{"id":22125,"date":"2026-10-25T07:58:10","date_gmt":"2026-10-24T23:58:10","guid":{"rendered":"https:\/\/synopower.club\/?post_type=docs&#038;p=22125"},"modified":"2026-10-25T08:04:28","modified_gmt":"2026-10-25T00:04:28","password":"","slug":"synology-threat-prevention-blind-spots","status":"publish","type":"docs","link":"https:\/\/synopower.club\/cs\/docs\/synology-threat-prevention-blind-spots\/","title":{"rendered":"Synology Threat Prevention: Co zachyt\u00ed a co nevid\u00ed"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Threat Prevention je bal\u00ed\u010dek, po kter\u00e9m v\u011bt\u0161ina lid\u00ed s\u00e1hne ve chv\u00edli, kdy se rozhodnou hostovat web na Synology NAS. B\u011b\u017e\u00ed na routeru, m\u00e1 ikonu \u0161t\u00edtu a jeho p\u0159ehled po\u010d\u00edt\u00e1 \u00fatoky na stovky, tak\u017ee vypad\u00e1 jako v\u011bc, kter\u00e1 udr\u017euje ve\u0159ejn\u00fd web v bezpe\u010d\u00ed. Provozujeme jej na RT6600ax p\u0159ed ka\u017ed\u00fdm strojem, kter\u00fd vlastn\u00edme, a vyplatilo se ho m\u00edt. Pro sv\u00e9pomocn\u011b hostovan\u00fd web je v\u0161ak t\u00e9m\u011b\u0159 zcela mimo m\u00edsu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tento \u010dl\u00e1nek z \u0159ady NAS Hosting 101 otev\u00edr\u00e1 n\u00e1\u0161 vlastn\u00ed router, \u010dte z n\u011bj re\u00e1ln\u00fd t\u00fdden ud\u00e1lost\u00ed a p\u0159esn\u011b ukazuje, kde Threat Prevention p\u0159est\u00e1v\u00e1 pom\u00e1hat, p\u0159i\u010dem\u017e jako p\u0159\u00edklad \u00fatoku, kter\u00fd Threat Prevention nem\u011bl \u0161anci zachytit, pou\u017e\u00edv\u00e1 PHP2Shell.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Bod SynoPower Club:<\/strong> Str\u00e1vil jsem dlouhou dobu na z\u00e1kaznick\u00e9 podpo\u0159e Synology a tato ot\u00e1zka p\u0159ich\u00e1zela neust\u00e1le: kterou mo\u017enost m\u00e1m zapnout, abych tento \u00fatok zastavil. Je to spr\u00e1vn\u00fd instinkt zam\u011b\u0159en\u00fd na \u0161patn\u00fd box. To, co mi to kone\u010dn\u011b objasnilo, bylo \u010dten\u00ed na\u0161eho vlastn\u00edho seznamu ud\u00e1lost\u00ed nam\u00edsto str\u00e1nky s funkcemi. Ka\u017ed\u00e9 upozorn\u011bn\u00ed, kter\u00e9 n\u00e1\u0161 router tento m\u011bs\u00edc zaznamenal, byla adresa se \u0161patnou reputac\u00ed, nikoli po\u017eadavek se \u0161patn\u00fdm u\u017eite\u010dn\u00fdm obsahem (payloadem). Jakmile to uvid\u00edte, p\u0159estanete po Threat Prevention po\u017eadovat, aby kontroloval provoz, kter\u00fd dr\u017e\u00ed v zape\u010det\u011bn\u00e9 ob\u00e1lce.<\/p>\n<\/blockquote>\n\n\n\n<h2 id=\"what-threat-prevention-actually-does-on-a-synology-router\" class=\"wp-block-heading\">Co Threat Prevention na routeru Synology skute\u010dn\u011b d\u011bl\u00e1<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Threat Prevention je syst\u00e9m detekce a prevence pr\u016fniku (IDS\/IPS) postaven\u00fd na rodin\u011b n\u00e1stroj\u016f Snort a Suricata. \u010cte pakety p\u0159i jejich sm\u011brov\u00e1n\u00ed routerem, porovn\u00e1v\u00e1 je se sadou podpis\u016f a bu\u010f zaznamen\u00e1 varov\u00e1n\u00ed, nebo paket zahod\u00ed. Na na\u0161em RT6600ax je zdrojem podpis\u016f ET Open, bezplatn\u00e1 \u00farove\u0148 sady pravidel Emerging Threats, aktualizovan\u00e1 denn\u011b v 09:00.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Z tohoto n\u00e1vrhu vypl\u00fdvaj\u00ed t\u0159i vlastnosti a na v\u0161ech t\u0159ech z\u00e1le\u017e\u00ed v\u00edce ne\u017e na jak\u00e9mkoli za\u0161krt\u00e1vac\u00edm pol\u00ed\u010dku v rozhran\u00ed:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>It can only examine packets the router <strong>forwards<\/strong>. Traffic that never crosses the routing engine is not slow to inspect, it is invisible.<\/li>\n\n<li>It can only match on bytes it can <strong>read<\/strong>. V Threat Prevention nikde neprob\u00edh\u00e1 zachyt\u00e1v\u00e1n\u00ed TLS, tak\u017ee \u0161ifrovan\u00fd u\u017eite\u010dn\u00fd obsah je ne\u010diteln\u00fd.<\/li>\n\n<li>It can only match signatures <strong>somebody else wrote<\/strong>. The interface exposes vendor classes to switch on and off, and nothing that accepts a rule you author yourself.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Nic z toho nen\u00ed chyba. IPS na obvodu s\u00edt\u011b je rozumn\u00e1 a u\u017eite\u010dn\u00e1 v\u011bc. Chybou je p\u0159edpokl\u00e1dat, \u017ee obvod je m\u00edstem, kde doch\u00e1z\u00ed k \u00fatoku na webov\u00e9 str\u00e1nky.<\/p>\n\n\n\n<h2 id=\"threat-prevention-vs-a-web-application-firewall\" class=\"wp-block-heading\">Threat Prevention vs. Web Application Firewall<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Nejjasn\u011bj\u0161\u00ed zp\u016fsob, jak uvid\u011bt tento rozd\u00edl, je postavit Threat Prevention vedle webov\u00e9ho aplika\u010dn\u00edho firewallu (WAF) a zeptat se, co ka\u017ed\u00fd z nich dr\u017e\u00ed v ruce, kdy\u017e se rozhoduje. Threat Prevention dr\u017e\u00ed paket. WAF dr\u017e\u00ed de\u0161ifrovan\u00fd po\u017eadavek HTTP.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Question<\/th><th>Router IPS<\/th><th>Reverse-proxy WAF<\/th><\/tr><\/thead><tbody><tr><td>Kde to b\u011b\u017e\u00ed<\/td><td>On the routing path, before TLS ends<\/td><td>At the edge, after TLS ends<\/td><\/tr><tr><td>What it inspects<\/td><td>Packet headers and any cleartext bytes<\/td><td>Method, path, headers, cookies, body<\/td><\/tr><tr><td>HTTPS traffic<\/td><td>Opaque<\/td><td>Fully readable<\/td><\/tr><tr><td>Rules you can add<\/td><td>Vendor classes on or off<\/td><td>Your own expressions, plus managed rulesets<\/td><\/tr><tr><td>Same-subnet traffic<\/td><td>Never seen<\/td><td>Not applicable, it is upstream of everything<\/td><\/tr><tr><td>Typical catch<\/td><td>Reputation hits, scans, cleartext exploits, outbound command and control<\/td><td>Injection, traversal, known CVE request shapes, credential stuffing, bots<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Nejedn\u00e1 se o konkuren\u010dn\u00ed produkty. Pokr\u00fdvaj\u00ed r\u016fzn\u00e9 \u00faseky stejn\u00e9 cesty a sv\u00e9pomocn\u011b hostovan\u00fd web pot\u0159ebuje ten druh\u00fd o mnoho v\u00edce ne\u017e ten prvn\u00ed. Ponech\u00e1v\u00e1me si oba a od ka\u017ed\u00e9ho o\u010dek\u00e1v\u00e1me \u00fapln\u011b jin\u00e9 v\u011bci.<\/p>\n\n\n\n<h2 id=\"reading-595-events-from-one-week-on-our-own-router\" class=\"wp-block-heading\">\u010cten\u00ed 595 ud\u00e1lost\u00ed za jeden t\u00fdden na na\u0161em vlastn\u00edm routeru<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Zde je p\u0159ehledov\u00e1 obrazovka bal\u00ed\u010dku Threat Prevention na\u0161eho produk\u010dn\u00edho routeru ze dne 25. \u0159\u00edjna 2026. P\u011bt set devades\u00e1t p\u011bt \u0161kodliv\u00fdch ud\u00e1lost\u00ed za sedm dn\u00ed, z toho 75 s vysokou z\u00e1va\u017enost\u00ed. Vypad\u00e1 to jako hr\u00e1z zadr\u017euj\u00edc\u00ed povode\u0148.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"eager\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events.webp\" alt=\"P\u0159ehled Synology Threat Prevention na RT6600ax zobrazuj\u00edc\u00ed 595 \u0161kodliv\u00fdch ud\u00e1lost\u00ed za sedm dn\u00ed a jedno za\u0159\u00edzen\u00ed s potenci\u00e1ln\u00edmi hrozbami\" class=\"wp-image-22119\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-1000x482.webp 1000w\"  fetchpriority=\"high\"\/><figcaption class=\"wp-element-caption\">Sedm dn\u00ed na na\u0161em vlastn\u00edm RT6600ax. Za ka\u017edou ud\u00e1lost s vysokou z\u00e1va\u017enost\u00ed m\u016f\u017ee jedin\u00e9 za\u0159\u00edzen\u00ed, a to e-mailov\u00fd server, nikoli webov\u00fd hostitel.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Dva detaily na t\u00e9to obrazovce maj\u00ed v\u011bt\u0161\u00ed hodnotu ne\u017e samotn\u00e9 celkov\u00e9 \u010d\u00edslo. Prvn\u00edm je, \u017ee se mezi potenci\u00e1ln\u00edmi hrozbami objevuje v\u016fbec jen jedno za\u0159\u00edzen\u00ed, a to REVERSE_MAIL, stroj, kter\u00fd ukon\u010duje TLS a provozuje MailPlus. Druh\u00fdm je datum podpisu vedle zelen\u00e9 fajfky. Nyn\u00ed otev\u0159ete jednu ud\u00e1lost a p\u0159e\u010dt\u011bte si, co se vlastn\u011b spustilo.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature.webp\" alt=\"Detail ud\u00e1losti Threat Prevention zobrazuj\u00edc\u00ed podpis IP se \u0161patnou reputac\u00ed ET CINS se stavem Upozorn\u011bn\u00ed (Alert) a t\u011blem pravidla, kter\u00e9 odpov\u00edd\u00e1 pouze IP adres\u00e1m\" class=\"wp-image-22120\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">T\u011blo podpisu prozrad\u00ed v\u0161e. Za\u010d\u00edn\u00e1 v\u00fdrazem alert ip n\u00e1sledovan\u00fdm seznamem adres, tak\u017ee nic v po\u017eadavku nebylo zkoum\u00e1no.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Klasifikace Misc Attack, z\u00e1va\u017enost St\u0159edn\u00ed, stav Alert, n\u00e1zev podpisu ET CINS Active Threat Intelligence Poor Reputation IP group 24. Otev\u0159ete t\u011blo pravidla a to za\u010d\u00edn\u00e1 alert ip a pak dlouh\u00fdm seznamem adres. Jedn\u00e1 se o vyhled\u00e1v\u00e1n\u00ed v \u010dern\u00e9m seznamu (blocklistu). \u017d\u00e1dn\u00e1 \u010d\u00e1st po\u017eadavku HTTP nebyla p\u0159e\u010dtena, proto\u017ee ani p\u0159e\u010dtena b\u00fdt nemohla. Otestovali jsme ud\u00e1losti proti druh\u00e9mu c\u00edli, na\u0161emu hostiteli Virtual DSM, a na\u0161li jsme stejnou t\u0159\u00eddu pravidla s jin\u00fdm \u010d\u00edslem skupiny.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Up\u0159\u00edmn\u00e9 shrnut\u00ed jednoho t\u00fddne je tedy toto: router rozpoznal n\u011bkolik stovek p\u0159ipojen\u00ed z adres, kter\u00e9 ji\u017e m\u011bly \u0161patnou reputaci. To je opravdu u\u017eite\u010dn\u00e9. Nen\u00ed to v\u0161ak detekce webov\u00fdch \u00fatok\u016f a nikdo by nem\u011bl \u010d\u00edslo 595 interpretovat, jako by tomu tak bylo.<\/p>\n\n\n\n<h2 id=\"how-to-audit-threat-prevention-in-4-steps\" class=\"wp-block-heading\">Jak prov\u00e9st audit Threat Prevention ve 4 kroc\u00edch<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ne\u017e sv\u011b\u0159\u00edte bal\u00ed\u010dku Threat Prevention cokoli, v\u011bnujte deset minut zji\u0161t\u011bn\u00ed, co na va\u0161\u00ed vlastn\u00ed s\u00edti skute\u010dn\u011b d\u011bl\u00e1. Ka\u017ed\u00fd n\u00ed\u017ee uveden\u00fd krok slou\u017e\u00ed pouze ke \u010dten\u00ed a nic nem\u011bn\u00ed.<\/p>\n\n\n<div id=\"rank-math-howto\" class=\"rank-math-block\" >\n<div class=\"rank-math-howto-description\">\n\n<\/div>\n\n<div class=\"rank-math-steps\">\n<div id=\"step-1\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Otev\u0159ete jednu ud\u00e1lost a p\u0159e\u010dt\u011bte si t\u011blo podpisu<\/h3>\n<div class=\"rank-math-step-content\"><p>P\u0159ejd\u011bte do Threat Prevention, pot\u00e9 na Ud\u00e1losti a klikn\u011bte na libovolnou polo\u017eku. Pod\u00edvejte se za barevn\u00fd odznak z\u00e1va\u017enosti do pole Pravidla podpis\u016f. Pravidlo za\u010d\u00ednaj\u00edc\u00ed na alert ip odpov\u00edd\u00e1 pouze reputaci adresy. Pravidlo obsahuj\u00edc\u00ed content nebo pcre odpov\u00edd\u00e1 u\u017eite\u010dn\u00e9mu obsahu (payload). Spo\u010d\u00edtejte, kolik od ka\u017ed\u00e9ho typu najdete ve sv\u00e9m vlastn\u00edm seznamu, ne\u017e se rozhodnete, co vlastn\u011b Threat Prevention chr\u00e1n\u00ed.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-2\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Zkontrolujte, kter\u00e1 rozhran\u00ed jsou monitorov\u00e1na<\/h3>\n<div class=\"rank-math-step-content\"><p>Otev\u0159ete Nastaven\u00ed a prohl\u00e9dn\u011bte si tabulku Monitored Interfaces. Kontrolov\u00e1na jsou pouze rozhran\u00ed, kter\u00e1 jsou zde za\u0161krtnuta, a p\u0159i b\u011b\u017en\u00e9m nasazen\u00ed se jedn\u00e1 o rozhran\u00ed sm\u011b\u0159uj\u00edc\u00ed do internetu. Provoz mezi dv\u011bma za\u0159\u00edzen\u00edmi ve stejn\u00e9 pods\u00edti LAN je p\u0159ep\u00edn\u00e1n, nikoli sm\u011brov\u00e1n, tak\u017ee se nikdy nedostane ke kontrolovac\u00edmu modulu a \u017e\u00e1dn\u00e9 nastaven\u00ed na t\u00e9to str\u00e1nce to nem\u016f\u017ee zm\u011bnit.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-3\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Zjist\u011bte, co se stane, kdy\u017e je router vyt\u00ed\u017een\u00fd<\/h3>\n<div class=\"rank-math-step-content\"><p>Ve stejn\u00e9m panelu se pod\u00edvejte na v\u00fdchoz\u00ed re\u017eim. Priorita stability s\u00edt\u011b znamen\u00e1, \u017ee kdy\u017e provoz p\u0159ekro\u010d\u00ed kapacitu, kterou engine dok\u00e1\u017ee zpracovat, p\u0159ebyte\u010dn\u00fd provoz je propu\u0161t\u011bn nefiltrovan\u00fd. Priorita zabezpe\u010den\u00ed znamen\u00e1, \u017ee p\u0159ebytek je m\u00edsto toho zahozen. Jedna mo\u017enost p\u0159i selh\u00e1n\u00ed z\u016fst\u00e1v\u00e1 otev\u0159en\u00e1 a udr\u017e\u00ed va\u0161i linku v provozu, druh\u00e1 se p\u0159i selh\u00e1n\u00ed uzav\u0159e a va\u0161i linku shod\u00ed. Rozhodn\u011bte se, kterou vlastn\u011b chcete.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-4\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Zkuste p\u0159idat vlastn\u00ed pravidlo<\/h3>\n<div class=\"rank-math-step-content\"><p>Open Self-Defined Policy. You can change the action for a signature the vendor already ships, and you can scope it by source or destination address. There is no field anywhere that accepts a signature you wrote. If your threat is newer than your signature feed, this screen is where you discover you have no way to respond.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n\n\n\n<h2 id=\"where-it-genuinely-earns-its-place\" class=\"wp-block-heading\">Kde si skute\u010dn\u011b zaslou\u017e\u00ed sv\u00e9 m\u00edsto<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ponech\u00e1v\u00e1me Threat Prevention zapnut\u00fd, a to nikoli ze pov\u011br\u010divosti. D\u011bl\u00e1 \u010dty\u0159i \u00fakoly, kter\u00e9 nic jin\u00e9ho v na\u0161em syst\u00e9mu ned\u011bl\u00e1.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Outbound command and control.<\/strong> This is the strongest case by far. A compromised device has to call home, that call has to leave through the router, and a good share of it is still either cleartext or aimed at a known address. Our router ships the Malware Command and Control Activity class with 3,450 of 3,498 rules enabled, and the Domain Observed Used for C2 class with 7,157 of 7,202.<\/li>\n\n<li><strong>Cleartext protocols from the internet.<\/strong> Our mail server answers on port 25, and SMTP is cleartext until STARTTLS. That is real inspectable traffic, and it is no accident that the mail host is the one device our events list keeps naming.<\/li>\n\n<li><strong>Scanning and reconnaissance.<\/strong> Port sweeps and fingerprinting are recognised by connection behaviour rather than by payload, so encryption does not hide them.<\/li>\n\n<li><strong>Visibility.<\/strong> A searchable log of who knocked and with what reputation is worth having, even when every entry is only a reputation hit. It is monitoring value, and it should be counted as monitoring value rather than as protection.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Tyto \u010dty\u0159i v\u011bci maj\u00ed spole\u010dn\u00e9 to, \u017ee ani jedna z nich nen\u00ed \u00fatokem na webov\u00e9 str\u00e1nky.<\/p>\n\n\n\n<h2 id=\"why-a-site-owner-asks-threat-prevention-for-the-wrong-thing\" class=\"wp-block-heading\">Pro\u010d vlastn\u00edk webu po\u017eaduje po Threat Prevention nespr\u00e1vnou v\u011bc<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Kdy\u017e hostujete web na NAS, cesta po\u017eadavku obvykle obsahuje reverzn\u00ed proxy. Na\u0161e vypad\u00e1 takto a jej\u00ed struktura rozhoduje o v\u0161em:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The visitor reaches <strong>Cloudflare<\/strong>, which answers most requests from cache and inspects the rest in cleartext.<\/li>\n\n<li>What is left crosses the <strong>router<\/strong>, kde Threat Prevention vid\u00ed \u0161ifrovan\u00fd datov\u00fd tok TLS a nic v\u00edce.<\/li>\n\n<li>Ten\/Ta\/To <strong>reverse proxy NAS<\/strong> terminates TLS and forwards plain HTTP to the machine that runs the site.<\/li>\n\n<li>That last hop is on the <strong>same subnet<\/strong>, so the frame goes through a switch and the router is not in the path.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">P\u0159e\u010dt\u011bte si tyto \u010dty\u0159i \u0159\u00e1dky spole\u010dn\u011b a l\u00e9\u010dka je z\u0159ejm\u00e1. Jedin\u00fd \u00fasek, kde po\u017eadavek existuje v \u010diteln\u00e9 podob\u011b, je posledn\u00ed skok, a to je pr\u00e1v\u011b ten \u00fasek, kter\u00fd router nem\u016f\u017ee sledovat. V\u0161ude, kde router sledovat m\u016f\u017ee, je po\u017eadavek \u0161ifrov\u00e1n. Neexistuje \u017e\u00e1dn\u00e9 za\u0161krt\u00e1vac\u00ed pol\u00ed\u010dko, kter\u00e9 by vy\u0159e\u0161ilo takov\u00fd rozpor, a Threat Prevention neselh\u00e1v\u00e1, kdy\u017e z\u016fst\u00e1v\u00e1 zticha. Hl\u00e1s\u00ed p\u0159esn\u011b informace o provozu, kter\u00fd ze sv\u00e9 podstaty nedok\u00e1\u017ee p\u0159e\u010d\u00edst.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To je tak\u00e9 d\u016fvod, pro\u010d nasm\u011brov\u00e1n\u00ed Threat Prevention na konkr\u00e9tn\u00ed web nefunguje. Bal\u00ed\u010dek je v\u00e1z\u00e1n na rozhran\u00ed routeru, nikoli na n\u00e1zvy hostitel\u016f. Nem\u00e1 \u017e\u00e1dn\u00fd pojem o tom, ke kter\u00e9mu z va\u0161ich web\u016f p\u0159ipojen\u00ed pat\u0159\u00ed, proto\u017ee nikdy nevid\u00ed hlavi\u010dku Host.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces.webp\" alt=\"Nastaven\u00ed Threat Prevention zobrazuj\u00edc\u00ed monitorovan\u00e1 rozhran\u00ed omezen\u00e1 na porty sm\u011brovan\u00e9 do internetu, re\u017eim priority stability s\u00edt\u011b a zdroj podpis\u016f ET Open\" class=\"wp-image-22121\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Monitored Interfaces (Sledovan\u00e1 rozhran\u00ed) tvo\u0159\u00ed cel\u00fd rozsah Threat Prevention. V\u0161imn\u011bte si v\u00fdchoz\u00edho re\u017eimu n\u00ed\u017ee a zdroje podpis\u016f zcela dole.<\/figcaption><\/figure>\n\n\n\n<h2 id=\"three-reasons-php2shell-was-invisible-at-the-router\" class=\"wp-block-heading\">T\u0159i d\u016fvody, pro\u010d byl PHP2Shell na routeru neviditeln\u00fd<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell, dvojice zranitelnost\u00ed typu vzd\u00e1len\u00e9ho spu\u0161t\u011bn\u00ed k\u00f3du p\u0159ed autentizac\u00ed sledovan\u00fdch jako CVE-2026-109618 a CVE-2026-109619, unikla 20. \u0159\u00edjna 2026 a n\u00e1sleduj\u00edc\u00ed den byla opravena p\u0159\u00edmo u v\u00fdvoj\u00e1\u0159\u016f. Je to p\u0159esn\u011b ten druh v\u011bci, o kter\u00e9m lid\u00e9 doufaj\u00ed, \u017ee jej zachyt\u00ed IPS routeru, a stoj\u00ed za to p\u0159esn\u011b vysv\u011btlit, pro\u010d to nedok\u00e1zal.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Za prv\u00e9, provoz byl \u0161ifrov\u00e1n na ka\u017ed\u00e9m \u00faseku, kter\u00fd router sleduje.<\/strong> The exploit lives in the HTTP request, and the HTTP request only exists in the clear after TLS has been terminated, which happens downstream of the router on a hop the router never carries.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Za druh\u00e9, neexistuje \u017e\u00e1dn\u00fd podpis Threat Prevention, kter\u00fd by bylo mo\u017en\u00e9 zapnout.<\/strong> We checked again on 25 October 2026 and found no published Snort or Emerging Threats rule for either CVE. Our feed is ET Open, the free tier, which lags the commercial set, and the Self-Defined Policy screen accepts no rule of your own. So even an operator who knew precisely what to match for had nowhere to put it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy.webp\" alt=\"Obrazovka Vlastn\u00ed z\u00e1sady (Self-Defined Policy) v Threat Prevention, pr\u00e1zdn\u00e1, pouze s mo\u017enostmi Upravit a Smazat a bez mo\u017enosti vytvo\u0159it nov\u00fd podpis\" class=\"wp-image-22123\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Vlastn\u00ed z\u00e1sady (Self-Defined Policy) upravuj\u00ed akci u podpis\u016f, kter\u00e9 dodavatel ji\u017e poskytuje. Neexistuje \u017e\u00e1dn\u00e9 pole, kter\u00e9 by p\u0159ijalo pravidlo, je\u017e jste sami napsali.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Za t\u0159et\u00ed, a to je z\u00e1sadn\u00ed, tento \u00fatok nem\u00e1 \u017e\u00e1dn\u00fd tvar u\u017eite\u010dn\u00e9ho zat\u00ed\u017een\u00ed (payloadu), kter\u00fd by se dal zachytit.<\/strong> The chain takes two requests. The first has to push PHP into exhausting its memory limit, which makes the engine abandon a request through a path that skips cleanup and leaves some global state behind. The second request is ordinary, and it is the one that reaches a stale pointer and turns into code execution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0158et\u011bzec vy\u017eaduje dva po\u017eadavky. Prvn\u00ed mus\u00ed dotla\u010dit PHP k vy\u010derp\u00e1n\u00ed jeho pam\u011b\u0165ov\u00e9ho limitu, co\u017e zp\u016fsob\u00ed, \u017ee stroj opust\u00ed po\u017eadavek cestou, kter\u00e1 p\u0159esko\u010d\u00ed \u00faklid a zanech\u00e1 za sebou ur\u010dit\u00fd glob\u00e1ln\u00ed stav. Druh\u00fd po\u017eadavek je b\u011b\u017en\u00fd a je to ten, kter\u00fd dos\u00e1hne neplatn\u00e9ho ukazatele (stale pointer) a prom\u011bn\u00ed se ve spu\u0161t\u011bn\u00ed k\u00f3du. Prvn\u00ed po\u017eadavek je definov\u00e1n t\u00edm, kolik pam\u011bti spot\u0159ebuje, nikoli jakoukoli sekvenc\u00ed bajt\u016f; vyhovuje mu velk\u00fd upload, obrovsk\u00e9 t\u011blo JSON, hlubok\u00e9 pole i dlouh\u00fd \u0159et\u011bzec v regul\u00e1rn\u00edm v\u00fdrazu. Druh\u00fd po\u017eadavek neobsahuje v\u016fbec \u017e\u00e1dn\u00e9 \u0161kodliv\u00e9 bajty. IPS rozhoduje na \u00farovni jednotliv\u00fdch paket\u016f a tok\u016f. Nem\u00e1 \u017e\u00e1dn\u00fd model pracovn\u00edho procesu (worker process) p\u0159en\u00e1\u0161ej\u00edc\u00edho kontaminovan\u00fd stav z jednoho po\u017eadavku do druh\u00e9ho, co\u017e je p\u0159esn\u011b m\u00edsto, kde tato chyba \u017eije.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To tak\u00e9 stanovuje limity mitigace, kter\u00e1 v t\u00e9 dob\u011b kolovala, co\u017e bylo vypnut\u00ed session.upload_progress v konfiguraci PHP. Odstra\u0148uje sice jeden dob\u0159e zdokumentovan\u00fd zp\u016fsob, jak dos\u00e1hnout druh\u00e9ho CVE, a na stroji, kter\u00fd opravdu nem\u016f\u017eete aktualizovat, je to lep\u0161\u00ed ne\u017e nic. Nen\u00ed to v\u0161ak oprava: vy\u010derp\u00e1n\u00ed pam\u011bti nen\u00ed dosa\u017eiteln\u00e9 pouze prost\u0159ednictv\u00edm t\u00e9to jedin\u00e9 funkce a toto nastaven\u00ed nem\u00e1 v\u016fbec \u017e\u00e1dn\u00fd vliv na CVE-2026-109618. Pou\u017eili jsme ho jako provizorn\u00ed \u0159e\u0161en\u00ed na p\u0159esn\u011b jednom hostiteli a p\u0159istupovali k n\u011bmu jako k z\u00edskan\u00e9mu \u010dasu, ne jako k vy\u0159e\u0161en\u00ed probl\u00e9mu. Cel\u00fd popis toho, jak jsme prov\u00e1d\u011bli opravu, naleznete v na\u0161em <a href=\"https:\/\/synopower.club\/cs\/synology-php2shell-emergency-patch\/\">PHP2Shell write-up<\/a>.<\/p>\n\n\n\n<h2 id=\"fail-open-by-design-and-the-day-it-cost-us-our-mail\" class=\"wp-block-heading\">N\u00e1vrhov\u00e9 selh\u00e1n\u00ed do otev\u0159en\u00e9ho stavu (Fail Open) a den, kdy n\u00e1s to st\u00e1lo po\u0161tu<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Existuje je\u0161t\u011b jedna vlastnost, kterou stoj\u00ed za to zn\u00e1t, ne\u017e za\u010dnete Threat Prevention pova\u017eovat za prvek, na kter\u00fd se m\u016f\u017eete spolehnout. Jeho doporu\u010den\u00fdm v\u00fdchoz\u00edm nastaven\u00edm je re\u017eim priority stability s\u00edt\u011b a rozhran\u00ed uv\u00e1d\u00ed, co to znamen\u00e1, bez jak\u00fdchkoli eufemism\u016f: kdy\u017e provoz p\u0159ekro\u010d\u00ed kapacitu zpracov\u00e1n\u00ed, \u010d\u00e1ste\u010dn\u011b vy\u0159\u00edzen\u00e9 pakety jsou p\u0159emost\u011bny bez filtrov\u00e1n\u00ed. Alternativa, re\u017eim priority zabezpe\u010den\u00ed, je m\u00edsto toho zahazuje a varuje, \u017ee p\u0159ipojen\u00ed bude nestabiln\u00ed, dokud nebude probl\u00e9m vy\u0159e\u0161en.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To je rozumn\u00e9 v\u00fdchoz\u00ed nastaven\u00ed pro dom\u00e1c\u00ed router. Znamen\u00e1 to v\u0161ak, \u017ee Threat Prevention je nejslab\u0161\u00ed v p\u0159esn\u011b ten moment, kdy byste cht\u011bli, aby byl nejsiln\u011bj\u0161\u00ed, proto\u017ee n\u00e1por provozu je jak v\u011bc\u00ed, kterou chcete filtrovat, tak v\u011bc\u00ed, kter\u00e1 p\u0159ekra\u010duje kapacitu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">M\u00e1me zaznamen\u00e1n i druh\u00fd zp\u016fsob selh\u00e1n\u00ed. Dne 2. srpna 2026 n\u011bkdo 116kr\u00e1t za\u00fato\u010dil na n\u00e1\u0161 reverzn\u00ed proxy server pomoc\u00ed exploitu na chybu PHP-CGI ve Windows, kter\u00e1 proti Linuxu nem\u016f\u017ee v\u016fbec fungovat. Threat Prevention zahodil dostate\u010dn\u00e9 mno\u017estv\u00ed paket\u016f na to, aby zablokoval sv\u016fj vlastn\u00ed stav, a pot\u00e9 za\u010dal odm\u00edtat odchoz\u00ed provoz p\u0159esn\u011b toho stroje, kter\u00fd br\u00e1nil. Na\u0161e po\u0161tovn\u00ed fronta se zastavila a p\u0159\u00edznak vypadal p\u0159esn\u011b jako selh\u00e1n\u00ed DNS. Restartov\u00e1n\u00ed routeru to opravilo. V protokolu p\u0159\u00edstup\u016f proxy se nic neobjevilo, proto\u017ee k proxy nic nedorazilo. \u00datok, kter\u00fd byl struktur\u00e1ln\u011b neschopn\u00fd usp\u011bt, n\u00e1s p\u0159esto st\u00e1l v\u00fdpadek, a to prost\u0159ednictv\u00edm v\u011bci, kter\u00e1 mu m\u011bla zabr\u00e1nit.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list.webp\" alt=\"Seznam T\u0159\u00edda a podpis v Threat Prevention s po\u010dty povolen\u00fdch pravidel podle t\u0159\u00edd, v\u010detn\u011b \u00datoku na webov\u00e9 aplikace v po\u010dtu 5 928 z 6 010 pravidel\" class=\"wp-image-22122\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">P\u0159ep\u00edna\u010de na \u00farovni t\u0159\u00edd s po\u010dtem povolen\u00fdch polo\u017eek vpravo. Toto je cel\u00fd rozsah mo\u017enost\u00ed p\u0159izp\u016fsoben\u00ed.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Kdy\u017e u\u017e tam jste, pod\u00edvejte se na po\u010dty povolen\u00fdch polo\u017eek v tomto seznamu. Web Application Attack zobrazuje 5 928 z 6 010 aktivn\u00edch pravidel a pom\u011br je podobn\u00fd ve v\u0161ech t\u0159\u00edd\u00e1ch, kter\u00e9 n\u00e1s zaj\u00edmaj\u00ed. Zapnut\u00ed t\u0159\u00eddy nezapne ka\u017ed\u00e9 pravidlo uvnit\u0159 a rozhran\u00ed v\u00e1m ned\u00e1v\u00e1 \u017e\u00e1dn\u00fd zp\u016fsob, jak zjistit, kter\u00e1 ze zb\u00fdvaj\u00edc\u00edch pravidel v\u00e1m chyb\u00ed.<\/p>\n\n\n\n<h2 id=\"put-a-proxy-in-front-then-lock-the-origin-to-it\" class=\"wp-block-heading\">Um\u00edst\u011bte proxy dop\u0159edu a pot\u00e9 k n\u00ed uzamkn\u011bte origin<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pokud provozujete web z NAS, prvkem, kter\u00fd odvede pr\u00e1ci, kterou sm\u011brova\u010d nezvl\u00e1dne, je reverzn\u00ed proxy WAF. Pou\u017e\u00edv\u00e1me Cloudflare, a d\u016fvodem je sp\u00ed\u0161e pozice ne\u017e zna\u010dka: TLS kon\u010d\u00ed na okraji (edge), tak\u017ee cel\u00fd po\u017eadavek je \u010diteln\u00fd v okam\u017eiku, kdy se p\u0159ij\u00edm\u00e1 rozhodnut\u00ed. Metoda, cesta, dotaz, hlavi\u010dky, cookies i t\u011blo jsou pro pravidlo pln\u011b dostupn\u00e9.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Proto se ochrany PHP2Shell objevily tam a ne na sm\u011brova\u010di. Kdy\u017e se objevily zranitelnosti CVE, spravovan\u00e1 sada pravidel z\u00edskala b\u011bhem dvou dn\u016f sedm pravidel pro tuto dvojici a ta byla aktivn\u00ed ve v\u0161ech \u010dty\u0159ech n\u00e1mi provozovan\u00fdch z\u00f3n\u00e1ch d\u0159\u00edve, ne\u017e jsme dokon\u010dili p\u0159estavbu vlastn\u00edch kontejner\u016f. V kan\u00e1lu Threat Prevention se nikdy \u017e\u00e1dn\u00fd ekvivalent neobjevil a ani o p\u011bt dn\u00ed pozd\u011bji st\u00e1le neexistuje \u017e\u00e1dn\u00e9 ve\u0159ejn\u00e9 pravidlo pro Snort nebo Emerging Threats ke instalaci.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Jedno varov\u00e1n\u00ed, kter\u00e9 je d\u016fle\u017eit\u011bj\u0161\u00ed ne\u017e volba poskytovatele. Proxy v pop\u0159ed\u00ed pom\u00e1h\u00e1 pouze tehdy, dokud ji nelze obej\u00edt. Pokud va\u0161e adresa p\u016fvodu odpov\u00edd\u00e1 p\u0159\u00edmo do ve\u0159ejn\u00e9ho internetu, ka\u017ed\u00fd, kdo ji objev\u00ed, obejde v\u0161echna edge pravidla, kter\u00e1 jste napsali. Omezte port 443 na p\u016fvodu pouze na s\u00ed\u0165ov\u00e9 rozsahy proxy, na\u010d\u00edtejte tyto rozsahy z koncov\u00e9ho bodu poskytovatele nam\u00edsto jejich pevn\u00e9ho k\u00f3dov\u00e1n\u00ed a ov\u011b\u0159te uzam\u010den\u00ed vy\u017e\u00e1d\u00e1n\u00edm webu p\u0159\u00edmo z jeho adresy. Na\u0161e \u0161ir\u0161\u00ed nastaven\u00ed a \u010dty\u0159i vrstvy za touto jsou pops\u00e1ny v <a href=\"https:\/\/synopower.club\/cs\/docs\/synology-nas-security-public-website\/\">the five layers we run<\/a>.<\/p>\n\n\n\n<h2 id=\"threat-prevention-limits-and-security-notes\" class=\"wp-block-heading\">Omezen\u00ed a bezpe\u010dnostn\u00ed pozn\u00e1mky k aplikaci Threat Prevention<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Threat Prevention vy\u017eaduje extern\u00ed \u00falo\u017ei\u0161t\u011b ve sm\u011brova\u010di a nen\u00ed k dispozici u v\u0161ech model\u016f, proto p\u0159ed pl\u00e1nov\u00e1n\u00edm ov\u011b\u0159te podporu pro v\u00e1\u0161 hardware. Engine je tak\u00e9 nejvyt\u00ed\u017een\u011bj\u0161\u00ed \u010dinnost\u00ed va\u0161eho sm\u011brova\u010de a na spot\u0159ebitelsk\u00e9 jednotce je to komponenta, u n\u00ed\u017e je nejpravd\u011bpodobn\u011bj\u0161\u00ed, \u017ee se stane stropem propustnosti. M\u011b\u0159te p\u0159ed a po, ne\u017e abyste v\u011b\u0159ili marketingov\u00e9mu \u010d\u00edslu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pova\u017eujte ka\u017ed\u00e9 \u010d\u00edslo na obrazovce p\u0159ehledu za po\u010det shod signatur, nikoli za po\u010det zastaven\u00fdch \u00fatok\u016f. Tyto dv\u011b hodnoty se li\u0161\u00ed v obou sm\u011brech. Z\u00e1sah reputace v\u016f\u010di skeneru, kter\u00fd by nikdy ni\u010deho nedos\u00e1hl, nav\u00fd\u0161\u00ed celkov\u00fd po\u010det, a klidn\u00fd t\u00fdden nic nedokazuje o provozu HTTPS, kter\u00fd engine nedok\u00e1\u017ee p\u0159e\u010d\u00edst.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">V aplikaci Threat Prevention z\u00e1le\u017e\u00ed na stavu stejn\u011b jako na z\u00e1va\u017enosti. Volba Automaticky zahazovat vysoce rizikov\u00e9 pakety funguje pouze pro vysok\u00e9 p\u00e1smo, tak\u017ee z\u00e1znamy se st\u0159edn\u00ed z\u00e1va\u017enost\u00ed jsou zaznamen\u00e1ny a p\u0159ed\u00e1ny d\u00e1l. Rozhran\u00ed zobrazuj\u00edc\u00ed Alert v\u00e1m oznamuje, \u017ee paket byl doru\u010den.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kan\u00e1l signatur je dodavatelsk\u00fd \u0159et\u011bzec. ET Open se obnovuje podle pl\u00e1nu, zaost\u00e1v\u00e1 za komer\u010dn\u00ed sadou pravidel a pro n\u011bkolik dn\u00ed starou zranitelnost nemus\u00ed dodat v\u016fbec nic. Ovl\u00e1dac\u00ed panel, kter\u00fd hl\u00e1s\u00ed datab\u00e1zi jako aktu\u00e1ln\u00ed, hl\u00e1s\u00ed, \u017ee odpov\u00edd\u00e1 kan\u00e1lu, nikoli to, \u017ee kan\u00e1l pokr\u00fdv\u00e1 to, co je v sou\u010dasnosti zneu\u017e\u00edv\u00e1no.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nic z toho nenahrazuje patchov\u00e1n\u00ed. Ka\u017ed\u00e1 zde prob\u00edran\u00e1 vrstva v\u00e1m z\u00edsk\u00e1v\u00e1 \u010das pro to, co zranitelnost skute\u010dn\u011b odstra\u0148uje, a t\u00edm je aktualizace dot\u010den\u00e9ho softwaru. V p\u0159\u00edpad\u011b PHP2Shell to znamenalo nov\u00e9 bal\u00ed\u010dky PHP a znovu sestaven\u00e9 kontejnery a \u017e\u00e1dn\u00e9 s\u00ed\u0165ov\u00e9 opat\u0159en\u00ed to nemohlo nahradit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A kone\u010dn\u011b, odolejte poku\u0161en\u00ed zapnout ka\u017edou t\u0159\u00eddu po p\u0159e\u010dten\u00ed bezpe\u010dnostn\u00edho varov\u00e1n\u00ed. T\u0159\u00eddy jako Misc activity obsahuj\u00ed tis\u00edce pravidel s n\u00edzkou hodnotou, kter\u00e1 v\u011bt\u0161inou jen generuj\u00ed \u0161um a spot\u0159ebov\u00e1vaj\u00ed stejnou kapacitu, kterou pot\u0159ebuj\u00ed u\u017eite\u010dn\u00e9 t\u0159\u00eddy. Tich\u00fd, dob\u0159e vylad\u011bn\u00fd seznam ud\u00e1lost\u00ed, kter\u00fd si skute\u010dn\u011b p\u0159e\u010dtete, je lep\u0161\u00ed ne\u017e hlu\u010dn\u00fd, kter\u00fd se nau\u010d\u00edte ignorovat.<\/p>\n\n\n\n<h2 id=\"frequently-asked-questions\" class=\"wp-block-heading\">\u010casto kladen\u00e9 ot\u00e1zky<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list\">\n<div id=\"faq-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Chr\u00e1n\u00ed Threat Prevention webov\u00e9 str\u00e1nky hostovan\u00e9 na m\u00e9m NAS?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>T\u00e9m\u011b\u0159 ne a ne zp\u016fsobem, kter\u00fd n\u00e1zev napov\u00edd\u00e1. Webov\u00e9 str\u00e1nky jsou poskytov\u00e1ny p\u0159es HTTPS a Threat Prevention neprov\u00e1d\u00ed \u017e\u00e1dnou zachyt\u00e1v\u00e1n\u00ed TLS (TLS interception), tak\u017ee po\u017eadavek je v\u0161ude, kde ho router vid\u00ed, ne\u010diteln\u00fd. P\u0159i b\u011b\u017en\u00e9m nastaven\u00ed se po\u017eadavek stane \u010diteln\u00fdm a\u017e pot\u00e9, co reverzn\u00ed proxy ukon\u010d\u00ed TLS, a tento skok je obvykle na stejn\u00e9 pods\u00edti, tak\u017ee je p\u0159ep\u00edn\u00e1n (switched), nikoli sm\u011brov\u00e1n (routed), a router jej nikdy nep\u0159en\u00e1\u0161\u00ed. Pro webov\u00e9 str\u00e1nky pou\u017eijte WAF s reverzn\u00ed proxy a Threat Prevention si ponechte na to, v \u010dem je dobr\u00fd.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Which option should I switch on to stop a specific CVE?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Usually none, because the answer depends on whether the vendor shipped a signature for it at all. Open Self-Defined Policy and you will find you can change the action on an existing signature but cannot add one of your own. If no rule exists in the feed, there is nothing to enable, and for a vulnerability a few days old that is the normal case.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Why does my event list only name one or two devices?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Because those are the devices receiving traffic the engine can actually read. On our network it is consistently the mail server, which answers cleartext SMTP on port 25. A web host behind a reverse proxy produces few entries not because it is attacked less, but because its traffic is encrypted at every point the router inspects.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Kontroluje Threat Prevention provoz mezi za\u0159\u00edzen\u00edmi v m\u00e9 s\u00edti LAN?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>No. Two devices in the same subnet reach each other through a switch, and the router is not in that path, so the packets are never offered to the inspection engine. The Monitored Interfaces table in Settings shows the real scope, and no option there extends it to same-subnet traffic.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Je bezpe\u010dn\u00e9 nechat Threat Prevention zapnut\u00fd?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Yes, with one caveat worth knowing. The recommended default passes traffic through unfiltered when the engine is saturated, which keeps your line up at the cost of inspection. The opposite mode drops that traffic instead. We have also had the engine wedge under a flood of harmless exploit attempts and start refusing a server&#8217;s outbound traffic, which cost us a mail outage, so include the router in your list of suspects when a machine goes quiet.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Pomohl Threat Prevention s PHP2Shell v\u016fbec n\u011bjak?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>No, and three separate reasons each would have been enough on their own. The traffic was encrypted everywhere the router looks, no Snort or Emerging Threats signature was published for either CVE, and the exploit has no payload shape to match because the first request is defined by the memory it consumes and the second looks completely ordinary. The fix was new PHP packages, with a reverse-proxy WAF covering the gap in the meantime.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-7\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Is disabling session.upload_progress enough on an unpatchable host?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>It helps and it is not enough. Switching it off removes one documented route to CVE-2026-109619, which is worth doing on a host you truly cannot update, but memory exhaustion is reachable by other means and the setting does nothing for CVE-2026-109618. Treat it as borrowed time and plan the package update.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-8\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">What should I buy or configure first for a NAS-hosted site?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Um\u00edst\u011bte p\u0159ed web reverzn\u00ed proxy se spravovanou sadou pravidel a potom omezte p\u016fvod tak, aby port 443 odpov\u00eddal pouze s\u00edti t\u00e9to proxy. Tyto dva kroky spole\u010dn\u011b p\u0159esunou bod kontroly na m\u00edsto, kde je po\u017eadavek \u010diteln\u00fd, a odstran\u00ed obch\u00e1zen\u00ed, kter\u00e9 by jej zneplatnilo. Pot\u00e9 ponechte Threat Prevention zapnut\u00fd pro odchoz\u00ed komunikaci s \u0159\u00eddic\u00edmi servery (command and control) a pro slu\u017eby v ne\u0161ifrovan\u00e9m textu, co\u017e je oblast, kde odv\u00e1d\u00ed skute\u010dnou pr\u00e1ci.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<h2 id=\"references-and-video-walkthroughs\" class=\"wp-block-heading\">Reference a video n\u00e1vody<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Prim\u00e1rn\u00ed zdroje pro v\u0161e v\u00fd\u0161e uveden\u00e9 a nav\u00edc t\u0159i n\u00e1vody, kter\u00e9 stoj\u00ed za pozornost.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/kb.synology.com\/en-global\/SRM\/help\/ThreatPrevention\/threatprevention_desc\" target=\"_blank\" rel=\"noreferrer noopener\">Centrum znalost\u00ed Synology: Threat Prevention<\/a> covers requirements, modes and model support.<\/li>\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_26_14\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-26:14<\/a> lists the fixed PHP package versions for DSM, including the 7.4 build.<\/li>\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/php2shell\/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities\" target=\"_blank\" rel=\"noreferrer noopener\">Synology Statement on PHP2Shell<\/a> names the affected packages and the one that needs a manual update.<\/li>\n\n<li><a href=\"https:\/\/developers.cloudflare.com\/waf\/managed-rules\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Cloudflare WAF managed rules<\/a> explains how managed rulesets are versioned and deployed.<\/li>\n\n<li><a href=\"https:\/\/www.cloudflare.com\/ips\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Rozsahy IP adres Cloudflare<\/a> is the endpoint to read when locking an origin to the proxy instead of hard-coding addresses.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"SRM Threat Prevention \u2013 Ochrana s\u00edt\u011b v re\u00e1ln\u00e9m \u010dase vysv\u011btlena\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/yT_xGpxGF7k?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">Vysv\u011btlen\u00ed SRM Threat Prevention, v\u010detn\u011b toho, kde se tento bal\u00ed\u010dek v s\u00edti nach\u00e1z\u00ed<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Test rychlosti Synology Router s zapnut\u00fdm Threat Prevention.\" width=\"1200\" height=\"900\" src=\"https:\/\/www.youtube.com\/embed\/wuuRthcZQ_E?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">Test propustnosti s povolenou funkc\u00ed Threat Prevention, co\u017e je da\u0148, kterou nikdo nezmi\u0148uje<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Protecting Your Public Websites with Cloudflare WAF\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/NbEo8p2Hvt8?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">Cloudflare o ochran\u011b ve\u0159ejn\u00fdch webov\u00fdch str\u00e1nek pomoc\u00ed WAF \u2013 vrstv\u011b, kter\u00e1 \u010dte po\u017eadavek<\/figcaption><\/figure>","protected":false},"excerpt":{"rendered":"<p>Threat Prevention is the package most people reach for the moment they decide to host a website on a Synology NAS. It sits on the router, it has a shield icon, and its dashboard counts attacks in the hundreds, so it looks like the thing that keeps a public site safe. We run it on [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":22124,"comment_status":"open","ping_status":"closed","template":"","meta":{"_eb_attr":"","_xspeed_no_cache":false,"_xspeed_expiry_hours":0,"footnotes":""},"doc_category":[197],"doc_tag":[],"class_list":["post-22125","docs","type-docs","status-publish","has-post-thumbnail","hentry","doc_category-nas-hosting-101"],"year_month":"2026-10","word_count":3684,"total_views":"43","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"Adair Hsu","author_nicename":"adairpk17","author_url":"https:\/\/synopower.club\/cs\/author\/adairpk17\/"},"doc_category_info":[{"term_name":"NAS Hosting 101","term_url":"https:\/\/synopower.club\/cs\/docs-category\/nas-hosting-101\/"}],"doc_tag_info":[],"_links":{"self":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/docs\/22125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/comments?post=22125"}],"version-history":[{"count":2,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/docs\/22125\/revisions"}],"predecessor-version":[{"id":22127,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/docs\/22125\/revisions\/22127"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/media\/22124"}],"wp:attachment":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/media?parent=22125"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/doc_category?post=22125"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/doc_tag?post=22125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}