Remote NAS Access Without Exposing It

This guide shows you how to securely access your Synology or QNAP NAS from anywhere without opening ports to the internet. Instead of exposing your device directly, you’ll use a VPN server built into the NAS or a cloud relay service, keeping your data behind an encrypted tunnel. You’ll need administrator access to your NAS and, for the VPN method, a router that supports the VPN protocol you choose.

What You’ll Need

• Administrator login to your Synology DSM or QNAP QTS web interface.
• For the VPN method: a router that supports OpenVPN or WireGuard (most modern routers do), or the ability to install a VPN client on your computer/phone.
• For the cloud relay method: a free Synology QuickConnect ID or QNAP myQNAPcloud account.
• A stable internet connection at both ends.

Step-by-Step

Method 1: Set Up a VPN Server on Your NAS (Recommended)

1. Log in to your NAS admin panel. Open a browser and go to your NAS’s local IP address (e.g., http://192.168.1.100:5000 for Synology, http://192.168.1.100:8080 for QNAP). Enter your admin credentials.
2. Enable the VPN Server package. On Synology: open Package Center, search for VPN Server, and install it. On QNAP: open App Center, find QVPN Service, and install it.
3. Choose a VPN protocol. OpenVPN is the most compatible and works on all devices. WireGuard is faster and newer but may not be available on older NAS models. For this guide, we’ll use OpenVPN.
4. Configure OpenVPN.
   • On Synology: open VPN Server > OpenVPN. Check Enable OpenVPN. Set a port (default 1194). Leave the other settings as default unless you know what you’re doing.
   • On QNAP: open QVPN Service > OpenVPN. Click Enable OpenVPN. Set a port (default 1194).
5. Create a user account for VPN access. It’s best not to use your admin account. Create a new user (e.g., vpnuser) with a strong password. On Synology: Control Panel > User > Create. On QNAP: Control Panel > Users > Create.
6. Export the OpenVPN configuration file. On Synology: in VPN Server > OpenVPN, click Export Configuration. On QNAP: in QVPN Service > OpenVPN, click Export Config. This downloads a .zip file containing the client config and certificates.
7. Set up port forwarding for the VPN port. Even though we’re not exposing the NAS’s file services, we do need to forward the VPN port (e.g., 1194) from your router to the NAS’s local IP. Log in to your router, find Port Forwarding, and add a rule: external port 1194 (UDP) to internal IP of NAS, port 1194.
8. Test the VPN from outside. On your phone or laptop, install an OpenVPN client (like OpenVPN Connect). Import the config file you exported. Connect using the vpnuser credentials. Once connected, you can access your NAS using its local IP address (e.g., http://192.168.1.100:5000).

Method 2: Use Cloud Relay (Simpler, No Port Forwarding)

1. Enable QuickConnect (Synology) or myQNAPcloud (QNAP).
   • Synology: go to Control Panel > QuickConnect. Check Enable QuickConnect and sign in with your Synology Account. Create a QuickConnect ID (e.g., yourname).
   • QNAP: go to myQNAPcloud app. Sign in or create a QNAP account. Set up a cloud link (e.g., yourname.myqnapcloud.com).
2. Access your NAS via the relay. From any browser, go to https://quickconnect.to/yourname (Synology) or https://yourname.myqnapcloud.com (QNAP). Log in with your NAS credentials. You’ll get a web-based interface to your files and apps.
3. Use the mobile app. Install the official Synology or QNAP mobile app (DS file, Qfile). Enter your QuickConnect ID or cloud link instead of an IP address. The app connects through the relay without needing port forwarding.
4. Optional: Enable two-factor authentication (2FA). This adds an extra layer of security. On Synology: Control Panel > User > Advanced > Enable 2FA. On QNAP: Control Panel > Users > 2FA.

Common Mistakes

• Using the admin account for VPN. Always create a separate, limited user for remote access. If that account is compromised, the attacker doesn’t have full control.
• Forgetting to update the NAS firmware. Security patches are crucial. Enable automatic updates.
• Using a weak password. Your NAS password is the only thing standing between your data and the internet. Use a long, unique passphrase.
• Leaving the default VPN port. While not a security measure, changing the port reduces automated scan noise. Use a random high port (e.g., 49532).
• Not testing the VPN before relying on it. Always test from a mobile network (turn off Wi-Fi) to ensure it works outside your home.

Tips

• Use WireGuard if your NAS supports it. It’s faster and simpler than OpenVPN, and the config is a single file. QNAP supports WireGuard in QVPN 2.0+. Synology added WireGuard in DSM 7.2.
• Set up a dynamic DNS (DDNS) if you have a static IP. Most routers have built-in DDNS. This gives you a hostname like mynas.ddns.net that always points to your home IP, even if it changes.
• Enable firewall on your NAS. Only allow connections from the VPN subnet (e.g., 10.8.0.0/24) to the NAS’s management ports.
• Use the VPN for all remote access, not just file sharing. Once connected, you can access any service on your home network, like cameras or a media server.
• Keep a backup of your VPN config file. Store it in a password manager or encrypted cloud drive.

Troubleshooting

• VPN connects but no internet access. This is usually a routing issue. On the OpenVPN server, make sure Redirect all client traffic through VPN is disabled, or the client is not trying to route all traffic through the VPN.
• VPN connects but can’t reach the NAS. Check the NAS’s firewall settings. Ensure the NAS allows connections from the VPN subnet. Also, verify you’re using the correct local IP address of the NAS.
• Port forwarding not working. Confirm the NAS’s local IP is static (set a DHCP reservation in your router). Double-check the protocol (UDP) and port number. Some routers require you to enable port forwarding for both TCP and UDP separately.
• QuickConnect/myQNAPcloud slow. The relay servers can be congested. Try the VPN method for faster speeds. Also, ensure your NAS’s firmware is up to date.
• Can’t import the OpenVPN config. Make sure you extracted the .zip file first. The .ovpn file inside is what you import. If the client complains about missing certificates, re-export the config and try again.

Frequently Asked Questions

Is the VPN method truly secure?

Yes, OpenVPN and WireGuard use strong encryption. The only exposed port is the VPN port, which requires a certificate and password. It’s far safer than opening port 5000 or 8080 directly.

Do I need a static IP address?

No. For the VPN method, you can use a dynamic DNS service to keep track of your home IP. For QuickConnect/myQNAPcloud, you don’t need a static IP at all.

Can I use both methods at the same time?

Yes. You can have QuickConnect enabled for easy web access and also set up a VPN for full network access. They don’t conflict.

Will the VPN slow down my connection?

There’s a slight overhead due to encryption, but on a modern NAS, it’s minimal. WireGuard is faster than OpenVPN. The bottleneck is usually your home upload speed.

What if I travel to a country that blocks VPNs?

Some networks block VPN traffic. You can try changing the VPN port to 443 (HTTPS) which is often allowed. OpenVPN supports this easily.

Can I access my NAS from a public computer?

Yes, using QuickConnect or myQNAPcloud via a web browser. However, avoid logging in from untrusted devices, and always log out when done.

Related

• Why AI Won’t Take Your Programming Job
• NBA and WNBA Games: Where to Stream Them
• How AI Browsers Are Being Hacked and How to Stay Safe