Breaking back into your network with the Synology Web UI

Have you ever left town, or even just took a trip to the coffee shop, only to find that you’re locked out of your home network? Maybe you needed a file that you forgot to put in Dropbox, or felt paranoid and wanted to check on your security cameras, or you just wanted to stream music. I have…

The end of a long drive

Last night, I arrived at my hotel after a 4 hour drive only to find my VPN wasn’t working. I always VPN in to home, so that I can access my file server, my VMs, security cameras, what have you. I didn’t understand.. I was sure I had things set up right. You see, I recently had my Xfinity router replaced, and had to set it up to talk to my Asus N66U, but I was absolutely sure it was working. Almost sure. Well, I thought it was working…

So I tried SSHing in. No dice. Hmm.. Any web server ports I exposed? Guess not. Maybe port forwarding was messed up somewhere?

Ah HA! I could reach my wonderful Synology NAS’s web UI. If you haven’t used this thing, it’s like a full-on desktop environment with apps. It’s amazing. Only thing it’s really missing is a web browser for accessing the home network (get on this, guys!). After spending some time thinking about it, I devised a solution to get me back into my home network, with full VPN access (though, see the end of the story for what happened there).

Christian’s step-by-step guide to breaking in with Synology

No more stories for now.

To get started, I’m assuming you have three things:

1. Remote access (with admin rights) to your Synology NAS’s web console.
2. A Linux server somewhere both sides can log into remotely (other than your local machine, as I’m assuming yours isn’t publicly connected to the network).
3. A local Linux or Mac with a web browser and ssh. You can make this work on Windows with Putty as well, but I’m not going into details on that. Just figure out SSH tunneling and replace step 7 below.

All set? Here’s what you do.

1. Log into your NAS and go to Package Center. Click Settings -> Package Sources and add:
2. Name: MissileHugger
   Location: http://packages.missilehugger.com/
3. Install the “Web Console” package and run it from the start menu.
4. Web Console doesn’t support interactive sessions with commands, so you’ll need to have some SSH key set up on your linux server’s authorized_keys, and have that key available to you. There’s also no multi-line paste, so you’ll need to copy this key through Web Console line-by-line:

   Locally:

   $ cat ~/.ssh/id_dsa

   On Web Console:

   $ echo "-----BEGIN DSA PRIVATE KEY-----" > id_dsa
   $ echo "<first line of private key>" >> id_dsa
   $ echo "<second line of private key>" >> id_dsa
   $ ...
   $ echo "-----END DSA PRIVATE KEY-----" >> id_dsa
   $ chmod 600 id_dsa

5. Establish a reverse tunnel to your Linux box, pointing to the web server you’re trying to reach (we’ll say 192.168.1.1 for your router).

   Remember that Web Console doesn’t support interactive sessions, or pseudo-terminal allocation, so we’ll need to tweak some stuff when calling ssh:

   $ ssh -o 'StrictHostKeyChecking no' -t -t -i id_dsa \
         -R 19980:192.168.1.1:80 youruser@yourlinuxserver

   The ‘StrictHostKeyChecking no’ is to get around not having any way to verify a host key from Web Console, and the two -t parameters (yes, two) forces TTY allocation regardless of the shell.

6. If all went well, your Linux server should locally have a port 19980 that reaches your web server. Verify this by logging in and typing:

   $ lynx http://localhost:19980

7. On your local machine, set up a tunnel to connect port 19980 on your machine to port 19980 on your Linux server.

   $ ssh -L 19980:yourlinuxserver:19980 youruser@yourlinuxserver

8. You should now be able to reach your router. Try it! Open your favorite browser and go to http://localhost:19980
9. Clean up. Delete your id_dsa you painfully hand-copied over, if you no longer need it, and kill your SSH sessions.

Epilogue

While this worked great, and I was able to get back in and see my router configuration, I wasn’t able to spot any problems.

That’s when I realized my Mac’s VPN configuration was hard-coding my old IP address and not the domain for my home network. Oops 🙁

Hope this helps someone!