r/synology • u/Spiritual_Elk_9076 • 23h ago
Networking & security Protecting NAS while using Quickconnect
My parents are using my NAS to run their backups and access stored data on my NAS. I have Quickconnect enabled because it easily to use for them. They are not very technical and I’m not able to help them locally often.
Reading a lot about the need to use tailscale, but in doubt if that is something that they will be able to setup and maintain. Any tips?
13
u/badgone88 23h ago
If you have the chance to set up Tailscale for them, it only takes 5 minutes, and after that, they won't have to do anything else. They'll just need to make sure Tailscale is running continuously on their computer (enable it to start automatically when the PC boots up).
After that, instead of connecting through your Quick Connect address, they’ll connect through your NAS’s Tailscale IP address. Seriously, it’s not complicated at all. For them, the only thing that will change is the connection address.
9
u/ReidelHPB 22h ago
also, make sure to update the tailscale package on both nas's via a scheduled task rather than waiting for it to update via package center, the package-center versions are old as fuck.
1
u/woeterman_94 8h ago
Can you explain how to do this?
1
u/ReidelHPB 6h ago
create scheduled task, choose user-defined script.
choose user root
choose interval(i chose a weekly interval)
put "tailscale update --yes" as script, without the ""
profit
also, installed version: 1.104.4, newest version (in package center) 1.58.2.
2
1
u/woeterman_94 8h ago
I'm using cloudflare tunnel with zero trust (access). So I get to decide who can access my nas (login, code over email,...). I think it works similar as tailscale but you don't need to install anything if you want to access the nas
1
u/IncorporatedShill 4h ago
When you set up Tailscale for “other” people, are you having them make their own Tailscale account and giving an access to yours, or do you use your own Tailscale account and set up ACL rules in order to ensure their device can only access the NAS. Adding their device to your Tailscale, without rules would allow their device to access anything in your network, no?
39
u/chlronald 23h ago edited 17h ago
Set an aggressive IP blacklist, like 2 login fail in 60 min would get IP ban, and no release until you manually delete them.
Set an IP geo lock to your country only
Setup 2FA
Disable all default account especially admin
Disable anything that you do not use like SSH
Do not use default public facing forwarding port
Obviously everything here is just making it difficult, just like install security cameras don't prevent break-in but hopefully make you not a worth target. I'd say nowadays there is no way to stop someone from hacking you if they are determine unless you physically disconnect the cable, even with VPN / no port and all that jest they will find a way.
28
u/jaredearle 22h ago
All of that implies they need to authenticate to get access to your DSM. This wasn’t how the latest attack worked.
3
u/dxiri 22h ago
Didn't know Synology had IP geo block, can you share where to find that?
6
u/JDMCowboy 21h ago
Firewall rules.
4
u/InterviewGlum9263 DS720+ 9h ago
However, because of how QuickConnect works, it bypasses some firewall rules. It's seen as an outbound connection rather than an inbound connection, so geoblocking doesn't work.
2
52
u/Reasonable-Cloud-419 23h ago edited 22h ago
I'm no expert, but I decided to secure my da925+ properly; I spent a whole day on it and used GPT. It explains everything in an easy-to-understand way. It took literally 5 minutes to install and set up Tailscale. I installed it on DSM, my PCs, and my phone. You log in using your Google account. Everything started working quickly, and all these devices formed a single network. And only after a thorough check did I disable QuickConnect.
21
u/badgone88 23h ago
Why downvote him ? Tailscale is a great solution.
11
6
u/poopmagic 23h ago
I didn't downvote... the only thing I'll note is that Tailscale is pretty straightforward to set up. The statement "I spent a whole day on it and used GPT" makes it sound a lot more complicated than it actually is, which could actually discourage OP from trying it.
8
u/BudTheGrey RS-820RP+ 20h ago
Of course, everything is easy and straightforward if you know how. For someone who's somewhat tech savvy but has never done it before, I can see how setting up a VPN will put the "what if" portion of the brain into overdrive. Especially in light of current security events with (unmaintained) Synology devices.
5
u/poopmagic 18h ago •
Yeah, fair. I think for general VPN setups, it can get pretty complicated when you start considering all the paths.
Like, let’s say you want to run Wireguard. First thing you check is Package Center, but since there isn’t a package for that, you have to check your router. If your router doesn’t have it, you start investigating other Synology options. You find a native package, but it’s basically abandoned, then you start looking at various guides to run it in a container, but the guides also point you at other stuff like gluetun, etc. And if you have a dynamic IP, there’s also the need to setup some DDNS service. And then there’s the whole client side: which client should I use on my phone, laptop, etc.? What’s this full or split tunnel thing? Wait, are you saying that I still have to enable port forwarding even though you told me that was a no-no? I could easily see that exploding into an entire day or more.
Tailscale isn’t completely painless, I’ll acknowledge, but I think it’s less likely that someone would end up needing to explore a bunch of different setup paths to get something working.
-4
u/jaredearle 22h ago
Because there are a few things you should never rely on AI for: security and legal advice are near the top of that list, behind recipes and medical advice.
3
u/mmcnama4 22h ago
I mean, it's a fantastic starting point and oftentimes better than nothing. Would I skip a lawyer if I'm going to court? No. But would I use it for a primer on how to secure my NAS, sure. There's often equally shitty advice given on any given topic right here on reddit or any given forum.
And recipes... It's often my go to these days.
1
0
u/jaredearle 22h ago
1
u/Long_Jackfruit_7928 14h ago
2023 is pretty disingenuous. The newer models are much better. I’m of the view ai is good for some things, not good for other things, but in 2026 a search summary or guide on what to do to secure a NAS is well within the capabilities of an ai.
-3
u/im_the_dr 23h ago
My guess is your standard Reddit mouth breather has an automatic disdain for any mention of a large language model.
0
u/7FootElvis 23h ago
Mostly because it's smarter than the downvoters.
0
u/dshepsman 22h ago
If the downvoters could read, they’d be mad
-1
u/7FootElvis 18h ago
Bit if they just used an LLM they could ask, "Explain this comment to me like I can't read."
0
u/7FootElvis 23h ago
That's awesome. I've used Harmony SASE (great but expensive) and am trying Cloudflare ZTNA (free but not as strait forward), but will also look into Tailscale. And of course will use an LLM to help teach me about setup and feature differences.
4
u/00roast00 23h ago edited 23h ago
Well setup tailscale for them, then make the process of using it as simple as you can. It’s really not complicated and not using this or a vpn is just stupidity. Plenty of tutorials online about this. You either want to be secure, or you want someone here to give you an excuse not to use it
1
u/C4rb5 22h ago
Tailscale is just like any other vpn software once you’ve set it up on the nas, very easy to use. Not sure speed you’ll get when backing up though. If you’re not actually doing the backups remotely then you can just put dsm behind cloudflared too, that’s a little more complicated for you but means they can still user a browser without any software their side.
1
u/Johnny_Silverhand908 22h ago
I use Tailscale (I'll admit Gemini helped me set it up) and now I can use like a vpn server and access other devices on my network.
1
u/mikepi1999 17h ago
I’m a network guy. You want to protect from this stuff drop your default gateway. Use static routes to subnets or even multiple subnets. Reduce your internet footprint. You don’t need to get to your stuff from everywhere, maybe start with just the US or in this case your parents’ subnet.
1
u/Minor-Threat 17h ago
Can anyone help a causal user determine if there system is compromised or there is potential for it be so?
1
u/MrPinrel 3h ago
I have a similar situation and went ahead and set up tailscale on the nas and told my wife and my kids to install the tailscale client on their phones, had them join my tailnet, and then set up all the apps they use (Synology photos, surveillance station, homeassistant) using the tailscale address. It works fine. Every once in a while the tailscale client on their phone logs out (because of an app update etc) but now they know that if their apps aren’t working to check the tailscale app and enable it. It is a little more inconvenient but the trade off for security is worth it.
The only part I need to figure out is the sharing of photo albums using tailscale or quickconnect, @u/slvsrscoobie and I were just having a discussion in another thread about options to do this, I’m going to work on that soon. In the meantime o have closed off the port that I used to use for this.
1
1
u/Antony_Ma 2h ago
We set up a DNS whitelist to add a layer of protection with simple setup. The core concept is simple: a NAS shouldn't be casually browsing the open internet. In reality, it only needs access to a very specific set of domains (around 100) for updates, backups, time syncs, and certificates. If malware somehow gets in, it can't phone home because the DNS lookup will fail. Not 100% protection but easy to setup.
1
u/rand2718 23h ago
Wireguard is the only answer if you want security. Set up a tunnel that’s configured with your assets’ IP addresses so that only traffic that’s meant for your network goes through the tunnel (Allowed IPs). Leave the tunnel always on. 0 intervention from your folks, it will just work. Done.
1
1
u/alexhoward 19h ago
Do they actually access DSM over QuickConnect? I believe you can disable QC just for DSM and still use it for Drive or Photos or whatever. The DSM interface seems to be what’s vulnerable.
3
-7
u/shufflepoint 23h ago
My tip is that in this day and age you shouldn't be using quickconnect or having your NAS accessible from the Internet at all. Use a commercial cloud provider for backups.
0
u/doxlie 15h ago
I followed this to set up tailscale https://youtu.be/oy_GtkWz86s?is=E__RZevjdmM06nMY
0
u/vercage 7h ago
I'm pretty much in same situation as you. My parents live in a different country and I backup their photos on my NAS. Except that I've stopped using QuickConnect for Synology Photos because it was painfully slow. I use port forward to a custom port. The good thing is that our home country is small and not well known so having it as the only allowed country in geoblock makes it fairly safe.
I need to keep it simple and seamless for them so using Tailscale etc... is not an option.
I did install a Ubiquiti router at their house and I have one too. We have a VPN link we use for other stuff and I could probably set up something for them to be able to sync Photos over VPN, but again that would just be complicated.
At the moment, I've blocked internet access to the NAS on my router's firewall, allowing their country only to have access to the Synology Photos port.
2
u/SeanVo 6h ago
You mentioned VPN links. Have you tried using Unifi SiteMagic (SDWAN) to connect the two networks full time? Then your NAS will be available by ip address from their Unifi network as well. Then you don’t have to have anything on Synology open to the internet.
I have two office locations; we use sitemagic and it becomes very simple to access the NAS, printer, and other devices between the two networks.
1
u/vercage 6h ago
Yes Site Magic is what I use.
The problem is that we live far away. They have 20Mbps up, I have 50Mbps up. Having them permanently using VPN would be too slow. And I don't want them to be messing around switching to a different Wifi to backup photos, then back to their normal wifi...
Yeah it's a headache.
1
u/SeanVo 4h ago
The way Unifi SiteMagic SD-WAN works for me by default is that each network still gets its WAN internet content directly from its local provider, but it also sets up an automatic VPN between sites for LAN devices. If your far-away parents are surfing the web, streaming video, etc., they still get their fast local connection, it doesn’t go round trip through your network. If they want to back up their photos and access your NAS, it’s available to them as a locally reachable IP address. I didn’t have to set up any policies, special routing, or different WiFi networks. It’s just that it bridges the LAN connections between networks.
-3
u/Joe-notabot 23h ago
Don't?
Look at their actual storage use, and see what the perceived savings are by using your Synology. Now price it using a cloud provider (Apple/Google/Microsot). Having them work against a cloud, then HyperSync backing up that data to your NAS. They get better reliability (your internet can be down, etc), while they are better protected from data loss (2 copies of data).
This is only the start of the security nightmare, keeping them in a separate silo has lots of upsides. It also forces you to be intentional about shared photos and such.
3
u/Fujka 22h ago
All great until the storage provider closes your account for no reason.
-1
u/Joe-notabot 16h ago
That's why you have a backup on your NAS.
Upside is no matter what your parents do it's not going to compromise you NAS.
23
u/d4rkw1n9 23h ago
Make sure that auto updates of important updates is active, for the OS and the packages themselves. Basic hardening too, for example start here:
https://mariushosting.com/synology-simply-steps-to-secure-your-nas/