My TS-233 is frequently sending alerts for QuFirewall when it reaches 5000 events. Can I block or suppress connections from port 1900 so I don’t get so many alerts?
I’ve not used QuFirewall, so I can’t help there.
But port 1900 is primarily used by SSDP (UPnP). UPnP was a well-intentioned, but ultimately “bad idea”. It allows LAN clients to poke holes in your Internet firewall.
If you disable the UPnP service on all devices in your LAN (including the NAS, but mainly your router), that should prevent the connection attempts.
Port 1900 is already disabled on the router and other media devices that have an option to disable. Most requests are coming from connected iPhones.
Ah, that makes it tricky. I don’t think it can be disabled in iOS.
Could you please provide a screenshot or log of the event you mentioned? We’ll see if we can help. Thanks!
Why do you need to use QuFirewall? Is your NAS exposed to the internet? It should not be. So if your NAS is behind your router’s firewall, there’s no need for a second one…
I’ve set the threshold for 5,000 so I don’t get too many notifications but still happens too frequently. I don’t want to set too much higher as that would defeat the reason for using QuFirewall.
Here is a link to the first three log files: Log files
Port 1900 is used to discover specific services or servers/devices on the home network. If these requests are coming from your iPhones, I would try to determine which app(s) are responsible. The QuFirewall logs shows multiple requests to port 1900 per second per iPhone! This indicates a faulty configuration of one or more apps on the iPhone.
Hi Kenhickey,
The high event count is caused by iPhones or other device in your subnet which periodically broadcasting SSDP discovery messages (port 1900 UDP) on your LAN.
If your NAS is behind a router (not directly exposed to the internet) and UPnP is already disabled on your router, the risk of this traffic is very low. You can safely add a whitelist rule in QuFirewall to stop these events from triggering notifications:
- QuFirewall → Firewall Profiles → Add Rule
- IP: your LAN subnet (e.g. 192.168.1.0 / 255.255.255.0)
- Protocol: UDP / Port: 1900
- Action: Allow
This keeps your event counter clean without affecting security.
Hope this helps!
How is it possible for an iPhone to generate that much network traffic by default? It’s a good thing I don’t have an iPhone.
You’d be surprised how much network traffic is just device discovery and so forth. Nearly all devices it these days. It’s not really that much traffic in terms of data size. And the user may have multiple iOS devices.
I really question the need to even use the firewall on a NAS that is inside your network and behind a firewall. I would not at all trust the QNAP firewall if you are exposing it to the WAN. There’s just about zero need to run a firewall on a NAS that is only on your local network.
I was mistaken. The traffic is not from iPhones. It is from a Sony TV and Sony soundbar that is one to two years old.
Thanks @CY1 your response was the most helpful in taming the log count.