/d/f123456789](https://mydomain.com:8443/d/f123456789). HAProxy does not require a http user/password on port 8443, so someone using one of these links could go straight to the shared content, provided I have that content enabled for public sharing, and provided they are clicking the link within my country. If they login at [https://mydomain.com:8443](https://mydomain.com:8443) using a user account, they'll be in the "Synology Drive" user interface mode. (As a sidebar, I used 8443 because it's one of the very limited ports that CloudFlare will forward with a free account) 7. If someone goes straight to [https://mydomain.com](https://mydomain.com), assuming they are in this country, they'll first be greeted with a user/pass popup via HAProxy. Upon successful providing that, will then have to login with the NAS's user account, including 2-factor. They then will have regular access within the NAS.
**So my question to the community is - what am I missing?** Are there any reasonable precautions I missed, or assumptions that are misguided? I know what I set up is more complicated than simply enabling Quick Connect, but I think it (hopefully) strikes a good balance between having a connected and accessible NAS, but that has a minimized attack vector.
Would rather be roasted here than by a hacker ;)