Synology NAS loses connection after IPS is enabled in LAN to WAN Rule ?

Hello Nabil R1,

Thank you for reaching out to the community, you'll be able to see the traffic getting dropped under the log viewer > drop down menu > IPS. 

Thanks,

It's empty though.

If I remove the IPS, I get the connectivity back. So it is definitely due to that. 

In that case, please check the KBA: Understanding Invalid Traffic:
https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/LogViewer/InvalidTrafficEvents/index.html#managing-invalid-traffic-events

You can reduce the number of invalid traffic events logged by increasing the Tcp Connection Establishment Idle Timeout value. 

 For example, you can increase the timeout to 6 hours (21600 seconds):

set advanced-firewall tcp-est-idle-timeout 21600

Ok I'll try that right away.

But does this have anything to do with IPS ? What is the default TCP timeout ?

Edit : It is not enough to re-establish the connection

The default tcp timeout is 10800. You can also check with the value of 86400 instead. 
This is in the context when you start noticing the invalid events, after applying IPS. Check with the values provided and see if that helps with the situation. 

To check whether the change has taken place, you may enter the following cmd: 
show advanced-firewall

This has indeed solved the issue (86400). Could you explain to me what it means ? 

If a user then sends a packet, it doesn't match any connection in the conntrack table. Sophos Firewall drops the packet and logs it as an invalid traffic event. With the value of 86400 it maintains the conntrack so it takes 24 hours before it completely expires connection. 

Actually, it wasn't enough, it seems to have lost connection again.

I don't understand as well : we have 3 hours timeout, we're moving to 6 hours or to 24 hours. Still seems plenty of time ?

Just for the testing purpose, what if you bypass the firewall rule under the IPS exception: 
Please follow the steps mentioned in the KBA: https://support.sophos.com/support/s/article/KB-000038900?language=en_US
 

Same thing, it didn't seem to work.

Can you share the results of show ips-settings. 

console> show ips-settings 

-------------IPS Settings-------------

ac_atp_exception_fwrules 11

stream on

lowmem off

maxsesbytes 0

maxpkts 8

enable_appsignatures on

http_response_scan_limit  65535

search_method ac-bnfa

sip_preproc enabled

sip_ignore_call_channel enabled

inspect untrusted-content

-------------IPS Instances------------

IPS is running on all cores

console> show ips-settings 

-------------IPS Settings-------------

ac_atp_exception_fwrules 11

stream on

lowmem off

maxsesbytes 0

maxpkts 8

enable_appsignatures on

http_response_scan_limit  65535

search_method ac-bnfa

sip_preproc enabled

sip_ignore_call_channel enabled

inspect untrusted-content

-------------IPS Instances------------

IPS is running on all cores

I'm actually lost. Now after deactivating IPS globally, I still don't have connection for some of my app on my NAS.

Can you also increase the maxpkts with the help of the following command: set ips maxpkts 100
And then check the results again. 
=============================
Monitor dropped packets using CLI : https://support.sophos.com/support/s/article/KB-000036858?language=en_US

Create and download a packet capture : support.sophos.com/.../KB-000037007

It says 0 dropped packet

Can you  Monitor traffic using Packet Capture Utility : https://support.sophos.com/support/s/article/KB-000035761?language=en_US
And also check with the Create and download a packet capture : https://support.sophos.com/support/s/article/KB-000037007?language=en_US

I'm starting to think the problem has nothing to do with Sophos but rather with my NAS itself.

I'll try to investigate something down this road first before bothering you any further. 

I really appreciate the time you took in following my queries. I'll get back to you quickly

I've now found out that it is not the NAS that is the issue. Any docker pull xx I do from any host fails.

Downloading an ISO, seems to work.

Strangely, on one of my linux box, when I forced the MTU to a different value, it would then successfully download.

But I'm not sure which MTU I should be using, and how to set it across my network ?