{"id":22125,"date":"2026-10-25T07:58:10","date_gmt":"2026-10-24T23:58:10","guid":{"rendered":"https:\/\/synopower.club\/?post_type=docs&#038;p=22125"},"modified":"2026-10-25T08:04:28","modified_gmt":"2026-10-25T00:04:28","password":"","slug":"synology-threat-prevention-blind-spots","status":"publish","type":"docs","link":"https:\/\/synopower.club\/hu\/docs\/synology-threat-prevention-blind-spots\/","title":{"rendered":"Synology Threat Prevention: Amit elkap \u00e9s amit nem l\u00e1t"},"content":{"rendered":"<p class=\"wp-block-paragraph\">A Threat Prevention az a csomag, amelyhez a legt\u00f6bben ny\u00falnak abban a pillanatban, amikor \u00fagy d\u00f6ntenek, hogy webhelyet hosztolnak egy Synology NAS-on. A routeren fut, pajzs ikonja van, a m\u0171szerfala pedig sz\u00e1zas nagys\u00e1grendben sz\u00e1molja a t\u00e1mad\u00e1sokat, \u00edgy \u00fagy t\u0171nik, mint ami biztons\u00e1gban tartja a nyilv\u00e1nos webhelyet. Egy RT6600ax eszk\u00f6z\u00f6n futtatjuk az \u00f6sszes saj\u00e1t g\u00e9p\u00fcnk el\u0151tt, \u00e9s meg\u00e9rte haszn\u00e1lni. Ugyanakkor egy saj\u00e1t hostingol\u00e1s\u00fa webhely szempontj\u00e1b\u00f3l szinte teljesen l\u00e9nyegtelen.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ez a NAS Hosting 101 cikk megnyitja a saj\u00e1t router\u00fcnket, kiolvassa bel\u0151le egy val\u00f3di h\u00e9t esem\u00e9nyeit, \u00e9s pontosan megmutatja, hol nem tud m\u00e1r seg\u00edteni a Threat Prevention, a PHP2Shell p\u00e9ld\u00e1j\u00e1n kereszt\u00fcl szeml\u00e9ltetve egy olyan t\u00e1mad\u00e1st, amelyet a Threat Prevention soha nem vett volna \u00e9szre.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>SynoPower Club pont:<\/strong> Hossz\u00fa id\u0151t t\u00f6lt\u00f6ttem a Synology t\u00e1mogat\u00e1si oldal\u00e1n, \u00e9s a k\u00e9rd\u00e9s folyamatosan felmer\u00fclt: melyik opci\u00f3t kapcsoljam be a t\u00e1mad\u00e1s meg\u00e1ll\u00edt\u00e1s\u00e1hoz. Ez a helyes \u00f6szt\u00f6n, de a rossz dobozra ir\u00e1nyul. Sz\u00e1momra az hozta meg az \u00e1tt\u00f6r\u00e9st, amikor a funkci\u00f3oldal helyett a saj\u00e1t esem\u00e9nylist\u00e1nkat olvastam el. Minden riaszt\u00e1s, amelyet az \u00fatv\u00e1laszt\u00f3nk ebben a h\u00f3napban r\u00f6gz\u00edtett, rossz h\u00edrnev\u0171 c\u00edm volt, nem pedig rossz hasznos teherrel rendelkez\u0151 k\u00e9r\u00e9s. Ha ezt egyszer megl\u00e1tja, nem k\u00e9ri t\u00f6bb\u00e9 a Threat Prevention-t, hogy ellen\u0151rizze a lez\u00e1rt bor\u00edt\u00e9kban tartott forgalmat.<\/p>\n<\/blockquote>\n\n\n\n<h2 id=\"what-threat-prevention-actually-does-on-a-synology-router\" class=\"wp-block-heading\">Mit csin\u00e1l val\u00f3j\u00e1ban a Threat Prevention egy Synology routeren<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A Threat Prevention egy behatol\u00e1s\u00e9szlel\u0151 \u00e9s -megel\u0151z\u0151 rendszer, amely a Snort \u00e9s Suricata alapjaira \u00e9p\u00fcl. Beolvassa a csomagokat, mik\u00f6zben a router tov\u00e1bb\u00edtja azokat, \u00f6sszehasonl\u00edtja \u0151ket egy al\u00e1\u00edr\u00e1sk\u00e9szlettel, \u00e9s vagy r\u00f6gz\u00edt egy riaszt\u00e1st, vagy eldobja a csomagot. Az RT6600ax k\u00e9sz\u00fcl\u00e9k\u00fcnk\u00f6n az al\u00e1\u00edr\u00e1sforr\u00e1s az ET Open, az Emerging Threats szab\u00e1lyk\u00e9szlet ingyenes szintje, amely naponta 09:00-kor friss\u00fcl.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ebb\u0151l a fel\u00e9p\u00edt\u00e9sb\u0151l h\u00e1rom tulajdons\u00e1g k\u00f6vetkezik, \u00e9s mindh\u00e1rom fontosabb, mint a fel\u00fclet b\u00e1rmelyik jel\u00f6l\u0151n\u00e9gyzete:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>It can only examine packets the router <strong>forwards<\/strong>. Traffic that never crosses the routing engine is not slow to inspect, it is invisible.<\/li>\n\n<li>It can only match on bytes it can <strong>read<\/strong>. A Threat Prevention sehol nem v\u00e9gez TLS-betekint\u00e9st, \u00edgy a titkos\u00edtott hasznos teher \u00e1tl\u00e1thatatlan.<\/li>\n\n<li>It can only match signatures <strong>somebody else wrote<\/strong>. The interface exposes vendor classes to switch on and off, and nothing that accepts a rule you author yourself.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ezek egyike sem hiba. Egy IPS a h\u00e1l\u00f3zat perem\u00e9n \u00e9sszer\u0171 \u00e9s hasznos dolog. A hiba az a felt\u00e9telez\u00e9s, hogy a webhelyet a peremen \u00e9ri t\u00e1mad\u00e1s.<\/p>\n\n\n\n<h2 id=\"threat-prevention-vs-a-web-application-firewall\" class=\"wp-block-heading\">Threat Prevention vs. Webalkalmaz\u00e1s-t\u0171zfal (WAF)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A k\u00fcl\u00f6nbs\u00e9g legtiszt\u00e1bb meg\u00e9rt\u00e9s\u00e9hez \u00e1ll\u00edtsuk a Threat Prevention-t egy webalkalmaz\u00e1s-t\u0171zfal mell\u00e9, \u00e9s k\u00e9rdezz\u00fck meg, mit tart a kez\u00e9ben mindegyik, amikor meghozza a d\u00f6nt\u00e9s\u00e9t. A Threat Prevention egy h\u00e1l\u00f3zati csomagot tart. A WAF egy dek\u00f3dolt HTTP-k\u00e9r\u00e9st tart.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Question<\/th><th>Router IPS<\/th><th>Reverse-proxy WAF<\/th><\/tr><\/thead><tbody><tr><td>Hol fut<\/td><td>On the routing path, before TLS ends<\/td><td>At the edge, after TLS ends<\/td><\/tr><tr><td>What it inspects<\/td><td>Packet headers and any cleartext bytes<\/td><td>Method, path, headers, cookies, body<\/td><\/tr><tr><td>HTTPS traffic<\/td><td>Opaque<\/td><td>Fully readable<\/td><\/tr><tr><td>Rules you can add<\/td><td>Vendor classes on or off<\/td><td>Your own expressions, plus managed rulesets<\/td><\/tr><tr><td>Same-subnet traffic<\/td><td>Never seen<\/td><td>Not applicable, it is upstream of everything<\/td><\/tr><tr><td>Typical catch<\/td><td>Reputation hits, scans, cleartext exploits, outbound command and control<\/td><td>Injection, traversal, known CVE request shapes, credential stuffing, bots<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Ezek nem egym\u00e1ssal verseng\u0151 term\u00e9kek. Ugyanazon folyamat m\u00e1s-m\u00e1s szakasz\u00e1t fedik le, \u00e9s egy saj\u00e1t hostingol\u00e1s\u00fa webhelynek sokkal ink\u00e1bb sz\u00fcks\u00e9ge van a m\u00e1sodikra, mint az els\u0151re. Mi mindkett\u0151t megtartjuk, \u00e9s teljesen elt\u00e9r\u0151 dolgokat v\u00e1runk el t\u0151l\u00fck.<\/p>\n\n\n\n<h2 id=\"reading-595-events-from-one-week-on-our-own-router\" class=\"wp-block-heading\">595 esem\u00e9ny kiolvas\u00e1sa egyetlen h\u00e9tb\u0151l a saj\u00e1t router\u00fcnk\u00f6n<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u00cdme a termel\u00e9si router\u00fcnk Threat Prevention \u00e1ttekint\u0151 k\u00e9perny\u0151je 2026. okt\u00f3ber 25-\u00e9n. \u00d6tsz\u00e1zkilencven\u00f6t rosszindulat\u00fa esem\u00e9ny h\u00e9t nap alatt, ebb\u0151l 75 magas s\u00falyoss\u00e1g\u00fa. \u00dagy n\u00e9z ki, mint egy g\u00e1t, amely visszatartja az \u00e1radatot.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"eager\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events.webp\" alt=\"Synology Threat Prevention \u00e1ttekint\u00e9s egy RT6600ax-en, amely 595 rosszindulat\u00fa esem\u00e9nyt mutat h\u00e9t nap alatt, \u00e9s egy potenci\u00e1lis fenyeget\u00e9sekkel rendelkez\u0151 eszk\u00f6zt\" class=\"wp-image-22119\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-1000x482.webp 1000w\"  fetchpriority=\"high\"\/><figcaption class=\"wp-element-caption\">H\u00e9t nap a saj\u00e1t RT6600ax eszk\u00f6z\u00fcnk\u00f6n. Egyetlen eszk\u00f6z felel\u0151s minden magas s\u00falyoss\u00e1g\u00fa esem\u00e9ny\u00e9rt, \u00e9s ez a levelez\u0151szerver, nem pedig a webszerver.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">K\u00e9t r\u00e9szlet ezen a k\u00e9perny\u0151n t\u00f6bbet \u00e9r, mint a f\u0151sz\u00e1m. Az els\u0151 az, hogy mind\u00f6ssze egyetlen eszk\u00f6z jelenik meg a potenci\u00e1lis fenyeget\u00e9sek alatt, \u00e9s az a REVERSE_MAIL, a g\u00e9p, amely lez\u00e1rja a TLS-t \u00e9s futtatja a MailPlus-t. A m\u00e1sodik a z\u00f6ld pipa melletti al\u00e1\u00edr\u00e1s d\u00e1tuma. Most nyisson meg egyetlen esem\u00e9nyt, \u00e9s olvassa el, mi aktiv\u00e1l\u00f3dott val\u00f3j\u00e1ban.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature.webp\" alt=\"A Threat Prevention esem\u00e9ny r\u00e9szletei, amely egy ET CINS rossz h\u00edrnev\u0171 IP-al\u00e1\u00edr\u00e1st mutat Alert st\u00e1tusszal \u00e9s egy olyan szab\u00e1lyt\u00f6rzzsel, amely csak az IP-c\u00edmekre illeszkedik\" class=\"wp-image-22120\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Az al\u00e1\u00edr\u00e1s t\u00f6rzse az \u00e1rulkod\u00f3 jel. alert ip-vel kezd\u0151dik, amelyet c\u00edmek list\u00e1ja k\u00f6vet, \u00edgy a k\u00e9r\u00e9sb\u0151l semmit sem vizsg\u00e1lt meg.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Besorol\u00e1s: Misc Attack, s\u00falyoss\u00e1g: Medium, \u00e1llapot: Alert, al\u00e1\u00edr\u00e1s neve: ET CINS Active Threat Intelligence Poor Reputation IP group 24. Nyissa meg a szab\u00e1ly t\u00f6rzs\u00e9t, \u00e9s az alert ip-vel kezd\u0151dik, majd egy hossz\u00fa c\u00edmlist\u00e1val. Ez egy tilt\u00f3lista-lek\u00e9rdez\u00e9s. A HTTP-k\u00e9r\u00e9s egyetlen r\u00e9sz\u00e9t sem olvasta el, mert semelyik r\u00e9sz\u00e9t nem tudta elolvasni. Mint\u00e1t vett\u00fcnk az esem\u00e9nyekb\u0151l egy m\u00e1sodik c\u00e9lpont, a Virtual DSM gazdag\u00e9p\u00fcnk ellen is, \u00e9s ugyanazt a szab\u00e1lyoszt\u00e1lyt tal\u00e1ltuk egy m\u00e1sik csoportsz\u00e1mmal.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Egy h\u00e9t \u0151szinte \u00f6sszefoglal\u00e1sa teh\u00e1t a k\u00f6vetkez\u0151: a router felismerte a m\u00e1r rossz h\u00edr\u0171 c\u00edmekr\u0151l \u00e9rkez\u0151 n\u00e9h\u00e1ny sz\u00e1z kapcsol\u00f3d\u00e1st. Ez val\u00f3ban hasznos. De ez nem webes t\u00e1mad\u00e1s\u00e9szlel\u00e9s, \u00e9s senkinek sem szabad \u00fagy \u00e9rtelmeznie az 595-\u00f6s sz\u00e1mot, mintha az lenne.<\/p>\n\n\n\n<h2 id=\"how-to-audit-threat-prevention-in-4-steps\" class=\"wp-block-heading\">A Threat Prevention audit\u00e1l\u00e1sa 4 l\u00e9p\u00e9sben<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Miel\u0151tt b\u00e1rmit r\u00e1b\u00edzna a Threat Prevention-re, sz\u00e1njon t\u00edz percet arra, hogy kider\u00edtse, mit csin\u00e1l val\u00f3j\u00e1ban a saj\u00e1t h\u00e1l\u00f3zat\u00e1n. Az al\u00e1bbi l\u00e9p\u00e9sek mindegyike csak olvashat\u00f3, \u00e9s semmit sem v\u00e1ltoztat meg.<\/p>\n\n\n<div id=\"rank-math-howto\" class=\"rank-math-block\" >\n<div class=\"rank-math-howto-description\">\n\n<\/div>\n\n<div class=\"rank-math-steps\">\n<div id=\"step-1\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Nyisson meg egy esem\u00e9nyt, \u00e9s olvassa el a szignat\u00fara t\u00f6rzs\u00e9t<\/h3>\n<div class=\"rank-math-step-content\"><p>Nyissa meg a Threat Prevention men\u00fcpontot, majd az Esem\u00e9nyek lapot, \u00e9s kattintson b\u00e1rmelyik bejegyz\u00e9sre. A sz\u00ednes s\u00falyoss\u00e1gi jelv\u00e9ny m\u00f6g\u00f6tt n\u00e9zze meg a Signature rules mez\u0151t. Az alert ip kezdet\u0171 szab\u00e1ly kiz\u00e1r\u00f3lag a c\u00edm h\u00edrneve alapj\u00e1n illeszkedik. A content vagy pcre elemet tartalmaz\u00f3 szab\u00e1ly a hasznos teherre illeszkedik. Sz\u00e1molja meg, h\u00e1nyat tal\u00e1l mindegyikb\u0151l a saj\u00e1t list\u00e1j\u00e1ban, miel\u0151tt eld\u00f6nti, mit v\u00e9d a Threat Prevention.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-2\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Ellen\u0151rizze, hogy mely interf\u00e9szek vannak megfigyelve<\/h3>\n<div class=\"rank-math-step-content\"><p>Nyissa meg a Be\u00e1ll\u00edt\u00e1sok men\u00fcpontot, \u00e9s tekintse meg a Megfigyelt interf\u00e9szek t\u00e1bl\u00e1zatot. Csak az ott bejel\u00f6lt interf\u00e9szek ker\u00fclnek ellen\u0151rz\u00e9sre, \u00e9s norm\u00e1l telep\u00edt\u00e9s eset\u00e9n ezek az internet fel\u0151li interf\u00e9szek. Az azonos LAN-alh\u00e1l\u00f3zaton l\u00e9v\u0151 k\u00e9t eszk\u00f6z k\u00f6z\u00f6tti adatforgalom \u00e1tkapcsol\u00e1sra ker\u00fcl az \u00fatvonalv\u00e1laszt\u00e1s helyett, \u00edgy soha nem \u00e9ri el az ellen\u0151rz\u0151 motort, \u00e9s ezen az oldalon egyetlen be\u00e1ll\u00edt\u00e1s sem v\u00e1ltoztathat ezen.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-3\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Tudd meg, mi t\u00f6rt\u00e9nik, amikor a router leterhelt<\/h3>\n<div class=\"rank-math-step-content\"><p>Ugyanabban a panelben tekintse meg az alap\u00e9rtelmezett m\u00f3dot. A h\u00e1l\u00f3zati stabilit\u00e1s priorit\u00e1sa azt jelenti, hogy amikor a forgalom meghaladja a motor \u00e1ltal feldolgozhat\u00f3 mennyis\u00e9get, a t\u00f6bblet sz\u0171retlen\u00fcl tov\u00e1bb\u00edt\u00f3dik. A biztons\u00e1gi priorit\u00e1s azt jelenti, hogy a t\u00f6bblet ehelyett eldob\u00e1sra ker\u00fcl. Az egyik lehet\u0151s\u00e9g hiba eset\u00e9n nyitva marad (fail-open), \u00e9s m\u0171k\u00f6d\u00e9sben tartja a vonalat, a m\u00e1sik hiba eset\u00e9n lez\u00e1r (fail-closed), \u00e9s le\u00e1ll\u00edtja a vonalat. D\u00f6ntse el, melyikre van val\u00f3ban sz\u00fcks\u00e9ge.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-4\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Try to add a rule of your own<\/h3>\n<div class=\"rank-math-step-content\"><p>Open Self-Defined Policy. You can change the action for a signature the vendor already ships, and you can scope it by source or destination address. There is no field anywhere that accepts a signature you wrote. If your threat is newer than your signature feed, this screen is where you discover you have no way to respond.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n\n\n\n<h2 id=\"where-it-genuinely-earns-its-place\" class=\"wp-block-heading\">Hol van val\u00f3ban jogosults\u00e1ga<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Bekapcsolt \u00e1llapotban tartjuk a Threat Prevention-t, \u00e9s nem babon\u00e1b\u00f3l. N\u00e9gy olyan feladatot l\u00e1t el, amelyeket semmi m\u00e1s nem v\u00e9gez el a rendszer\u00fcnkben.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Outbound command and control.<\/strong> This is the strongest case by far. A compromised device has to call home, that call has to leave through the router, and a good share of it is still either cleartext or aimed at a known address. Our router ships the Malware Command and Control Activity class with 3,450 of 3,498 rules enabled, and the Domain Observed Used for C2 class with 7,157 of 7,202.<\/li>\n\n<li><strong>Cleartext protocols from the internet.<\/strong> Our mail server answers on port 25, and SMTP is cleartext until STARTTLS. That is real inspectable traffic, and it is no accident that the mail host is the one device our events list keeps naming.<\/li>\n\n<li><strong>Scanning and reconnaissance.<\/strong> Port sweeps and fingerprinting are recognised by connection behaviour rather than by payload, so encryption does not hide them.<\/li>\n\n<li><strong>Visibility.<\/strong> A searchable log of who knocked and with what reputation is worth having, even when every entry is only a reputation hit. It is monitoring value, and it should be counted as monitoring value rather than as protection.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ebben a n\u00e9gyben az a k\u00f6z\u00f6s, hogy egyik sem egy webhely elleni t\u00e1mad\u00e1s.<\/p>\n\n\n\n<h2 id=\"why-a-site-owner-asks-threat-prevention-for-the-wrong-thing\" class=\"wp-block-heading\">Mi\u00e9rt v\u00e1r el egy webhelytulajdonos rossz dolgot a Threat Prevention-t\u0151l<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Amikor egy webhelyet NAS-on hosztol, a k\u00e9r\u00e9si \u00fatvonalban \u00e1ltal\u00e1ban van egy reverse proxy. A mi\u00e9nk \u00edgy n\u00e9z ki, \u00e9s a fel\u00e9p\u00edt\u00e9se az, ami mindent eld\u00f6nt:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The visitor reaches <strong>Cloudflare<\/strong>, which answers most requests from cache and inspects the rest in cleartext.<\/li>\n\n<li>What is left crosses the <strong>router<\/strong>, ahol a Threat Prevention egy titkos\u00edtott TLS-folyamot l\u00e1t, \u00e9s semmi m\u00e1st.<\/li>\n\n<li>A <strong>reverse proxy NAS<\/strong> terminates TLS and forwards plain HTTP to the machine that runs the site.<\/li>\n\n<li>That last hop is on the <strong>same subnet<\/strong>, so the frame goes through a switch and the router is not in the path.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ha elolvassa ezt a n\u00e9gy sort egy\u00fctt, a csapda nyilv\u00e1nval\u00f3. Az egyetlen szakasz, ahol a k\u00e9r\u00e9s olvashat\u00f3 form\u00e1ban l\u00e9tezik, az utols\u00f3 ugr\u00e1s, \u00e9s ez az egyetlen olyan szakasz, amelyet a router nem tud megfigyelni. Mindenhol, ahol a router megfigyelhetne, a k\u00e9r\u00e9s titkos\u00edtott. Nincs olyan jel\u00f6l\u0151n\u00e9gyzet, amely feloldana egy ilyen ellentmond\u00e1st, \u00e9s a Threat Prevention nem vall kudarcot, amikor hallgat. Pontosan sz\u00e1mol be arr\u00f3l a forgalomr\u00f3l, amelyet struktur\u00e1lisan k\u00e9ptelen elolvasni.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ez az oka annak is, hogy a Threat Prevention egy adott webhelyre ir\u00e1ny\u00edt\u00e1sa nem m\u0171k\u00f6dik. A csomag a router interf\u00e9szeihez van k\u00f6tve, nem a gazdanevekhez. Fogalma sincs arr\u00f3l, hogy egy kapcsolat melyik webhely\u00e9hez tartozik, mert soha nem l\u00e1tja a Host fejl\u00e9cet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces.webp\" alt=\"Threat Prevention be\u00e1ll\u00edt\u00e1sok, amelyek az internet fel\u00e9 n\u00e9z\u0151 portokra korl\u00e1tozott megfigyelt interf\u00e9szeket, h\u00e1l\u00f3zati stabilit\u00e1si priorit\u00e1si m\u00f3dot \u00e9s az ET Open al\u00e1\u00edr\u00e1si forr\u00e1st mutatj\u00e1k\" class=\"wp-image-22121\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">A Megfigyelt interf\u00e9szek (Monitored Interfaces) k\u00e9pezik a Threat Prevention teljes hat\u00f3k\u00f6r\u00e9t. Vegye figyelembe az alatta l\u00e9v\u0151 alap\u00e9rtelmezett m\u00f3dot \u00e9s az alj\u00e1n tal\u00e1lhat\u00f3 al\u00e1\u00edr\u00e1sforr\u00e1st.<\/figcaption><\/figure>\n\n\n\n<h2 id=\"three-reasons-php2shell-was-invisible-at-the-router\" class=\"wp-block-heading\">H\u00e1rom ok, ami\u00e9rt a PHP2Shell l\u00e1thatatlan volt a router sz\u00e1m\u00e1ra<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A PHP2Shell, a CVE-2026-109618 \u00e9s CVE-2026-109619 n\u00e9ven nyomon k\u00f6vetett hiteles\u00edt\u00e9s el\u0151tti t\u00e1voli k\u00f3dv\u00e9grehajt\u00e1si hibap\u00e1r 2026. okt\u00f3ber 20-\u00e1n sziv\u00e1rgott ki, \u00e9s a k\u00f6vetkez\u0151 napon jav\u00edtott\u00e1k a fels\u0151 tagozaton (upstream). Ez pontosan az a fajta dolog, amit az emberek rem\u00e9lnek, hogy egy router IPS elnyel, \u00e9s \u00e9rdemes pontos\u00edtani, mi\u00e9rt nem volt k\u00e9pes r\u00e1.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>El\u0151sz\u00f6r is, a forgalom minden olyan szakaszon titkos\u00edtva volt, amelyet a router figyel.<\/strong> The exploit lives in the HTTP request, and the HTTP request only exists in the clear after TLS has been terminated, which happens downstream of the router on a hop the router never carries.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>M\u00e1sodszor, nem l\u00e9tezik bekapcsolhat\u00f3 Threat Prevention al\u00e1\u00edr\u00e1s.<\/strong> We checked again on 25 October 2026 and found no published Snort or Emerging Threats rule for either CVE. Our feed is ET Open, the free tier, which lags the commercial set, and the Self-Defined Policy screen accepts no rule of your own. So even an operator who knew precisely what to match for had nowhere to put it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy.webp\" alt=\"A Self-Defined Policy k\u00e9perny\u0151 a Threat Prevention-ben, \u00fcresen, csak a Edit \u00e9s Delete funkci\u00f3val, \u00e9s \u00faj al\u00e1\u00edr\u00e1s l\u00e9trehoz\u00e1s\u00e1nak lehet\u0151s\u00e9ge n\u00e9lk\u00fcl\" class=\"wp-image-22123\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">A Saj\u00e1t meghat\u00e1roz\u00e1s\u00fa h\u00e1zirend (Self-Defined Policy) m\u00f3dos\u00edtja a sz\u00e1ll\u00edt\u00f3 \u00e1ltal m\u00e1r kiadott al\u00e1\u00edr\u00e1sokhoz kapcsol\u00f3d\u00f3 m\u0171veleteket. Nincs olyan mez\u0151, amely elfogadn\u00e1 az \u00d6n \u00e1ltal \u00edrt szab\u00e1lyt.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Harmadszor, \u00e9s ami a legalapvet\u0151bb, ennek a t\u00e1mad\u00e1snak nincs illeszthet\u0151 hasznos teher (payload) form\u00e1ja.<\/strong> The chain takes two requests. The first has to push PHP into exhausting its memory limit, which makes the engine abandon a request through a path that skips cleanup and leaves some global state behind. The second request is ordinary, and it is the one that reaches a stale pointer and turns into code execution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Az els\u0151 k\u00e9r\u00e9st az hat\u00e1rozza meg, hogy mennyi mem\u00f3ri\u00e1t fogyaszt, nem pedig a b\u00e1jtok b\u00e1rmely szekvenci\u00e1ja; egy nagy felt\u00f6lt\u00e9s, egy hatalmas JSON t\u00f6rzs, egy m\u00e9ly t\u00f6mb \u00e9s egy hossz\u00fa karakterl\u00e1nc egy regul\u00e1ris kifejez\u00e9sben mind megfelel. A m\u00e1sodik egy\u00e1ltal\u00e1n nem tartalmaz k\u00e1rt\u00e9kony b\u00e1jtokat. Az IPS csomagonk\u00e9nt \u00e9s folyamonk\u00e9nt d\u00f6nt. Nem rendelkezik olyan modellel, amelyben egy munkafolyamat szennyezett \u00e1llapotot visz \u00e1t az egyik k\u00e9r\u00e9sb\u0151l a m\u00e1sikba, holott ez a hiba pontosan itt tal\u00e1lhat\u00f3.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ez egyben kijel\u00f6li az akkoriban k\u00f6zk\u00e9zen forg\u00f3 enyh\u00edt\u00e9s hat\u00e1rait is, amely a session.upload_progress kikapcsol\u00e1sa volt a PHP-konfigur\u00e1ci\u00f3ban. Val\u00f3ban elt\u00e1vol\u00edt egy j\u00f3l dokument\u00e1lt m\u00f3dot a m\u00e1sodik CVE el\u00e9r\u00e9s\u00e9re, \u00e9s egy olyan g\u00e9pen, amelyet val\u00f3ban nem tud friss\u00edteni, ez is jobb a semmin\u00e9l. Ez nem jav\u00edt\u00e1s: a mem\u00f3riakimer\u00fcl\u00e9s nem csak ezen az egy funkci\u00f3n kereszt\u00fcl \u00e9rhet\u0151 el, \u00e9s a be\u00e1ll\u00edt\u00e1s egy\u00e1ltal\u00e1n nincs hat\u00e1ssal a CVE-2026-109618-ra. Ezt \u00e1thidal\u00f3 megold\u00e1sk\u00e9nt haszn\u00e1ltuk pontosan egy gazdag\u00e9pen, \u00e9s k\u00f6lcs\u00f6nz\u00f6tt id\u0151k\u00e9nt kezelt\u00fck, nem pedig megold\u00e1sk\u00e9nt. A friss\u00edt\u00e9s teljes t\u00f6rt\u00e9nete a k\u00f6vetkez\u0151 helyen tal\u00e1lhat\u00f3: <a href=\"https:\/\/synopower.club\/hu\/synology-php2shell-emergency-patch\/\">PHP2Shell write-up<\/a>.<\/p>\n\n\n\n<h2 id=\"fail-open-by-design-and-the-day-it-cost-us-our-mail\" class=\"wp-block-heading\">Kialak\u00edt\u00e1sb\u00f3l ad\u00f3d\u00f3 nyitott hiba\u00e1llapot (Fail Open), \u00e9s a nap, amikor ez a levelez\u00e9s\u00fcnkbe ker\u00fclt<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Van m\u00e9g egy tulajdons\u00e1g, amit \u00e9rdemes tudni, miel\u0151tt a Threat Prevention-re megb\u00edzhat\u00f3 vez\u00e9rl\u0151k\u00e9nt tekintene. Az aj\u00e1nlott alap\u00e9rtelmezett be\u00e1ll\u00edt\u00e1sa a h\u00e1l\u00f3zati stabilit\u00e1st el\u0151nyben r\u00e9szes\u00edt\u0151 m\u00f3d, \u00e9s a fel\u00fclet k\u00f6nt\u00f6rfalaz\u00e1s n\u00e9lk\u00fcl le\u00edrja, hogy ez mit jelent: amikor a forgalom meghaladja a feldolgoz\u00e1si kapacit\u00e1st, a f\u00fcgg\u0151ben l\u00e9v\u0151 csomagok sz\u0171r\u00e9s n\u00e9lk\u00fcl \u00e1thaladnak. Az alternat\u00edva, a biztons\u00e1got el\u0151nyben r\u00e9szes\u00edt\u0151 m\u00f3d ink\u00e1bb eldobja \u0151ket, \u00e9s figyelmeztet, hogy a kapcsolat instabil lesz a probl\u00e9ma megold\u00e1s\u00e1ig.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ez egy \u00e9sszer\u0171 alap\u00e9rtelmez\u00e9s egy otthoni router eset\u00e9ben. Ez azt jelenti, hogy a Threat Prevention \u00e9ppen abban a pillanatban a leggyeng\u00e9bb, amikor a leger\u0151sebbnek szeretn\u00e9, mivel az el\u00e1raszt\u00e1s (flood) egyszerre az a dolog, amit sz\u0171rni szeretne, \u00e9s az a dolog, ami meghaladja a kapacit\u00e1st.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A m\u00e1sik meghib\u00e1sod\u00e1si m\u00f3dr\u00f3l is van feljegyz\u00e9s\u00fcnk. 2026. augusztus 2-\u00e1n valaki 116-szor t\u00e1madta meg a ford\u00edtott proxy-nkat egy olyan Windows PHP-CGI hiba exploitj\u00e1val, amely Linux ellen egy\u00e1ltal\u00e1n nem m\u0171k\u00f6dhet. A Threat Prevention elegend\u0151 csomagot dobott el ahhoz, hogy be\u00e9kelje a saj\u00e1t \u00e1llapot\u00e1t, majd elkezdte visszautas\u00edtani \u00e9ppen azon g\u00e9p kimen\u0151 forgalm\u00e1t, amelyet v\u00e9dett. A levelez\u00e9si sorunk le\u00e1llt, \u00e9s a t\u00fcnet pontosan \u00fagy n\u00e9zett ki, mint egy DNS-hiba. A router \u00fajraind\u00edt\u00e1sa megoldotta a probl\u00e9m\u00e1t. Semmi nem jelent meg a proxy hozz\u00e1f\u00e9r\u00e9si napl\u00f3j\u00e1ban, mert semmi nem \u00e9rte el a proxy-t. Egy olyan t\u00e1mad\u00e1s, amely struktur\u00e1lisan k\u00e9ptelen volt a sikerre, m\u00e9gis le\u00e1ll\u00e1st okozott nek\u00fcnk azon eszk\u00f6z r\u00e9v\u00e9n, amelynek meg kellett volna \u00e1ll\u00edtania azt.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list.webp\" alt=\"A Class and Signature lista a Threat Prevention-ben, oszt\u00e1lyonk\u00e9nti enged\u00e9lyezett darabsz\u00e1mokkal, bele\u00e9rtve a Web Application Attack-ot 6010 szab\u00e1lyb\u00f3l 5928-n\u00e1l\" class=\"wp-image-22122\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Oszt\u00e1lyszint\u0171 kapcsol\u00f3k a jobb oldalon enged\u00e9lyezett sz\u00e1mmal. Ez a teljes finomhangol\u00e1si fel\u00fclet.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">N\u00e9zze meg az enged\u00e9lyez\u00e9si sz\u00e1mokat abban a list\u00e1ban, am\u00edg ott van. A Web Application Attack 6010 szab\u00e1lyb\u00f3l 5928 akt\u00edv szab\u00e1lyt mutat, \u00e9s az ar\u00e1ny hasonl\u00f3 az \u00e1ltalunk fontosnak tartott oszt\u00e1lyok eset\u00e9ben is. Egy oszt\u00e1ly bekapcsol\u00e1sa nem kapcsol be minden benne l\u00e9v\u0151 szab\u00e1lyt, \u00e9s a fel\u00fclet nem ad lehet\u0151s\u00e9get arra, hogy l\u00e1ssa, a fennmarad\u00f3kb\u00f3l melyek hi\u00e1nyoznak.<\/p>\n\n\n\n<h2 id=\"put-a-proxy-in-front-then-lock-the-origin-to-it\" class=\"wp-block-heading\">Helyezzen el egy proxyt a rendszer el\u0151tt, majd korl\u00e1tozza az eredeti szervert arra<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ha webhelyet szolg\u00e1l ki egy NAS-r\u00f3l, az a v\u00e9delmi eszk\u00f6z, amely elv\u00e9gzi a router \u00e1ltal el nem v\u00e9gezhet\u0151 feladatot, egy ford\u00edtott proxy WAF. Mi a Cloudflare-t haszn\u00e1ljuk, \u00e9s ennek az oka a poz\u00edci\u00f3, nem pedig a m\u00e1rka: a TLS a h\u00e1l\u00f3zat sz\u00e9l\u00e9n fejez\u0151dik be, \u00edgy a teljes k\u00e9r\u00e9s olvashat\u00f3 a d\u00f6nt\u00e9shozatal pillanat\u00e1ban. A met\u00f3dus, az \u00fatvonal, a lek\u00e9rdez\u00e9s, a fejl\u00e9cek, a s\u00fctik \u00e9s a t\u00f6rzs mind el\u00e9rhet\u0151k a szab\u00e1lyok sz\u00e1m\u00e1ra.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ez\u00e9rt \u00e9rkeztek a PHP2Shell elleni v\u00e9delmek oda, \u00e9s nem a routerre. Amikor a CVE-k megjelentek, a fel\u00fcgyelt szab\u00e1lyk\u00e9szlet k\u00e9t napon bel\u00fcl h\u00e9t \u00faj szab\u00e1llyal b\u0151v\u00fclt a p\u00e1rhoz, \u00e9s ezek mind a n\u00e9gy \u00e1ltalunk \u00fczemeltetett z\u00f3n\u00e1ban \u00e9ltek, miel\u0151tt befejezt\u00fck volna a saj\u00e1t kont\u00e9nereink \u00fajra\u00e9p\u00edt\u00e9s\u00e9t. A Threat Prevention h\u00edrcsatorn\u00e1j\u00e1ban semmi sem jelent meg ezzel kapcsolatban, \u00e9s \u00f6t nappal k\u00e9s\u0151bb m\u00e9g mindig nincs telep\u00edthet\u0151 nyilv\u00e1nos Snort vagy Emerging Threats szab\u00e1ly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Egy figyelmeztet\u00e9s, amely fontosabb, mint a szolg\u00e1ltat\u00f3 kiv\u00e1laszt\u00e1sa. Az el\u00e9 helyezett proxy csak addig seg\u00edt, am\u00edg nem lehet megker\u00fclni. Ha az eredeti szerver c\u00edme k\u00f6zvetlen\u00fcl v\u00e1laszol a nyilv\u00e1nos internetnek, b\u00e1rki, aki felfedezi, megker\u00fcli az \u00f6sszes \u00d6n \u00e1ltal \u00edrt edge-szab\u00e1lyt. Korl\u00e1tozza az eredeti szerver 443-as portj\u00e1t a proxy h\u00e1l\u00f3zati tartom\u00e1nyaira, ezeket a tartom\u00e1nyokat a szolg\u00e1ltat\u00f3 v\u00e9gpontj\u00e1r\u00f3l k\u00e9rje le a be\u00e9get\u00e9s helyett, \u00e9s ellen\u0151rizze a z\u00e1rol\u00e1st \u00fagy, hogy a webhelyet k\u00f6zvetlen\u00fcl a saj\u00e1t c\u00edm\u00e9r\u0151l k\u00e9ri le. A teljesebb konfigur\u00e1ci\u00f3nk \u00e9s az ez m\u00f6g\u00f6tti n\u00e9gy r\u00e9teg le\u00edr\u00e1sa itt tal\u00e1lhat\u00f3: <a href=\"https:\/\/synopower.club\/hu\/docs\/synology-nas-security-public-website\/\">the five layers we run<\/a>.<\/p>\n\n\n\n<h2 id=\"threat-prevention-limits-and-security-notes\" class=\"wp-block-heading\">A Threat Prevention korl\u00e1tai \u00e9s biztons\u00e1gi megjegyz\u00e9sek<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A Threat Prevention k\u00fcls\u0151 t\u00e1rhelyet ig\u00e9nyel a routeren, \u00e9s nem \u00e9rhet\u0151 el minden modelln\u00e9l, ez\u00e9rt a tervez\u00e9s el\u0151tt ellen\u0151rizze a hardver t\u00e1mogatotts\u00e1g\u00e1t. A motor egyben a legforgalmasabb feladat, amit a router v\u00e9gez, \u00e9s egy lakoss\u00e1gi egys\u00e9gn\u00e9l ez az a komponens, amely a legnagyobb val\u00f3sz\u00edn\u0171s\u00e9ggel v\u00e1lik az \u00e1tereszt\u0151k\u00e9pess\u00e9g fels\u0151 korl\u00e1tj\u00e1v\u00e1. M\u00e9rjen el\u0151tte \u00e9s ut\u00e1na ahelyett, hogy megb\u00edzna a marketingadatokban.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kezeljen az \u00e1ttekint\u0151 k\u00e9perny\u0151n tal\u00e1lhat\u00f3 minden sz\u00e1mot a szignat\u00fara-egyez\u00e9sek sz\u00e1mak\u00e9nt, nem pedig a meg\u00e1ll\u00edtott t\u00e1mad\u00e1sok sz\u00e1mak\u00e9nt. A kett\u0151 mindk\u00e9t ir\u00e1nyban elt\u00e9rhet. Egy olyan szkenner elleni reput\u00e1ci\u00f3s tal\u00e1lat, amely am\u00fagy sem \u00e9rt volna el semmit, n\u00f6veli az \u00f6sszes\u00edt\u00e9st, egy csendes h\u00e9t pedig semmit sem bizony\u00edt a HTTPS-forgalomr\u00f3l, amelyet a motor nem tud elolvasni.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A Threat Prevention szolg\u00e1ltat\u00e1sban a st\u00e1tusz legal\u00e1bb annyira sz\u00e1m\u00edt, mint a s\u00falyoss\u00e1g. A \u201eNagy kock\u00e1zat\u00fa csomagok automatikus eldob\u00e1sa\u201d opci\u00f3 csak a magas kateg\u00f3ri\u00e1ra vonatkozik, \u00edgy a k\u00f6zepes s\u00falyoss\u00e1g\u00fa bejegyz\u00e9sek r\u00f6gz\u00edt\u00e9sre \u00e9s tov\u00e1bb\u00edt\u00e1sra ker\u00fclnek. Egy olyan fel\u00fclet, amely Riaszt\u00e1s (Alert) \u00e1llapotot mutat, azt jelzi, hogy a csomag k\u00e9zbes\u00edtve lett.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A szignat\u00fara-h\u00edrforr\u00e1s egy ell\u00e1t\u00e1si l\u00e1nc. Az ET Open \u00fctemez\u00e9s szerint friss\u00fcl, elmarad a kereskedelmi szab\u00e1lyk\u00e9szlett\u0151l, \u00e9s el\u0151fordulhat, hogy egy t\u00f6bbnapos s\u00e9r\u00fcl\u00e9kenys\u00e9ghez egy\u00e1ltal\u00e1n nem ad ki semmit. Az az ir\u00e1ny\u00edt\u00f3pult, amely naprak\u00e9sznek jelenti az adatb\u00e1zist, azt jelzi, hogy az megegyezik a h\u00edrforr\u00e1ssal, nem pedig azt, hogy a h\u00edrforr\u00e1s lefedi a jelenleg kihaszn\u00e1lt s\u00e9r\u00fcl\u00e9kenys\u00e9geket.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ezek egyike sem helyettes\u00edti a jav\u00edt\u00e1sok telep\u00edt\u00e9s\u00e9t. Az itt t\u00e1rgyalt minden egyes r\u00e9teg csup\u00e1n id\u0151t nyer arra a l\u00e9p\u00e9sre, amely val\u00f3ban megsz\u00fcnteti a sebezhet\u0151s\u00e9get: az \u00e9rintett szoftver friss\u00edt\u00e9s\u00e9re. A PHP2Shell eset\u00e9ben ez \u00faj PHP-csomagokat \u00e9s \u00fajra\u00e9p\u00edtett kont\u00e9nereket jelentett, \u00e9s ezt semmilyen h\u00e1l\u00f3zati vez\u00e9rl\u00e9s nem helyettes\u00edthette.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">V\u00e9g\u00fcl ne engedjen a k\u00eds\u00e9rt\u00e9snek, hogy egy figyelmeztet\u00e9s elolvas\u00e1sa ut\u00e1n minden kateg\u00f3ri\u00e1t bekapcsoljon. Az olyan kateg\u00f3ri\u00e1k, mint a Misc activity, t\u00f6bb ezer alacsony \u00e9rt\u00e9k\u0171 szab\u00e1lyt tartalmaznak, amelyek f\u0151k\u00e9nt csak zajt gener\u00e1lnak, \u00e9s ugyanazt a kapacit\u00e1st fogyasztj\u00e1k, amire a hasznos kateg\u00f3ri\u00e1knak lenne sz\u00fcks\u00e9g\u00fck. Egy csendes, j\u00f3l behangolt esem\u00e9nylista, amelyet val\u00f3ban elolvas, t\u00f6bbet \u00e9r, mint egy zajos, amelyet megtanul figyelmen k\u00edv\u00fcl hagyni.<\/p>\n\n\n\n<h2 id=\"frequently-asked-questions\" class=\"wp-block-heading\">Gyakran Ism\u00e9telt K\u00e9rd\u00e9sek<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list\">\n<div id=\"faq-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">V\u00e9di a Threat Prevention a NAS-omon hosztolt webhelyet?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Alig, \u00e9s nem \u00fagy, ahogy a n\u00e9v sugallja. A webhely HTTPS-en kereszt\u00fcl fut, \u00e9s a Threat Prevention nem v\u00e9gez TLS-betekint\u00e9st, \u00edgy a k\u00e9r\u00e9s \u00e1tl\u00e1thatatlan ott, ahol az \u00fatv\u00e1laszt\u00f3 l\u00e1tja. Egy tipikus be\u00e1ll\u00edt\u00e1sn\u00e1l a k\u00e9r\u00e9s csak azut\u00e1n v\u00e1lik olvashat\u00f3v\u00e1, hogy egy ford\u00edtott proxy lez\u00e1rja a TLS-t, \u00e9s ez a l\u00e9p\u00e9s \u00e1ltal\u00e1ban ugyanazon az alh\u00e1l\u00f3zaton van, \u00edgy kapcsolva van az \u00fatv\u00e1laszt\u00e1s helyett, \u00e9s az \u00fatv\u00e1laszt\u00f3 soha nem tov\u00e1bb\u00edtja azt. Haszn\u00e1ljon ford\u00edtott proxy WAF-ot a webhelyhez, \u00e9s hagyja meg a Threat Prevention-t arra, amiben j\u00f3.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Which option should I switch on to stop a specific CVE?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Usually none, because the answer depends on whether the vendor shipped a signature for it at all. Open Self-Defined Policy and you will find you can change the action on an existing signature but cannot add one of your own. If no rule exists in the feed, there is nothing to enable, and for a vulnerability a few days old that is the normal case.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Why does my event list only name one or two devices?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Because those are the devices receiving traffic the engine can actually read. On our network it is consistently the mail server, which answers cleartext SMTP on port 25. A web host behind a reverse proxy produces few entries not because it is attacked less, but because its traffic is encrypted at every point the router inspects.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Ellen\u0151rzi a Threat Prevention a LAN-on l\u00e9v\u0151 eszk\u00f6z\u00f6k k\u00f6z\u00f6tti forgalmat?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>No. Two devices in the same subnet reach each other through a switch, and the router is not in that path, so the packets are never offered to the inspection engine. The Monitored Interfaces table in Settings shows the real scope, and no option there extends it to same-subnet traffic.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Biztons\u00e1gos enged\u00e9lyezve hagyni a Threat Prevention-t?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Yes, with one caveat worth knowing. The recommended default passes traffic through unfiltered when the engine is saturated, which keeps your line up at the cost of inspection. The opposite mode drops that traffic instead. We have also had the engine wedge under a flood of harmless exploit attempts and start refusing a server&#8217;s outbound traffic, which cost us a mail outage, so include the router in your list of suspects when a machine goes quiet.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Seg\u00edtett egy\u00e1ltal\u00e1n a Threat Prevention a PHP2Shell ellen?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>No, and three separate reasons each would have been enough on their own. The traffic was encrypted everywhere the router looks, no Snort or Emerging Threats signature was published for either CVE, and the exploit has no payload shape to match because the first request is defined by the memory it consumes and the second looks completely ordinary. The fix was new PHP packages, with a reverse-proxy WAF covering the gap in the meantime.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-7\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Is disabling session.upload_progress enough on an unpatchable host?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>It helps and it is not enough. Switching it off removes one documented route to CVE-2026-109619, which is worth doing on a host you truly cannot update, but memory exhaustion is reachable by other means and the setting does nothing for CVE-2026-109618. Treat it as borrowed time and plan the package update.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-8\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">What should I buy or configure first for a NAS-hosted site?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Helyezzen egy kezelt szab\u00e1lyk\u00e9szlettel rendelkez\u0151 ford\u00edtott proxyt a webhely el\u00e9, majd korl\u00e1tozza az eredetet, hogy a 443-as port csak arra a proxynetworkre v\u00e1laszoljon. Ez a k\u00e9t l\u00e9p\u00e9s egy\u00fctt \u00e1thelyezi az ellen\u0151rz\u00e9si pontot egy olyan helyre, ahol a k\u00e9r\u00e9s olvashat\u00f3, \u00e9s megsz\u00fcnteti a megker\u00fcl\u00e9st, amely \u00e9rv\u00e9nytelen\u00edten\u00e9 azt. Ezt k\u00f6vet\u0151en tartsa enged\u00e9lyezve a Threat Prevention-t a kimen\u0151 parancs- \u00e9s vez\u00e9rl\u0151forgalomhoz, valamint a ny\u00edlt sz\u00f6veges szolg\u00e1ltat\u00e1sokhoz, mert itt v\u00e9gez val\u00f3di munk\u00e1t.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<h2 id=\"references-and-video-walkthroughs\" class=\"wp-block-heading\">Referenci\u00e1k \u00e9s vide\u00f3s bemutat\u00f3k<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Els\u0151dleges forr\u00e1sok a fent le\u00edrtakhoz, valamint h\u00e1rom \u00fatmutat\u00f3, amelyekre \u00e9rdemes id\u0151t sz\u00e1nni.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/kb.synology.com\/en-global\/SRM\/help\/ThreatPrevention\/threatprevention_desc\" target=\"_blank\" rel=\"noreferrer noopener\">Synology Tud\u00e1sk\u00f6zpont: Threat Prevention<\/a> covers requirements, modes and model support.<\/li>\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_26_14\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-26:14<\/a> lists the fixed PHP package versions for DSM, including the 7.4 build.<\/li>\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/php2shell\/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities\" target=\"_blank\" rel=\"noreferrer noopener\">Synology Statement on PHP2Shell<\/a> names the affected packages and the one that needs a manual update.<\/li>\n\n<li><a href=\"https:\/\/developers.cloudflare.com\/waf\/managed-rules\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Cloudflare WAF managed rules<\/a> explains how managed rulesets are versioned and deployed.<\/li>\n\n<li><a href=\"https:\/\/www.cloudflare.com\/ips\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Cloudflare IP-tartom\u00e1nyok<\/a> is the endpoint to read when locking an origin to the proxy instead of hard-coding addresses.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"SRM Threat Prevention \u2013 A val\u00f3s idej\u0171 h\u00e1l\u00f3zati v\u00e9delem elmagyar\u00e1zva\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/yT_xGpxGF7k?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">Az SRM Threat Prevention m\u0171k\u00f6d\u00e9s\u00e9nek elmagyar\u00e1z\u00e1sa, bele\u00e9rtve azt is, hol helyezkedik el a csomag a h\u00e1l\u00f3zatban<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Synology \u00fatv\u00e1laszt\u00f3 sebess\u00e9gteszt enged\u00e9lyezett Threat Prevention mellett.\" width=\"1200\" height=\"900\" src=\"https:\/\/www.youtube.com\/embed\/wuuRthcZQ_E?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">\u00c1tviteli sebess\u00e9g teszt enged\u00e9lyezett Threat Prevention mellett, ami az az \u00e1r, amir\u0151l senki sem besz\u00e9l<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Protecting Your Public Websites with Cloudflare WAF\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/NbEo8p2Hvt8?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">Cloudflare a nyilv\u00e1nos webhelyek WAF-fal t\u00f6rt\u00e9n\u0151 v\u00e9delm\u00e9r\u0151l, arr\u00f3l a r\u00e9tegr\u0151l, amely beolvassa a k\u00e9r\u00e9st<\/figcaption><\/figure>","protected":false},"excerpt":{"rendered":"<p>Threat Prevention is the package most people reach for the moment they decide to host a website on a Synology NAS. It sits on the router, it has a shield icon, and its dashboard counts attacks in the hundreds, so it looks like the thing that keeps a public site safe. We run it on [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":22124,"comment_status":"open","ping_status":"closed","template":"","meta":{"_eb_attr":"","_xspeed_no_cache":false,"_xspeed_expiry_hours":0,"footnotes":""},"doc_category":[197],"doc_tag":[],"class_list":["post-22125","docs","type-docs","status-publish","has-post-thumbnail","hentry","doc_category-nas-hosting-101"],"year_month":"2026-10","word_count":3684,"total_views":"43","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"Adair Hsu","author_nicename":"adairpk17","author_url":"https:\/\/synopower.club\/hu\/author\/adairpk17\/"},"doc_category_info":[{"term_name":"NAS Hosting 101","term_url":"https:\/\/synopower.club\/hu\/docs-category\/nas-hosting-101\/"}],"doc_tag_info":[],"_links":{"self":[{"href":"https:\/\/synopower.club\/hu\/wp-json\/wp\/v2\/docs\/22125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/synopower.club\/hu\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/synopower.club\/hu\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/synopower.club\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/synopower.club\/hu\/wp-json\/wp\/v2\/comments?post=22125"}],"version-history":[{"count":2,"href":"https:\/\/synopower.club\/hu\/wp-json\/wp\/v2\/docs\/22125\/revisions"}],"predecessor-version":[{"id":22127,"href":"https:\/\/synopower.club\/hu\/wp-json\/wp\/v2\/docs\/22125\/revisions\/22127"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/synopower.club\/hu\/wp-json\/wp\/v2\/media\/22124"}],"wp:attachment":[{"href":"https:\/\/synopower.club\/hu\/wp-json\/wp\/v2\/media?parent=22125"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/synopower.club\/hu\/wp-json\/wp\/v2\/doc_category?post=22125"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/synopower.club\/hu\/wp-json\/wp\/v2\/doc_tag?post=22125"}],"curies":[{"name":"munkaf\u00fczet","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}