Check what is enabled and what the firewall allows:
1. Go to Network Center > Security > Service.
2. Under Enable, review which services/packages are Enabled or Disabled.
3. For each enabled service/package, check whether the SRM firewall allows or blocks Internet access.
4. Use Allow through firewall / firewall rules to remove access for services and packages you don’t need.
5. If available, use Test Connection to test the ports used by services and packages from an external network.
For DSM, the related place is Control Panel > Info Center > Synology Account for account-related services, and Info Center also has Allow through firewall and Test Connection for services/packages.
If you are specifically auditing router exposure, the KB also notes that Service lets you check and modify whether services/packages are enabled and whether the SRM firewall allows/blocks Internet access.
Sources used: [1], [2]