Synology NAS loses connection after IPS is enabled in LAN to WAN Rule ?

Hello Nabil R1,

Thank you for reaching out to the community, you'll be able to see the traffic getting dropped under the log viewer > drop down menu > IPS. 

Thanks,

It's empty though.

If I remove the IPS, I get the connectivity back. So it is definitely due to that. 

Under the firewall rule where you have applied the IPS policy, is "Log firewall traffic" Enabled ?
If not, please enabled it, without it, it will not log the traffic !!

Yes indeed.

I see a lot of "Invalid Traffic", in the logs, under Firewall Rule, coming from my NAS IP.

Those aren't there when I remove the IPS

In that case, please check the KBA: Understanding Invalid Traffic:
https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/LogViewer/InvalidTrafficEvents/index.html#managing-invalid-traffic-events

You can reduce the number of invalid traffic events logged by increasing the Tcp Connection Establishment Idle Timeout value. 

 For example, you can increase the timeout to 6 hours (21600 seconds):

set advanced-firewall tcp-est-idle-timeout 21600

Ok I'll try that right away.

But does this have anything to do with IPS ? What is the default TCP timeout ?

Edit : It is not enough to re-establish the connection

The default tcp timeout is 10800. You can also check with the value of 86400 instead. 
This is in the context when you start noticing the invalid events, after applying IPS. Check with the values provided and see if that helps with the situation. 

To check whether the change has taken place, you may enter the following cmd: 
show advanced-firewall

The default tcp timeout is 10800. You can also check with the value of 86400 instead. 
This is in the context when you start noticing the invalid events, after applying IPS. Check with the values provided and see if that helps with the situation. 

To check whether the change has taken place, you may enter the following cmd: 
show advanced-firewall

This has indeed solved the issue (86400). Could you explain to me what it means ? 

If a user then sends a packet, it doesn't match any connection in the conntrack table. Sophos Firewall drops the packet and logs it as an invalid traffic event. With the value of 86400 it maintains the conntrack so it takes 24 hours before it completely expires connection. 

Actually, it wasn't enough, it seems to have lost connection again.

I don't understand as well : we have 3 hours timeout, we're moving to 6 hours or to 24 hours. Still seems plenty of time ?

Just for the testing purpose, what if you bypass the firewall rule under the IPS exception: 
Please follow the steps mentioned in the KBA: https://support.sophos.com/support/s/article/KB-000038900?language=en_US
 

Same thing, it didn't seem to work.

Can you share the results of show ips-settings. 

console> show ips-settings 

-------------IPS Settings-------------

ac_atp_exception_fwrules 11

stream on

lowmem off

maxsesbytes 0

maxpkts 8

enable_appsignatures on

http_response_scan_limit  65535

search_method ac-bnfa

sip_preproc enabled

sip_ignore_call_channel enabled

inspect untrusted-content

-------------IPS Instances------------

IPS is running on all cores

I'm actually lost. Now after deactivating IPS globally, I still don't have connection for some of my app on my NAS.

Can you also increase the maxpkts with the help of the following command: set ips maxpkts 100
And then check the results again. 
=============================
Monitor dropped packets using CLI : https://support.sophos.com/support/s/article/KB-000036858?language=en_US

Create and download a packet capture : support.sophos.com/.../KB-000037007