How do you connect to the NAS at home when you're outside? I've tried DDNS, intranet penetration, and IPv6—let me tell you which one suits you best

it all started when I went out for a trip during National Day, and my mom suddenly wanted to send me a video—over 60MB, with WeChat packed to pieces. I said, 'Wait until I go back and interrogate you,' but she said no, she wanted it right now. My N100 mini PC at home had a Feiniu NAS running on it, with all the photos and videos inside, but when I was outside, no one could reach the NAS at home. That day, I was fussing around at the hotel until midnight and couldn't get in. After returning, I was determined to open up the remote access path. I tried three different paths and fell into every pitfall. This article lists everything I've tried, so you can directly copy your homework based on your own situation.

to get a general conclusion first: if your home broadband can get a public IP, using DDNS is the most comfortable; If you can't get it, you either use Feiniu's built-in fn Connect as a relay, or spend some money to build your own FRP. IPv6 is a trick—it works, but doesn't hold its shelf life. Let's go through them one by one.

first clarify one thing: does your broadband have public internet IP

this is the watershed of all plans. If you don't understand this, everything else will be wasted. The NAS is a domestic network device at home, with a long address like 192.168.x.x. This address doesn't exist on the internet outside, just like the room number inside the community, which the courier (public network) can't understand. If you want outsiders to access it, either give it a "world-wide" address (public IP recognition), or find a middleman to help you with a transfer (intranet penetration).

method to check public IPs: Log in to your router's management page (usually 192.168.1.1; if you don't know how to access it, check my previous article on the login portal), find the WAN port status, and note down the IP address. Then open Baidu and search for 'IP', and compare the IP in the search results with the WAN port IP: two are the same, congratulations on having a public IP; If the router shows 100.64.x.x or the two don't match, it means there is no .

here's a common pitfall for beginners: addresses starting with 100.64. It looks like a public IP but is actually the operator's intranet (called CGNAT, carrier-level NAT), sharing a single public network exit for the entire cell or area. When I saw my home was running 100.64.9.115, I was happy for a long time, thinking it worked. I tried port mapping for three hours but couldn't get through, and later found out this thing isn't a public network at all.

my home uses mobile broadband, and by default it's this kind of large intranet. I called 10086 to ask if they could provide a public IP address. The customer service girl politely said, "Your region is not supported." After hanging up, I called again and changed the explanation, saying that to install surveillance, you must have public network access. This time, they registered and said someone would contact me 48 hours a day. But it really was changed—so Mobile's public IP can be obtained, and the script is crucial. the success rate is higher than saying you installed a NAS. China Telecom and China Unicom generally accept it. If China Telecom calls 10,000 and says 'apply for public IP,' most regions will provide it directly.

the first path: public IP+DDNS, the best experience but requires hands-on

get a public IP so you don't get too excited—there's another problem: the IP is dynamic, and the carrier changes it from time to time (my home changes about every two weeks). You can't just remember the address every time you change it. DDNS is exactly what it does—if a client program stays at home, it automatically updates the new address to a domain name whenever the IP changes, and you just need to remember the domain name when you're away.

My method is zero cost: don't buy domains, use free ones. Feiniu has built-in DDNS functionality. In the settings, find "Remote Access," which supports entering keys for Alibaba Cloud and Tencent Cloud DNSPod, as well as free no-IP. I use Tencent Cloud's DNSPod free second-level domain solution: search for "DNSPod" in the WeChat public account, use its free domain resolution service, enter the ID and token for your Flying Bull, and save. No matter how the IP jumps afterward, the domain xxx.dnspod.net always points to my home.

having a domain name alone isn't enough; requests from outside need to know which door to go through. Two settings must be done:

• optical modem switches to bridge + router dial-up . Otherwise, if the public IP is on the optical modem, port mapping has to be done inside the modem, and the super password level can be exhausting. I wrote the full process of changing the bridge in . After changing the router's WAN port, just use the public IP and map it to the router.
• Router port mapping : Enter the router's "Port Mapping/Virtual Server"; for external ports, enter any larger one (e.g., 52345); for internal IPs, set NAS internal network address; for internal ports, set Feiniu's HTTPS port (default is 5663). A quick reminder: never expose well-known ports like 3389 or 22. I changed 5663 to 52345 just to avoid being targeted by scanners.

after completing these two steps, I typed https://xxx.dnspod.net:52345 in the hotel's mobile browser, and the Feiniu login page appeared instantly. That moment was worth all the effort. The fastest speed among the three routes is also the fastest. My home has 300Mbps uplink, and when watching Blu-ray movies stored on the NAS outside, I just drag the progress bar without spinning.

to say the ugly truth: the safety of this road lies entirely with you. Ports are exposed on the public internet, and scanners around the world are knocking on your door every day. Three things you must do: enable forced HTTPS in Feiniu's backend, change the administrator password to a 16-bit random string, and if possible, restrict source IPs on the router (if you often go, the IP is fixed). I enabled Feiniu's login failure lock, five errors, locked for half an hour, just for peace of mind.

second path: intranet penetration, mainstream solution without public IPs

public IP doesn't come to you? I can't just stop playing, can I? At this point, you need to find a "middleman": your external traffic first goes to a server with a public IP, and your home NAS actively maintains a channel with that server, allowing traffic to flow back through the channel. This is internal network penetration.

the easiest option is Feiniu's official fn Connect. In Feiniu system settings, open "Remote Access" and check fn Connect. It will automatically assign you an address xxxx.fnconnect.cn. Install Feiniu's app "fn connect" on your phone and scan the QR code to bind it, and you're done. No network settings needed for the whole process—it was done in five minutes. People my mom's age can use it. The downside is that it uses the official server for transfer, and speed depends on luck: I tested it at about 8MB/s during the evening rush hour, and during the day it reached 15MB/s. Watching 4K original discs is laggy, but it's sufficient for photos, document downloads, and online video streaming after transcoding. The free version is enough for everyday use, but heavy users can consider their paid acceleration.

find the official transfer slow and want to control it themselves, go for FRP. The idea is to spend a dozen yuan on a monthly disposable cloud server (any provider offers lightweight servers, 1 core and 1GB is enough), run frps on the server, use Docker on your home NAS to run frpc, and clearly specify in the configuration that a certain port of the server should be switched to the NAS's 5663. There are plenty of FRP configuration tutorials online, but I'll only mention three pitfalls I've encountered and rarely mention in tutorials:

• token both sides must consistent. The first time I set it up, the frpc log kept reporting login to server failed. After half an hour of checking, I finally found that a character in the token was lost during copying. It is recommended not to type tokens by hand, but to copy them directly.
• must pair with STCP, not tcp naked. Raw TCP means you attach the NAS port to a small pipe server; whoever scans it can test the password. The stcp mode requires an extra 'access side' key, so outsiders have to run a client with the key to connect, making it a whole level more secure.
• server bandwidth is the ceiling . Machines with 1 core and 1GB usually have 3-5Mbps bandwidth, so it's fine for photos, but for video viewing, don't even think about it. If you want to watch bandwidth upgrades or pay by data, it's better to just go for DDNS.

also mention ready-made box solutions like dandelion and peanut shells. The advantage is the graphical interface dotting around, but the downside is that the free version limits speed to 1Mbps and requires real-name verification. If you're using it for elders or really don't want to go through any hassle, you can buy it. If you're looking for a better experience, I don't recommend it.

the third way: IPv6, a free folk remedy

these past two years, operators have enabled IPv6 by default, so each device is assigned a public IPv6 address, so in theory, access is not needed for penetration. I tried it, and it really works, but the limitations are more than I expected—it's only suitable as a backup.

to work: your home broadband is IPv6 (if you can see addresses starting with 2408 or 240e in the router's WAN port info, you have them; for China Mobile, 240e is for China Mobile, for China Telecom is 2408); The phone you use outside also needs IPv6 data (China Mobile and Unicom basically have 4G/5G, but not even other people's WiFi); The IPv6 address on your home NAS will change, so you need to use DDNS IPv6 mode. If all three conditions are met, the direct connection speed is as fast as public IPv4—free access.

pitfall? First, many routers have IPv6 firewalls fully off (or enable all blocking) by default. You need to manually allow NAS ports to enter the router, but different companies call it "IPv6 Firewall," while others hide it in "Security Settings." Second, the access environment is beyond your control—if you connect to mall WiFi outside, IPv6 is unlikely to exist, and the connection is immediately cut off. So my suggestion is to set up IPv6 and keep it as a backup, with the first two main points still going strong.

Which three paths to choose? A single table explains everything

my current setup is: DDNS as the main source (don't waste the public IP you want), fn Connect for other family members' phones (they don't know how to enter the port number), and IPv6 setup but not deleted (in case any route crashes). Three sets coexist without conflict; having a few more roads gives peace of mind.

Finally, I'll go through the steps step by step: First, check if the router's WAN port has a public IP address. If not, call the carrier to request (install surveillance); If you get there, go all out on the DDNS+ port mapping path—remember to change the bridge first; If you really can't get it, Feiniu users can just open fn Connect and get it in five minutes; Prioritize speed before considering FRP. If you only buy a NAS for home use, you're wasting half the value—once you connect remote devices, you can take photos, movies, and documents wherever you go, and you'll never go back.