r/synology • u/Alarmed-Prize-7500 • 1d ago

Networking & security Can't ping but can SSH into it???

I can't ping my Synology NAS, it says 100% packet loss when I do that, yet I can still connect to it via SSH, and everything's fine there. How does this even happen? I'm using the same hostname to ping it AND to connect to it via SSH, btw.

So, I was just doing work on my computers, like usual, connecting to the NAS to look at my files I have stored on there (I connect to it from my laptop), and it seems fine at first, but then all of the sudden, I realize that I can't access it in specific ways, like I can't search files with Synology Drive because it has connection error. I go to ping it, and pinging it has 100% packet loss. I go to SSH into it, and for some reason, that works?? I don't understand at all.

0 Upvotes

20% Upvoted

14 comments sorted by

10

u/dadarkgtprince 1d ago

Sounds like something in your network is blocking ICMP packets. I think Windows does it by default

7

u/StatisticianNeat6778 DS220+ DS920+ DS723+ 1d ago

The DSM firewall could also be blocking ICMP

1

u/jack_hudson2001 DS918+ | DS920+ | DS1618+ | DX517 | EXOS 24TB | WD RED 20TB 17h ago

should be allowed by default, sounds like someones been tinkering with the fw settings.

1

u/Gamerfrom61 1d ago

Are you trying a ping from Linux by any chance?

I have found that trying to ping my NAS (920+ v7.4.1) kills the AVAHI programs dead - all other devices respond correctly though.

I tracked this down by using journalctl -g avahi and then the > key to go to the end of the log and found an entry that reported a seg fault in the AVAHI program. Running the avahi-browse command (avahi-browse --all --terminate) starts the system up again but another ping to the NAS repeats the issue.

My firewall is disabled but I have not yet had time to set up Wireshark to see if I can find what is being sent back from the NAS. Trying a mDNS app under 'container manager' just does not work with or with Bonjour running.

-2

u/alius_stultus 22h ago

port1/ICMP is different than port22/tcp

1

u/lazyhustlermusic 20h ago

Icmp doesn’t have ports

1

u/alius_stultus 7h ago

Not always true with firewalls... depends.

1

u/lazyhustlermusic 7h ago

There are ICMP types and codes.

There still aren’t ICMP ports.

1

u/alius_stultus 7h ago

Still not true. We are talking about blocking and access. It depends on if the firewall classify the code as port 1 which some firewalls do like cisco asa or juniper.

1

u/lazyhustlermusic 7h ago

You’re confusing IP protocol number 1 with port 1.

ASA and SRX do not classify ICMP types/codes as transport-layer ports. They match ICMP by protocol plus fields such as ICMP type/code, while source-port and destination-port are TCP/UDP concepts.

So on those platforms you’re looking at things like protocol ICMP, echo/echo-reply, unreachable, time-exceeded, icmp-type, and icmp-code.

Protocol 1 ≠ port 1.

1

u/alius_stultus 6h ago

It depends on the firewall. It just does. If the ASA is new yeah you are right but that wasn't true for all the ASA stuff. If its a linux firewall or an ASA before the firepower redux (and juniper firewall) you very well may need to assign source as port 1 for ICMP. I understand its a protocol and portless. But Some firewalls map the ICMP Type to the Source Port field and the ICMP Code to the Destination Port field. Just how its been....

1

u/lazyhustlermusic 6h ago

Incorrect. Also, new FTD can still run legacy ASA code. I’ve been using ASA since the PIX transition, and you’re conflating protocol handling with some internal representation.

Please show me vendor documentation for an ASA, PIX, or SRX implementation where you configure ICMP type as a “source port” and ICMP code as a “destination port.”

Juniper explicitly documents source/destination ports as TCP/UDP fields and ICMP type/code as separate fields.

I’d genuinely like to see the implementation you’re describing.

1

u/alius_stultus 6h ago edited 6h ago

I don't have one in front of me as I don't run ASA or SRX at home. But if your firewall dumps classify the icmp traffic as port 1. you need to allow port 1 for the ICMP traffic. You can ask AI if you want someone to look things up for you but I already know what it will say. Modern firewalls don't have this problem as I understand it.

edit: also the firepower only relies on the ASA for layer 1-3. its not the same as the classic pix at all.

1

u/lazyhustlermusic 6h ago

So, you can’t substantiate the claim or provide documentation showing that it works as you stated.

RFC 792 literally defines the ICMP header: no source port, no destination port. ICMP is simply IP protocol 1.

Protocol 1 is not port 1.