Applicable Products
Container Station
Scenario
When the Allow connections from the list only option is enabled, the device restricts network access to a predefined set of IP addresses or subnets. This security measure operates at the IP layer (Layer 3) and is designed to reduce vulnerabilities by permitting only trusted connections. However, some NAS applications may malfunction under this setting because they often rely on inter-network communication between different segments within the device.
For instance, applications running in containers or deployed through Container Station might need to communicate with external services or other internal modules that are not included in your approved list. If these necessary connections are inadvertently blocked, the application can experience disruptions or fail to operate correctly. To prevent these issues, it is important to carefully review and update your allowed list to include all IP addresses or subnets required by your applications.
Procedure
Follow these steps to configure network connectivity:
- Log in to your QNAP device and open Network & Virtual Switch.
- Select Advanced mode.
- Go to Network > Virtual Switch.
- Identify the network segments used by the container network.
- Go to Control Panel > System > Security > Allow/Deny List.
Note
If QuFirewall is installed on your device, ensure it is enabled, then open QuFirewall and add the required network segments to the allow list.
- Ensure that the container network segments are added to the allow list.
Important
QNAP strongly recommends adding the following IP ranges to the allow list: 10.0.3.0/24, 10.0.5.0/24, 10.0.7.0/24, 172.29.0.0/22, 172.30.0.0/22. If Kubernetes services are enabled, also add 10.42.0.0/24 (Kubernetes Pod Network CIDR).
适用产品
Container Station
场景
当仅允许列表中的连接选项启用时，设备将网络访问限制为预定义的IP地址或子网集。这一安全措施在IP层（第3层）操作，旨在通过仅允许受信任的连接来减少漏洞。然而，一些NAS应用程序在此设置下可能会出现故障，因为它们通常依赖于设备内不同段之间的网络通信。
例如，通过容器运行的应用程序或通过Container Station部署的应用程序可能需要与外部服务或未包含在批准列表中的其他内部模块进行通信。如果这些必要的连接被意外阻止，应用程序可能会出现中断或无法正常运行。为防止这些问题，重要的是仔细审查和更新您的允许列表，以包括应用程序所需的所有IP地址或子网。
步骤
请按照以下步骤配置网络连接：
- 登录到您的QNAP设备并打开网络与虚拟交换机.
- 选择高级 模式。
- 前往网络 >虚拟交换机.
- 识别容器网络使用的网络段。
- 前往控制台 > 系统 > 安全 > 允许/拒绝列表.
注意
如果您的设备上安装了QuFirewall，请确保其已启用，然后打开QuFirewall并将所需的网络段添加到允许列表中。
- 确保容器网络段已添加到允许列表中。
重要
QNAP强烈建议将以下IP范围添加到允许列表中：10.0.3.0/24,10.0.5.0/24,10.0.7.0/24,172.29.0.0/22,172.30.0.0/22. 如果启用了Kubernetes服务，还需添加10.42.0.0/24（Kubernetes Pod网络CIDR）。
