{"id":22125,"date":"2026-10-25T07:58:10","date_gmt":"2026-10-24T23:58:10","guid":{"rendered":"https:\/\/synopower.club\/?post_type=docs&#038;p=22125"},"modified":"2026-10-25T08:04:28","modified_gmt":"2026-10-25T00:04:28","password":"","slug":"synology-threat-prevention-blind-spots","status":"publish","type":"docs","link":"https:\/\/synopower.club\/da\/docs\/synology-threat-prevention-blind-spots\/","title":{"rendered":"Synology Threat Prevention: Hvad den opfanger, og hvad den ikke kan se"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Threat Prevention er pakken, de fleste r\u00e6kker ud efter, i det \u00f8jeblik de beslutter sig for at hoste et websted p\u00e5 en Synology NAS. Den ligger p\u00e5 routeren, har et skjold-ikon, og dens kontrolpanel t\u00e6ller angreb i hundredvis, s\u00e5 den ligner den ting, der holder et offentligt websted sikkert. Vi k\u00f8rer den p\u00e5 en RT6600ax foran hver eneste maskine, vi ejer, og den har v\u00e6ret v\u00e6rd at have. Den er ogs\u00e5, for et selvhostet websted, n\u00e6sten fuldst\u00e6ndig ved siden af skiven.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Denne NAS Hosting 101-artikel \u00e5bner vores egen router, l\u00e6ser en reel uges h\u00e6ndelser ud af den og viser pr\u00e6cis, hvor Threat Prevention holder op med at kunne hj\u00e6lpe, ved at bruge PHP2Shell som et eksempel p\u00e5 et angreb, som Threat Prevention aldrig ville opdage.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>SynoPower Club Punkt:<\/strong> Jeg brugte lang tid i Synology-supporten, og sp\u00f8rgsm\u00e5let kom hele tiden: hvilken indstilling skal jeg sl\u00e5 til for at stoppe dette angreb. Det er det rigtige instinkt rettet mod den forkerte boks. Det, der endelig fik det til at falde p\u00e5 plads for mig, var at l\u00e6se vores egen h\u00e6ndelsesliste i stedet for funktionssiden. Hver eneste advarsel, vores router har registreret i denne m\u00e5ned, var en adresse med et d\u00e5rligt omd\u00f8mme, ikke en anmodning med en d\u00e5rlig payload. N\u00e5r du f\u00f8rst har set det, holder du op med at bede Threat Prevention om at inspicere trafik, som den opbevarer i en forseglet konvolut.<\/p>\n<\/blockquote>\n\n\n\n<h2 id=\"what-threat-prevention-actually-does-on-a-synology-router\" class=\"wp-block-heading\">Hvad Threat Prevention reelt g\u00f8r p\u00e5 en Synology-router<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Threat Prevention er et system til registrering og forebyggelse af indtr\u00e6ngen, bygget p\u00e5 Snort- og Suricata-arven. Det l\u00e6ser pakker, mens routeren videresender dem, sammenligner dem med et signaturs\u00e6t og enten registrerer en advarsel eller afviser pakken. P\u00e5 vores RT6600ax er signatur-feedet ET Open, den gratis udgave af Emerging Threats-regels\u00e6ttet, som opdateres dagligt kl. 09:00.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tre egenskaber f\u00f8lger af det design, og alle tre betyder mere end et hvilket som helst afkrydsningsfelt i brugerfladen:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>It can only examine packets the router <strong>forwards<\/strong>. Traffic that never crosses the routing engine is not slow to inspect, it is invisible.<\/li>\n\n<li>It can only match on bytes it can <strong>read<\/strong>. Der er ingen TLS-opsnapning nogen steder i Threat Prevention, s\u00e5 en krypteret payload er uigennemsigtig.<\/li>\n\n<li>It can only match signatures <strong>somebody else wrote<\/strong>. The interface exposes vendor classes to switch on and off, and nothing that accepts a rule you author yourself.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Intet af det er en defekt. En IPS ved netv\u00e6rksperimeteren er en rimelig og nyttig ting at have. Fejlen er at antage, at perimeteren er der, hvor et websted angribes.<\/p>\n\n\n\n<h2 id=\"threat-prevention-vs-a-web-application-firewall\" class=\"wp-block-heading\">Threat Prevention i forhold til en Web Application Firewall<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Den klareste m\u00e5de at se forskellen p\u00e5 er at s\u00e6tte Threat Prevention ved siden af en web application firewall og sp\u00f8rge, hvad hver enkelt st\u00e5r med, n\u00e5r den tr\u00e6ffer sin beslutning. Threat Prevention st\u00e5r med en pakke. En WAF st\u00e5r med en dekrypteret HTTP-anmodning.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Question<\/th><th>Router IPS<\/th><th>Reverse-proxy WAF<\/th><\/tr><\/thead><tbody><tr><td>Hvor den k\u00f8rer<\/td><td>On the routing path, before TLS ends<\/td><td>At the edge, after TLS ends<\/td><\/tr><tr><td>What it inspects<\/td><td>Packet headers and any cleartext bytes<\/td><td>Method, path, headers, cookies, body<\/td><\/tr><tr><td>HTTPS traffic<\/td><td>Opaque<\/td><td>Fully readable<\/td><\/tr><tr><td>Rules you can add<\/td><td>Vendor classes on or off<\/td><td>Your own expressions, plus managed rulesets<\/td><\/tr><tr><td>Same-subnet traffic<\/td><td>Never seen<\/td><td>Not applicable, it is upstream of everything<\/td><\/tr><tr><td>Typical catch<\/td><td>Reputation hits, scans, cleartext exploits, outbound command and control<\/td><td>Injection, traversal, known CVE request shapes, credential stuffing, bots<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Det er ikke konkurrerende produkter. De d\u00e6kker forskellige segmenter af den samme rejse, og et selvhostet websted har langt mere brug for den sidstn\u00e6vnte end den f\u00f8rstn\u00e6vnte. Vi beholder begge dele, og vi forventer helt forskellige ting af hver af dem.<\/p>\n\n\n\n<h2 id=\"reading-595-events-from-one-week-on-our-own-router\" class=\"wp-block-heading\">L\u00e6sning af 595 h\u00e6ndelser fra \u00e9n uge p\u00e5 vores egen router<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Her er oversigtssk\u00e6rmen for Threat Prevention p\u00e5 vores produktionsrouter den 25. oktober 2026. Femhundrede og femoghalvfems ondsindede h\u00e6ndelser over syv dage, 75 af dem af h\u00f8j alvorlighed. Det ser ud som en mur, der holder en oversv\u00f8mmelse tilbage.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"eager\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events.webp\" alt=\"Synology Threat Prevention-oversigt p\u00e5 en RT6600ax, der viser 595 skadelige h\u00e6ndelser p\u00e5 syv dage og \u00e9n enhed med potentielle trusler\" class=\"wp-image-22119\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-1000x482.webp 1000w\"  fetchpriority=\"high\"\/><figcaption class=\"wp-element-caption\">Syv dage p\u00e5 vores egen RT6600ax. \u00c9n enhed st\u00e5r for hver eneste h\u00e6ndelse af h\u00f8j alvorlighed, og det er mailserveren, ikke webhosten.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">To detaljer p\u00e5 det sk\u00e6rmbillede er mere v\u00e6rd end overskriftstallet. Den f\u00f8rste er, at kun \u00e9n enhed overhovedet vises under potentielle trusler, og det er REVERSE_MAIL, maskinen der afbryder TLS og k\u00f8rer MailPlus. Den anden er signaturdatoen ved siden af det gr\u00f8nne flueben. \u00c5bn nu en enkelt h\u00e6ndelse og l\u00e6s, hvad der reelt blev udl\u00f8st.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature.webp\" alt=\"En Threat Prevention-h\u00e6ndelsesdetalje, der viser en ET CINS-IP-signatur for d\u00e5rligt omd\u00f8mme med statussen Advarsel og et regelindhold, der kun matcher p\u00e5 IP-adresser\" class=\"wp-image-22120\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Signaturteksten afsl\u00f8rer det hele. Den begynder med alert ip efterfulgt af en liste over adresser, s\u00e5 intet i anmodningen blev unders\u00f8gt.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Klassificering Misc Attack, alvorlighed Medium, status Alert, signaturnavn ET CINS Active Threat Intelligence Poor Reputation IP group 24. \u00c5bn regelteksten, og den starter med alert ip og derefter en lang liste af adresser. Det er et opslag i en blokeringsliste. Ingen del af HTTP-anmodningen blev l\u00e6st, fordi ingen del af den kunne l\u00e6ses. Vi stikpr\u00f8vede h\u00e6ndelser mod en anden destination, vores Virtual DSM-v\u00e6rt, og fandt den samme regelklasse med et andet gruppenummer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">S\u00e5 det \u00e6rlige resum\u00e9 af \u00e9n uge er dette: Routeren genkendte et par hundrede forbindelser fra adresser, der allerede havde et d\u00e5rligt rygte. Det er virkelig nyttigt. Det er ikke registrering af webangreb, og ingen b\u00f8r fortolke tallet 595, som om det var.<\/p>\n\n\n\n<h2 id=\"how-to-audit-threat-prevention-in-4-steps\" class=\"wp-block-heading\">S\u00e5dan gennemg\u00e5r du Threat Prevention i 4 trin<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">F\u00f8r du betror Threat Prevention noget som helst, b\u00f8r du bruge ti minutter p\u00e5 at finde ud af, hvad den rent faktisk g\u00f8r p\u00e5 dit eget netv\u00e6rk. Hvert trin nedenfor er skrivebeskyttet og \u00e6ndrer ingenting.<\/p>\n\n\n<div id=\"rank-math-howto\" class=\"rank-math-block\" >\n<div class=\"rank-math-howto-description\">\n\n<\/div>\n\n<div class=\"rank-math-steps\">\n<div id=\"step-1\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">\u00c5bn en h\u00e6ndelse, og l\u00e6s signaturens br\u00f8dtekst<\/h3>\n<div class=\"rank-math-step-content\"><p>G\u00e5 til Threat Prevention, derefter H\u00e6ndelser, og klik p\u00e5 en vilk\u00e5rlig post. Se forbi det farvede alvorlighedsm\u00e6rke ved boksen Signaturregler. En regel, der starter med alert ip, matcher kun p\u00e5 adresse-omd\u00f8mme. En regel, der indeholder content eller pcre, matcher p\u00e5 nyttebelastning (payload). T\u00e6l, hvor mange af hver du kan finde i din egen liste, f\u00f8r du beslutter dig for, hvad Threat Prevention beskytter.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-2\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Tjek, hvilke gr\u00e6nseflader der overv\u00e5ges<\/h3>\n<div class=\"rank-math-step-content\"><p>\u00c5bn Indstillinger, og l\u00e6s tabellen Overv\u00e5gede gr\u00e6nseflader. Kun de gr\u00e6nseflader, der er afkrydset her, inspekteres, og i en normal ops\u00e6tning er det dem, der vender mod internettet. Trafik mellem to enheder p\u00e5 det samme LAN-undernet switches i stedet for at blive routed, s\u00e5 den n\u00e5r aldrig inspektionsmotoren, og ingen indstilling p\u00e5 denne side kan \u00e6ndre det.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-3\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Find ud af, hvad der sker, n\u00e5r routeren er optaget<\/h3>\n<div class=\"rank-math-step-content\"><p>I det samme panel skal du se p\u00e5 standardtilstanden. Netv\u00e6rksstabilitetsprioritet betyder, at n\u00e5r trafikken overstiger, hvad motoren kan behandle, sendes det overskydende ufiltreret igennem. Sikkerhedsprioritet betyder, at det overskydende i stedet droppes. Det ene valg fejler \u00e5bent og holder din linje oppe, det andet fejler lukket og tager din linje ned. Beslut dig for, hvad du rent faktisk \u00f8nsker.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-4\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Try to add a rule of your own<\/h3>\n<div class=\"rank-math-step-content\"><p>Open Self-Defined Policy. You can change the action for a signature the vendor already ships, and you can scope it by source or destination address. There is no field anywhere that accepts a signature you wrote. If your threat is newer than your signature feed, this screen is where you discover you have no way to respond.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n\n\n\n<h2 id=\"where-it-genuinely-earns-its-place\" class=\"wp-block-heading\">Hvor den reelt g\u00f8r sig fortjent til sin plads<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Vi beholder Threat Prevention sl\u00e5et til, og ikke af overtro. Der er fire opgaver, den udf\u00f8rer, som intet andet i vores stack g\u00f8r.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Outbound command and control.<\/strong> This is the strongest case by far. A compromised device has to call home, that call has to leave through the router, and a good share of it is still either cleartext or aimed at a known address. Our router ships the Malware Command and Control Activity class with 3,450 of 3,498 rules enabled, and the Domain Observed Used for C2 class with 7,157 of 7,202.<\/li>\n\n<li><strong>Cleartext protocols from the internet.<\/strong> Our mail server answers on port 25, and SMTP is cleartext until STARTTLS. That is real inspectable traffic, and it is no accident that the mail host is the one device our events list keeps naming.<\/li>\n\n<li><strong>Scanning and reconnaissance.<\/strong> Port sweeps and fingerprinting are recognised by connection behaviour rather than by payload, so encryption does not hide them.<\/li>\n\n<li><strong>Visibility.<\/strong> A searchable log of who knocked and with what reputation is worth having, even when every entry is only a reputation hit. It is monitoring value, and it should be counted as monitoring value rather than as protection.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Hvad de fire har til f\u00e6lles er, at ingen af dem er et angreb p\u00e5 et websted.<\/p>\n\n\n\n<h2 id=\"why-a-site-owner-asks-threat-prevention-for-the-wrong-thing\" class=\"wp-block-heading\">Hvorfor en webstedsejer beder Threat Prevention om det forkerte<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">N\u00e5r du hoster et websted p\u00e5 en NAS, har anmodningsstien normalt en reverse proxy i sig. Vores ser s\u00e5ledes ud, og ops\u00e6tningen er det, der afg\u00f8r alt:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The visitor reaches <strong>Cloudflare<\/strong>, which answers most requests from cache and inspects the rest in cleartext.<\/li>\n\n<li>What is left crosses the <strong>router<\/strong>, hvor Threat Prevention ser en krypteret TLS-str\u00f8m og intet andet.<\/li>\n\n<li>De <strong>reverse proxy NAS<\/strong> terminates TLS and forwards plain HTTP to the machine that runs the site.<\/li>\n\n<li>That last hop is on the <strong>same subnet<\/strong>, so the frame goes through a switch and the router is not in the path.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">L\u00e6s de fire linjer igennem sammen, og f\u00e6lden er \u00e5benlys. Det eneste segment, hvor anmodningen findes i l\u00e6sbar form, er det sidste hop, og det er pr\u00e6cis det ene segment, som routeren ikke kan observere. Alle steder, routeren kan observere, er anmodningen krypteret. Der findes intet afkrydsningsfelt, der l\u00f8ser en s\u00e5dan modstrid, og Threat Prevention fejler ikke, n\u00e5r det forholder sig roligt. Det rapporterer n\u00f8jagtigt om trafik, det strukturelt set ikke er i stand til at l\u00e6se.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dette er ogs\u00e5 grunden til, at det ikke virker at pege Threat Prevention mod et specifikt websted. Pakken er bundet til routergr\u00e6nseflader, ikke til v\u00e6rtsnavne. Den har intet begreb om, hvilket af dine websteder en forbindelse tilh\u00f8rer, fordi den aldrig ser Host-headeren.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces.webp\" alt=\"Threat Prevention-indstillinger, der viser overv\u00e5gede gr\u00e6nseflader begr\u00e6nset til de internetvendte porte, prioriteret netv\u00e6rksstabilitetstilstand og ET Open-signaturkilden\" class=\"wp-image-22121\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Monitored Interfaces er hele omfanget af Threat Prevention. Bem\u00e6rk standardtilstanden nedenunder og signaturkilden i bunden.<\/figcaption><\/figure>\n\n\n\n<h2 id=\"three-reasons-php2shell-was-invisible-at-the-router\" class=\"wp-block-heading\">Tre grunde til, at PHP2Shell var usynlig p\u00e5 routeren<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell, parret af s\u00e5rbarheder til fjernk\u00f8rsel af kode f\u00f8r godkendelse, der spores som CVE-2026-109618 og CVE-2026-109619, blev l\u00e6kket den 20. oktober 2026 og rettet upstream den f\u00f8lgende dag. Det er pr\u00e6cis den type ting, folk h\u00e5ber, at en router-IPS vil absorbere, og det er v\u00e6rd at v\u00e6re specifik om, hvorfor den ikke kunne.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>For det f\u00f8rste var trafikken krypteret p\u00e5 hvert eneste segment, routeren overv\u00e5ger.<\/strong> The exploit lives in the HTTP request, and the HTTP request only exists in the clear after TLS has been terminated, which happens downstream of the router on a hop the router never carries.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>For det andet eksisterer der ingen Threat Prevention-signatur, man kan sl\u00e5 til.<\/strong> We checked again on 25 October 2026 and found no published Snort or Emerging Threats rule for either CVE. Our feed is ET Open, the free tier, which lags the commercial set, and the Self-Defined Policy screen accepts no rule of your own. So even an operator who knew precisely what to match for had nowhere to put it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy.webp\" alt=\"Sk\u00e6rmbilledet Egendefineret politik i Threat Prevention, tomt, med kun Rediger og Slet tilg\u00e6ngelige og ingen mulighed for at oprette en ny signatur\" class=\"wp-image-22123\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Self-Defined Policy justerer handlingen p\u00e5 signaturer, som leverand\u00f8ren allerede leverer. Der er intet felt til at angive en regel, du selv har skrevet.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>For det tredje, og mest fundamentalt, har dette angreb ingen nyttelastform at matche.<\/strong> The chain takes two requests. The first has to push PHP into exhausting its memory limit, which makes the engine abandon a request through a path that skips cleanup and leaves some global state behind. The second request is ordinary, and it is the one that reaches a stale pointer and turns into code execution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Den f\u00f8rste anmodning defineres af, hvor meget hukommelse den forbruger, ikke af en bestemt sekvens af bytes, og en stor upload, en enorm JSON-br\u00f8dtekst, et dybt array og en lang streng i et regul\u00e6rt udtryk opfylder alle betingelserne. Den anden indeholder overhovedet ingen ondsindede bytes. En IPS tr\u00e6ffer beslutninger pr. pakke og pr. flow. Den har ingen model for en worker-proces, der f\u00f8rer kontamineret tilstand fra \u00e9n anmodning videre til den n\u00e6ste, hvilket er pr\u00e6cis der, hvor denne fejl ligger.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Det s\u00e6tter ogs\u00e5 gr\u00e6nserne for den afb\u00f8dning, der cirkulerede p\u00e5 det tidspunkt, som var at sl\u00e5 session.upload_progress fra i PHP-konfigurationen. Det fjerner ganske vist \u00e9n veldokumenteret m\u00e5de at n\u00e5 det andet CVE p\u00e5, og p\u00e5 en maskine, du reelt ikke kan patche, er det bedre end ingenting. Det er ikke en l\u00f8sning: opbrug af hukommelse opn\u00e5s ikke kun gennem denne ene funktion, og indstillingen har overhovedet ingen indflydelse p\u00e5 CVE-2026-109618. Vi brugte det som en midlertidig l\u00f8sning p\u00e5 pr\u00e6cis \u00e9n v\u00e6rt og betragtede det som l\u00e5nt tid, ikke som en endelig l\u00f8sning. Den fulde beretning om, hvordan vi patchede, findes i vores <a href=\"https:\/\/synopower.club\/da\/synology-php2shell-emergency-patch\/\">PHP2Shell write-up<\/a>.<\/p>\n\n\n\n<h2 id=\"fail-open-by-design-and-the-day-it-cost-us-our-mail\" class=\"wp-block-heading\">Fejl\u00e5ben af design, og den dag det kostede os vores mail<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Der er endnu en egenskab, der er v\u00e6rd at kende, f\u00f8r du betragter Threat Prevention som en kontrolforanstaltning, du kan stole p\u00e5. Dens anbefalede standard er netv\u00e6rksstabilitetsprioriteret tilstand, og gr\u00e6nsefladen angiver uden forsk\u00f8nnelse, hvad det betyder: N\u00e5r trafikken overstiger behandlingskapaciteten, omg\u00e5s afventende pakker uden filtrering. Alternativet, sikkerhedsprioriteret tilstand, afviser dem i stedet og advarer om, at forbindelsen vil v\u00e6re ustabil, indtil problemet er l\u00f8st.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Det er en fornuftig standardindstilling for en hjemmerouter. Det betyder dog, at Threat Prevention er svagest p\u00e5 det n\u00f8jagtige tidspunkt, hvor du ville \u00f8nske, at det var st\u00e6rkest, fordi et oversv\u00f8mmelsesangreb b\u00e5de er det, du \u00f8nsker filtreret, og det, der overstiger kapaciteten.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vi har ogs\u00e5 den anden fejltilstand registreret. Den 2. august 2026 t\u00e6skede nogen vores reverse proxy 116 gange med et exploit til en Windows PHP-CGI-fejl, som overhovedet ikke kan fungere mod Linux. Threat Prevention afviste s\u00e5 mange pakker, at dets egen tilstand l\u00e5ste sig fast, og begyndte derefter at afvise den udg\u00e5ende trafik fra selvsamme maskine, det skulle forsvare. Vores mailk\u00f8 gik i st\u00e5, og symptomet lignede n\u00f8jagtigt en DNS-fejl. En genstart af routeren l\u00f8ste det. Intet dukkede op i proxyens adgangslog, fordi intet nogensinde n\u00e5ede frem til proxyen. Et angreb, der strukturelt set var ude af stand til at lykkes, kostede os alligevel et nedbrud p\u00e5 grund af den ting, der skulle stoppe det.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list.webp\" alt=\"Klasse- og signaturlisten i Threat Prevention med antal aktiverede pr. klasse, herunder Web Application Attack p\u00e5 5.928 af 6.010 regler\" class=\"wp-image-22122\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Skiftekontakter p\u00e5 klasseniveau med et antal aktiverede til h\u00f8jre. Dette er hele finjusteringsfladen.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Kig p\u00e5 antallet af aktiverede i den liste, mens du er der. Web Application Attack viser 5.928 af 6.010 regler aktive, og forholdet er lignende p\u00e5 tv\u00e6rs af de klasser, vi bekymrer os om. At sl\u00e5 en klasse til sl\u00e5r ikke alle regler inde i den til, og gr\u00e6nsefladen giver dig ingen mulighed for at se, hvilke af de resterende du mangler.<\/p>\n\n\n\n<h2 id=\"put-a-proxy-in-front-then-lock-the-origin-to-it\" class=\"wp-block-heading\">Placer en proxy foran, og l\u00e5s derefter origin-serveren til den<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Hvis du afvikler et websted fra en NAS, er den kontrol, der udf\u00f8rer arbejdet, som routeren ikke kan, en reverse-proxy WAF. Vi bruger Cloudflare, og grunden er placering snarere end brand: TLS terminerer ved kanten (edge), s\u00e5 den fulde anmodning kan l\u00e6ses i det \u00f8jeblik, beslutningen tr\u00e6ffes. Metode, sti (path), query, headers, cookies og body er alle tilg\u00e6ngelige for en regel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Det er grunden til, at PHP2Shell-beskyttelserne ankom der og ikke p\u00e5 routeren. Da CVE'erne blev offentliggjort, fik det administrerede regels\u00e6t syv regler for parret inden for to dage, og de var live p\u00e5 alle fire af de zoner, vi k\u00f8rer, f\u00f8r vi var f\u00e6rdige med at genopbygge vores egne containere. Intet tilsvarende dukkede nogensinde op i Threat Prevention-feedet, og fem dage senere er der stadig ingen offentlig Snort- eller Emerging Threats-regel at installere.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u00c9n advarsel, der betyder mere end valget af udbyder. En proxy foran hj\u00e6lper kun, s\u00e5 l\u00e6nge den ikke kan omg\u00e5s. Hvis din origin-adresse svarer det offentlige internet direkte, springer enhver, der opdager den, alle de edge-regler over, du har skrevet. Begr\u00e6ns port 443 p\u00e5 origin til proxyens netv\u00e6rksomr\u00e5der, hent disse omr\u00e5der fra udbyderens slutpunkt i stedet for at h\u00e5rdkode dem, og bekr\u00e6ft l\u00e5sningen ved at anmode om webstedet direkte fra dets adresse. Vores samlede ops\u00e6tning og de fire lag bag dette beskrives i <a href=\"https:\/\/synopower.club\/da\/docs\/synology-nas-security-public-website\/\">the five layers we run<\/a>.<\/p>\n\n\n\n<h2 id=\"threat-prevention-limits-and-security-notes\" class=\"wp-block-heading\">Threat Prevention-begr\u00e6nsninger og sikkerhedsbem\u00e6rkninger<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Threat Prevention kr\u00e6ver ekstern lagring p\u00e5 routeren og er ikke tilg\u00e6ngelig p\u00e5 alle modeller, s\u00e5 bekr\u00e6ft support for din hardware, f\u00f8r du planl\u00e6gger ud fra det. Motoren er ogs\u00e5 det mest travle element p\u00e5 din router, og p\u00e5 en forbrugerenhed er det den komponent, der mest sandsynligt bliver gennemstr\u00f8mningsloftet. M\u00e5l f\u00f8r og efter i stedet for at stole p\u00e5 markedsf\u00f8ringstallene.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Behandl ethvert tal p\u00e5 oversigtssk\u00e6rmen som et antal signaturmatch, ikke som et antal stoppede angreb. De to adskiller sig i begge retninger. Et omd\u00f8mmetr\u00e6f mod en scanner, der alligevel aldrig ville opn\u00e5 noget, puster totalen op, og en stille uge beviser intet om den HTTPS-trafik, som motoren ikke kan l\u00e6se.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I Threat Prevention betyder status lige s\u00e5 meget som alvorlighedsgrad. \"Drop high-risk packets automatically\" g\u00e6lder kun for h\u00f8jrisikob\u00e5ndet, s\u00e5 poster med medium alvorlighedsgrad registreres og videresendes. En brugerflade, der viser Alert, fort\u00e6ller dig, at pakken blev leveret.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Signaturfeedet er en forsyningsk\u00e6de. ET Open opdateres efter en tidsplan, sakker bagud i forhold til det kommercielle regels\u00e6t og leverer muligvis slet intet for en s\u00e5rbarhed, der er flere dage gammel. Et kontrolpanel, der rapporterer, at databasen er opdateret, rapporterer, at den matcher feedet, ikke at feedet d\u00e6kker det, der i \u00f8jeblikket bliver udnyttet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Intet af dette erstatter patching. Hvert lag, der diskuteres her, k\u00f8ber tid til det, der reelt lukker en s\u00e5rbarhed, hvilket er opdatering af den ber\u00f8rte software. For PHP2Shell bet\u00f8d det nye PHP-pakker og genopbyggede containere, og ingen netv\u00e6rkskontrol kunne erstatte det.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Til sidst b\u00f8r du modst\u00e5 trangen til at aktivere enhver klasse efter at have l\u00e6st en sikkerhedsadvarsel. Klasser som Misc activity indeholder tusindvis af regler af lav v\u00e6rdi, som prim\u00e6rt genererer st\u00f8j og forbruger den samme kapacitet, som de nyttige klasser har brug for. En stille, veltilpasset h\u00e6ndelsesliste, som du faktisk l\u00e6ser, sl\u00e5r en st\u00f8jende, som du l\u00e6rer at ignorere.<\/p>\n\n\n\n<h2 id=\"frequently-asked-questions\" class=\"wp-block-heading\">Ofte stillede sp\u00f8rgsm\u00e5l<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list\">\n<div id=\"faq-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Beskytter Threat Prevention et websted, der er hostet p\u00e5 min NAS?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>N\u00e6ppe, og ikke p\u00e5 den m\u00e5de navnet antyder. Et websted leveres over HTTPS, og Threat Prevention udf\u00f8rer ingen TLS-opsnapning, s\u00e5 anmodningen er uigennemsigtig, uanset hvor routeren kan se den. I en typisk ops\u00e6tning bliver anmodningen f\u00f8rst l\u00e6sbar, efter at en reverse proxy afbryder TLS, og det hop er som regel p\u00e5 det samme undernet, s\u00e5 det switches i stedet for at blive routeret, og routeren b\u00e6rer det aldrig. Brug en reverse-proxy WAF til webstedet, og bevar Threat Prevention til det, det er godt til.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Which option should I switch on to stop a specific CVE?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Usually none, because the answer depends on whether the vendor shipped a signature for it at all. Open Self-Defined Policy and you will find you can change the action on an existing signature but cannot add one of your own. If no rule exists in the feed, there is nothing to enable, and for a vulnerability a few days old that is the normal case.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Why does my event list only name one or two devices?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Because those are the devices receiving traffic the engine can actually read. On our network it is consistently the mail server, which answers cleartext SMTP on port 25. A web host behind a reverse proxy produces few entries not because it is attacked less, but because its traffic is encrypted at every point the router inspects.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Inspicerer Threat Prevention trafik mellem enheder p\u00e5 mit LAN?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>No. Two devices in the same subnet reach each other through a switch, and the router is not in that path, so the packets are never offered to the inspection engine. The Monitored Interfaces table in Settings shows the real scope, and no option there extends it to same-subnet traffic.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Er det sikkert at lade Threat Prevention v\u00e6re aktiveret?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Yes, with one caveat worth knowing. The recommended default passes traffic through unfiltered when the engine is saturated, which keeps your line up at the cost of inspection. The opposite mode drops that traffic instead. We have also had the engine wedge under a flood of harmless exploit attempts and start refusing a server&#8217;s outbound traffic, which cost us a mail outage, so include the router in your list of suspects when a machine goes quiet.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Hjulpede Threat Prevention overhovedet mod PHP2Shell?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>No, and three separate reasons each would have been enough on their own. The traffic was encrypted everywhere the router looks, no Snort or Emerging Threats signature was published for either CVE, and the exploit has no payload shape to match because the first request is defined by the memory it consumes and the second looks completely ordinary. The fix was new PHP packages, with a reverse-proxy WAF covering the gap in the meantime.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-7\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Is disabling session.upload_progress enough on an unpatchable host?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>It helps and it is not enough. Switching it off removes one documented route to CVE-2026-109619, which is worth doing on a host you truly cannot update, but memory exhaustion is reachable by other means and the setting does nothing for CVE-2026-109618. Treat it as borrowed time and plan the package update.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-8\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">What should I buy or configure first for a NAS-hosted site?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Placer en reverse proxy med et administreret regels\u00e6t foran webstedet, og begr\u00e6ns derefter oprindelsen, s\u00e5 port 443 kun svarer p\u00e5 det proxy-netv\u00e6rk. Disse to trin flytter tilsammen inspektionspunktet til et sted, hvor anmodningen er l\u00e6sbar, og fjerner den omstigning, der ellers ville annullere det. Hold Threat Prevention aktiveret bagefter for udg\u00e5ende command and control samt for klarteksttjenester, som er der, hvor den g\u00f8r et reelt arbejde.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<h2 id=\"references-and-video-walkthroughs\" class=\"wp-block-heading\">Referencer og videogennemgange<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Prim\u00e6re kilder til alt det ovenst\u00e5ende samt tre gennemgange, der er tiden v\u00e6rd.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/kb.synology.com\/en-global\/SRM\/help\/ThreatPrevention\/threatprevention_desc\" target=\"_blank\" rel=\"noreferrer noopener\">Synology Videnscenter: Threat Prevention<\/a> covers requirements, modes and model support.<\/li>\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_26_14\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-26:14<\/a> lists the fixed PHP package versions for DSM, including the 7.4 build.<\/li>\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/php2shell\/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities\" target=\"_blank\" rel=\"noreferrer noopener\">Synology Statement on PHP2Shell<\/a> names the affected packages and the one that needs a manual update.<\/li>\n\n<li><a href=\"https:\/\/developers.cloudflare.com\/waf\/managed-rules\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Cloudflare WAF managed rules<\/a> explains how managed rulesets are versioned and deployed.<\/li>\n\n<li><a href=\"https:\/\/www.cloudflare.com\/ips\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Cloudflare IP-intervaller<\/a> is the endpoint to read when locking an origin to the proxy instead of hard-coding addresses.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"SRM Threat Prevention \u2013 Netv\u00e6rksbeskyttelse i realtid forklaret\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/yT_xGpxGF7k?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">SRM Threat Prevention forklaret, herunder hvor pakken er placeret p\u00e5 netv\u00e6rket<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Synology Router-hastighedstest med Threat Prevention aktiveret.\" width=\"1200\" height=\"900\" src=\"https:\/\/www.youtube.com\/embed\/wuuRthcZQ_E?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">En gennemstr\u00f8mningstest med Threat Prevention aktiveret, hvilket er den pris, ingen n\u00e6vner<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Protecting Your Public Websites with Cloudflare WAF\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/NbEo8p2Hvt8?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">Cloudflare om beskyttelse af offentlige hjemmesider med en WAF, laget der l\u00e6ser anmodningen<\/figcaption><\/figure>","protected":false},"excerpt":{"rendered":"<p>Threat Prevention is the package most people reach for the moment they decide to host a website on a Synology NAS. It sits on the router, it has a shield icon, and its dashboard counts attacks in the hundreds, so it looks like the thing that keeps a public site safe. We run it on [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":22124,"comment_status":"open","ping_status":"closed","template":"","meta":{"_eb_attr":"","_xspeed_no_cache":false,"_xspeed_expiry_hours":0,"footnotes":""},"doc_category":[197],"doc_tag":[],"class_list":["post-22125","docs","type-docs","status-publish","has-post-thumbnail","hentry","doc_category-nas-hosting-101"],"year_month":"2026-10","word_count":3684,"total_views":"43","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"Adair Hsu","author_nicename":"adairpk17","author_url":"https:\/\/synopower.club\/da\/author\/adairpk17\/"},"doc_category_info":[{"term_name":"NAS Hosting 101","term_url":"https:\/\/synopower.club\/da\/docs-category\/nas-hosting-101\/"}],"doc_tag_info":[],"_links":{"self":[{"href":"https:\/\/synopower.club\/da\/wp-json\/wp\/v2\/docs\/22125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/synopower.club\/da\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/synopower.club\/da\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/synopower.club\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/synopower.club\/da\/wp-json\/wp\/v2\/comments?post=22125"}],"version-history":[{"count":2,"href":"https:\/\/synopower.club\/da\/wp-json\/wp\/v2\/docs\/22125\/revisions"}],"predecessor-version":[{"id":22127,"href":"https:\/\/synopower.club\/da\/wp-json\/wp\/v2\/docs\/22125\/revisions\/22127"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/synopower.club\/da\/wp-json\/wp\/v2\/media\/22124"}],"wp:attachment":[{"href":"https:\/\/synopower.club\/da\/wp-json\/wp\/v2\/media?parent=22125"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/synopower.club\/da\/wp-json\/wp\/v2\/doc_category?post=22125"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/synopower.club\/da\/wp-json\/wp\/v2\/doc_tag?post=22125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}