Synology NAS unreachable from LAN

Good morning,

following the router reboot carried out by swisscom on 11.21.2019, I am experiencing this anomaly in my internal network, and I am unable to resolve it.

I have a Synology NAS which is correctly visible from an external network, both via DDNS, and via the chosen domain, and via Sinology’s QuickConnect, and via the smartphone apps if it uses the air network.

I can easily connect to the server via direct IP both from outside and inside the LAN, but the problem arises when from inside the network I try to connect to the server using the server name (until Wednesday I was able to connect) and the same thing happens smartphone apps cannot find the server when it is connected to the wifi network.

all the ports of the services present on the NAS are correctly forwarded on the router, the server has a static IP within the network and is also correctly configured in the router.

the name of the server is Nesland.ch and the port for accessing http is 5000, while for https it is 5001 but if I try to connect it gives me a connection refused.

The server logs show no connection attempts by PCs on the network other than those entering the direct server IP.

I have not made any changes to the server or router settings on my side, and the same configuration with the same ports and rules has been active for over 10 years… but since Thursday, all external users of the server see it correctly as before , while users of the internal network are unable to access it unless they enter the direct IP address 192.168.1.192.

Checked firewall and there are no blocks in this regard.

Swisscom Internet Box plus router

internal ip 192.168.1.1

Synology 214play

internal ip 192.168.1.105

Connection address:

https://nesland.ch:5001/

Do you know how to solve it?

Installed firmware version: 10.03.36/10.03.48/01507

it seems to be a hairpinning problem according to my skills on the subject (and also according to the wireshark trace)

If you need further information I am at your complete disposal

Good morning Domi,

Here is the result of today’s conversation: 1h 8min….

Swisscom DOES NOT carry out the Downgrade;

they offered me to talk to the myservice service at pagamento, (swisscom installs a new firmware that creates hairpinnin problems and I HAVE to pay for the service to solve the problem?!?!?!);

Spoke to them too… and it turns out they CANNOT downgrade because they don’t have the old firmware versions for my router (which is currently still being sold)…

They simply told me that I will have to wait for the new version of the firmware in the next few days (days, months,???) and that in the meantime they can’t do anything, the systems in the internal network DO NOT see each other if you use their URL, but only via IP, as things currently stand, swisscom routers do not manage hairpins.

So in the end:

Swisscom updates the router FW by changing internal parameters which change the internal network configurations,

Swisscom asks to pay for a troubleshooting service (for something they admittedly caused)

and finally Swisscom tells you that it can’t do anything about it and that you have to wait hoping that the next update will solve the problem…

Now if I did the same thing, as IT manager in my company…. I would be fired immediately and I would also have to pay for the damages caused…

Considering that BEFORE the forced update, everything was working without problems, what course of action do you recommend?

Gaetano

Thank you for your interesse on the matter.

@PatrickB2

If it helps you, the problem is called Hairpin, which is when a HOST within a network searches for another HOST within the same network using its public IP or domain name.

example:

Host A: internal ip 192.168.1.101 external domain name: sitename.ch / external ip swisscom

Host B: internal IP 192.168.1.102 external IP: the one assigned by swisscom.

if I go from B to A using the direct internal IP, the connection occurs on the open and correctly forwarded ports (in this case 443), if I do a reverse lookup from A to B using the direct IP, same thing, perfect connection .

both A and B regularly access the internet.

if I try to go from B to A via the sitename.ch or via the external IP address on the same port, the connection is rejected by the router.

if I do a reverse lookup from A to B using the public IP assigned by swisscom, the connection is rejected by the router.

in practice the hairpin allows you to accept requests from your IP to your IP on the specified ports (in practice the connection returns to itself ideally like a U or hairpin, hairpin in English).

@DomiP

regarding the various routers currently in use at swisscom, they all currently have the same firmware version, except the internet box3, but it would be useless to request a router change where the problem also exists on that firmware version, it would have to be tested first, and it would be one waste of material to send a new router when the current one works well (except for the problem generated by the latest update).

Where possible, I am at your complete disposal both for tests and for information, even by telephone.

At the moment I am encountering the same problem not only in the residential sector, but also in the corporate sector where we have a swisscom business center as a router and a NAS as a backup.

@PatrickB2

Hi Patrick,

from a purely economic perspective for Swisscom, given that the problem concerns the standard internet box and the internet box plus:

Is it worth waiting for the development of a specific firmware with the necessary corrections in a short time?

or

Is it worth replacing the affected routers with newer models where this problem does not occur?

I ask you these two questions because the continuation of this outage, although not caused voluntarily by Swisscom, is creating inefficiencies for the users I manage, and they have asked questions regarding the timing.

Best regards

Gaetano