Replace open any/any inbound rule on Synology NAT with explicit TCP ports: 443 (Synology), 9890 (Vaultwarden), 4769 (Zabbix), 8080 (Snipe-IT), 3000 (Metabase), 3333 (Gitea), 8081 (phpIPAM). Access allowed from any IP. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>