Synology NAS loses connection after IPS is enabled in LAN to WAN Rule ?

Hello Nabil R1,

Thank you for reaching out to the community, you'll be able to see the traffic getting dropped under the log viewer > drop down menu > IPS. 

Thanks,

It's empty though.

If I remove the IPS, I get the connectivity back. So it is definitely due to that. 

Under the firewall rule where you have applied the IPS policy, is "Log firewall traffic" Enabled ?
If not, please enabled it, without it, it will not log the traffic !!

Yes indeed.

I see a lot of "Invalid Traffic", in the logs, under Firewall Rule, coming from my NAS IP.

Those aren't there when I remove the IPS

In that case, please check the KBA: Understanding Invalid Traffic:
https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/LogViewer/InvalidTrafficEvents/index.html#managing-invalid-traffic-events

You can reduce the number of invalid traffic events logged by increasing the Tcp Connection Establishment Idle Timeout value. 

 For example, you can increase the timeout to 6 hours (21600 seconds):

set advanced-firewall tcp-est-idle-timeout 21600

Ok I'll try that right away.

But does this have anything to do with IPS ? What is the default TCP timeout ?

Edit : It is not enough to re-establish the connection

The default tcp timeout is 10800. You can also check with the value of 86400 instead. 
This is in the context when you start noticing the invalid events, after applying IPS. Check with the values provided and see if that helps with the situation. 

To check whether the change has taken place, you may enter the following cmd: 
show advanced-firewall

This has indeed solved the issue (86400). Could you explain to me what it means ? 

If a user then sends a packet, it doesn't match any connection in the conntrack table. Sophos Firewall drops the packet and logs it as an invalid traffic event. With the value of 86400 it maintains the conntrack so it takes 24 hours before it completely expires connection. 

Actually, it wasn't enough, it seems to have lost connection again.

I don't understand as well : we have 3 hours timeout, we're moving to 6 hours or to 24 hours. Still seems plenty of time ?