How to securely enable external network access to NAS? I ran the 5001 port naked for a week, and finally only left one UDP port.

Last month, I mapped the DSM port of Synology DS220+ to the public network, thinking that it would be fine if I changed the complex password. As a result, when I opened the log center the next day, the screen was full of unfamiliar IPs trying admin, trying 123456, and dozens of them in a row. Only then did I realize that the moment the port was hung up, this machine had entered the public shooting range.

Later, I tried using both Synology and Feiniu N100, and finally only left one UDP port open to the outside world. This article won’t teach you how to memorize the parameters, it will just tell you the order in which I stepped on them.: First, let’s distinguish the four paths, then talk about why direct port mapping is the most dangerous, and finally give me a solution that I use now.

The four remote access routes are put together first.

If I want to connect my NAS to my home from outside, I have to go through the following four categories:: The manufacturer's own relay, DDNS plus port mapping, self-built intranet penetration, and VPN networking. No one is absolutely right, it all depends on what you want to do.

Synology's QuickConnect and Feiniu's FN Connect both fall into the first category. They can be used after installation and login, without touching the router. The disadvantage is that it uses the manufacturer's server for transfer, and the speed is easy to drift. When QuickConnect is slow, I can take three seconds to look at photos on my mobile phone. I have done this before. Why is Synology QuickConnect so slow? It has been dismantled. The same goes for Feiniu's FN Connect. Whether IPv6 can be directly connected or not makes a big difference. Why is Feiniu FN Connect sometimes fast and sometimes slow? Said this article.

DDNS plus port mapping is a traditional method. The advantage is that direct connection is fast, but the disadvantage is that you need to be able to configure a router and have a public IP. I am here How do you connect to your home NAS from outside? I have tried DDNS, intranet penetration, and IPv6. Those who are doing it for the first time should read that article first to establish the concept.

Self-built intranet penetration is a way when there is no public IP, but it uses a cloud server as a springboard. The speed depends on the server, and the security depends on the configuration. I will focus on VPN networking later. It is the one I am most willing to keep now.

Why direct port mapping is the most dangerous

Let's be honest first: Connecting DSM's 5001, SMB's 445, and SSH's 22 directly to the public network is equivalent to posting your house number and door lock on the road. It only takes a few minutes for the scanner to run on a network segment, and it doesn't even need to know who you are.

I counted it once using Synology Log Center. In the first two days after driving 5001, IPs from more than a dozen countries took turns to hit it, and the failure records were flushed very quickly. The "Security→Auto-Block" in Synology's control panel can block some of them. For example, if you make 5 mistakes within 5 minutes, the IP will be blocked, but this can only block the stupid ones. If you do encounter a vulnerability or weak password, it will be done once.

The most easily overlooked is the SMB port. Many people only forward 445 on the router, so that the folder can be opened outside like a LAN. As a result, SMB itself was not designed for the public network, and the old version still had many holes. When so many NAS were infected by ransomware, a large part of it was the management port and SMB. Will NAS be targeted by ransomware? There are three gates here, the first one is not to open the ports randomly.

So my bottom line is: The management page, SMB, and SSH can be used on the public network, but not on the public network. Changing the port to a non-default port can reduce some noise, but don't take it as safe. The scanner does not rely on guessing the port.

If you want a convenient web page, use HTTPS and add a reverse proxy.

If you really want to use a browser to open the NAS management page, photo album, Jellyfin, etc. outside, don't leave each port open. Add a reverse proxy to them, expose only one 443, configure HTTPS, at least the traffic will not streak.

What I installed on Feiniu N100 is the Nginx Proxy Manager container, officially called npm. When installing, map the three ports 80, 443, and 81. 81 is its management page, and then apply for a Let's Encrypt certificate for the domain name. If you want to add services in the future, just fill in the domain name, intranet IP, and port, and check the mandatory HTTPS box. Use 443 for the outside and 5001 or 8096 for the inside.

The prerequisite for this step is to have a domain name and configure DDNS. How to dynamically update a domain name, you can see How to use ddns-go In that article, it can catch up even when IPv6 prefixes change.

There is another practical issue to talk about here: Many home broadband operators have blocked inbound ports 80 and 443. I tried this at my own home and found that 443 could not be accessed. I had to change the reverse external port to 8443. Don't be too stubborn if you encounter a problem. Just put the port number after the URL when accessing. It is still 443 inside and 8443 outside. You can also use DNS verification for certificate application, and port 80 is not necessarily required. Also, certificates generally expire in three months. Use npm, which can automatically renew. Don't record the date manually.

After allocating, it is best to add another layer of account defense.: Change the default admin and enable two-step verification. Synology and Feiniu now support it. If you install an authenticator on your phone, you still have to go through one more level even if you lose your password. The reverse proxy solves the problem of "not running naked on the road" and cannot control "someone bumps into you at the door".

What really puts my mind at ease is VPN: WireGuard and Tailscale

After a lot of fussing, I found that the most worry-free thing for home scenarios is not to connect every service to the public network, but to open only one encrypted tunnel. People can enter the tunnel from outside and access everything as if they were sitting at home.

My own solution is WireGuard plus wg-easy container. The router only forwards one UDP port 51820 to the NAS, and all other ports are closed. UDP has the advantage that it is difficult for the scanner to know whether there is a service on this port, let alone how to return the protocol. Install the WireGuard client on your mobile phone and import the QR code.

If your home does not have a public IP, or you don’t want to touch the router port, then use Tailscale. It does not need to open any inbound ports and relies on the nodes on both sides to make their own holes. I installed one on my wife’s mobile phone, and after connecting it, she can directly access the LAN IP of the NAS. She can view photos and drag files. The premise is that each device is logged in with the same account. If the device is lost, it can be kicked off in the background.

Just a reminder: WireGuard gives you an encrypted channel, which does not mean that the password can be compromised. The NAS account password in the channel should be complicated or not, and the two-step verification should be turned on or off. VPN only hides the door, not removes it.

Avoid the three pitfalls I have stepped on

After two months of hard work, what really delayed the time was not the difficulty of configuration, but the back and forth of several small places.

• Don't do upgrading and keep the old port forwarding at the same time. I initially configured a reverse proxy for Jellyfin, but I forgot to delete the original 8096 forwarding line on the router. This meant that the new door was installed but the old door was still open. After changing the new plan, the first thing to do is to delete the old rules one by one, so as not to leave any backdoors.
• The container must be set to start automatically at boot. For resident tools such as Tailscale and npm, set the restart policy to unless-stopped when building a container. Otherwise, if the NAS is powered off, tunneling and reverse generation will not start up. Synology and Feiniu web backends have automatic restart switches, which can be easily turned on after installation.
• When a mobile phone is connected to the VPN, it also needs to accept subnet routing. When I used Tailscale's machine to access the 192.168.1.x network segment, I couldn't access it at first because I wasn't running on the NAS node. tailscale up --advertise-routes=192.168.1.0/24 , then go to the management background to confirm and enable this route. Just being connected to the tunnel does not mean that the entire LAN is automatically visible.

These three pitfalls are not complicated, but no one clicks on them, and novices tend to repeatedly suspect that they have made the wrong match in the last step. After making a change, use your mobile phone's data to try again. Don't test yourself on the same WiFi, otherwise you won't be able to test it.

Finally, you will be seated according to your needs.

I have arranged several roads into a table according to needs. You can just look at the first column.

The last configuration I have left now is: Tailscale is hung all year round, and you can use it with your mobile phone and computer ； If you need to temporarily use it for family members, use the sharing link that comes with the NAS. ； Ports 5001, 445, and 22 are all closed on the router. The log center was finally quiet.

If you are still connecting 5001 directly to the public network, do one thing first: Go to the router and delete this forwarding, then go to the NAS and turn on automatic blocking. The remaining anti-generation and VPN can be added slowly one by one. Close the door first and then talk about decoration.