Exposing a NAS to the Internet: 17,864 IPs Blocked in Two Years

In July 2024 I moved my blog onto my home NAS, and that put the NAS login page on the internet too. The only protection I had set up was DSM’s auto block: three failed logins and the IP is banned for good. Two years later I opened the block list and found 17,864 IPs in it, about 38 a day. Here is when, where from and how they came, and what I changed after looking at the data.

At a glance

• Scale: 17,864 IPs permanently blocked between 2024-05-06 and 2025-08-15 (about 38 a day)
• Peak: 3,231 in a single month (Oct 2024)
• Time of day: 680 to 823 per hour, night or day, so these are bots, not people
• Countries: China 20.6%, the US 11.2%, Singapore 8.3%. South Korea, where the NAS is, only 4.3%
• Networks: more cloud servers such as DigitalOcean and Alibaba Cloud than home connections
• What helped: limiting the admin pages to Korea alone filters about 96%; two-factor authentication and blocking by real IP handle the rest

How I counted

Synology DSM stores the IPs it auto-blocks in an internal database, /etc/synoautoblock.db. I only read that list with admin rights, copied it and counted. Dates are when each IP was first blocked, and countries and networks come from a public IP geolocation database. I’m not publishing the IP list itself.

sudo sqlite3 /etc/synoautoblock.db "SELECT COUNT(*) FROM AutoBlockIP WHERE Deny=1;"

To see the list in DSM, go to Control Panel → Security → Account → Auto Block → Allow/Block List.

By month: it started when the blog went live

Blocks started climbing around July 2024, when I pointed the blog’s domain at the NAS, and peaked at 3,231 in Oct 2024. Once the domain existed and search engines knew about it, it seems to have landed on automated scanners’ lists. There are almost no new blocks after September 2025. The attacks had become a lot, and I wasn’t using the NAS much at the time, so I turned it off completely for a few months. After I switched it back on, things were clearly quieter.

That July 2024 date is when I moved the blog from Cafe24, a Korean managed WordPress host, to the NAS and pointed a new domain straight at my home IP, with ports 80 and 443 forwarded to the NAS.

By hour: no breaks, 24 hours a day

The gap between the quietest and the busiest hour is only 143 blocks. People would leave a dip while they sleep, but 4 a.m. looks the same as 4 p.m. This is automated: many servers sweeping the whole internet for open login pages and trying common usernames and passwords.

Where it came from: countries

Rank	Country	Blocked IPs	Share
1	China	3,675	20.6%
2	United States	1,999	11.2%
3	Singapore	1,478	8.3%
4	Hong Kong	891	5.0%
5	India	876	4.9%
6	Indonesia	806	4.5%
7	South Korea	771	4.3%
8	Vietnam	762	4.3%
9	Germany	696	3.9%
10	Russia	472	2.6%

Only 4.3% of the IPs were Korean. Put the other way round, if the NAS admin pages only answer requests from Korea, about 96% of these attacks never get in. Keep in mind that the country is where the attacking server sits, not where the attacker lives, so this isn’t “people from country X attacked me”.

Which networks: mostly cloud servers

Network (ASN)	Blocked IPs	Share	Type
AS14061 DigitalOcean	2,314	13.0%	Cloud / hosting
AS45102 Alibaba (US) Technology	1,213	6.8%	Cloud / hosting
AS4134 CHINANET BACKBONE	634	3.5%	ISP / other
AS137718 Beijing Volcano Engine Technology	576	3.2%	Cloud / hosting
AS136052 PT Cloud Hosting Indonesia	456	2.6%	Cloud / hosting
AS4766 Korea Telecom	391	2.2%	ISP / other
AS16276 OVH SAS	349	2.0%	Cloud / hosting

Numbers one and two are DigitalOcean and Alibaba Cloud, companies that rent out servers by the hour. Attackers rent a server, run their scans for a while and throw it away, so blocking one IP just means the next one shows up. That is why an auto block list keeps growing forever.

Why auto block alone wasn’t enough

• It only stops password guessing: it counts failed logins, so it does nothing against attacks on software vulnerabilities that don’t need a password.
• IPs never run out: against attackers who keep switching cloud servers, blocking IPs mostly buys time.
• Behind Cloudflare it can backfire: with the proxy on, every visitor arrives from a Cloudflare IP, and if auto block bans a Cloudflare IP it locks out me and my family too.
• The blog gets targeted too: WordPress’s xmlrpc.php was getting a login attempt about every 20 seconds.

What I changed after seeing the data

I wrote up every step in my home server security guide (in Korean); here is the short version.

1. Cloudflare proxy to hide my home IP
2. One rule that only lets Korea reach the NAS admin pages, which blocks about 96% by the data above. Tested from seven other countries: every one got a 403
3. Only Jetpack may reach xmlrpc.php
4. Restore the real visitor IP, so auto block bans the actual attacker instead of a Cloudflare IP
5. Two-factor authentication on admin accounts, and no common account names

And above all, off-site backups. If everything above fails, a backup is the only way back.

Frequently asked questions

How many failed logins should trigger DSM auto block?

I used a permanent block after three failures. If family members often mistype their password, raise the number a little and put your home LAN IPs on the allow list so nobody gets locked out.

Does a country rule stop attacks from inside my own country?

No. Even here, 4.3% of the IPs were Korean. Use the country rule as the first filter and keep two-factor authentication and auto block behind it.

Is a NAS safe if I don’t open it to the internet?

The safest setup is not exposing the admin pages at all and only reaching them over a VPN from outside. I do that with Tailscale on DSM 6. If you have to open it, for family photo sharing for example, use a country rule, two-factor authentication and off-site backups together.

This NAS also runs the blog itself; I wrote about running it on PHP 8.3 with Docker on DSM 6.2.

This is a translation of my original Korean article: NAS를 인터넷에 열면 생기는 일 – 2년간 IP 17,864개 차단 기록. Last checked: 30 October 2026 (block records cover 6 May 2024 to 15 August 2025).