In this guide
Short answer: the safest way to reach a NAS from outside your home is through a VPN, because your NAS then stays hidden from the internet. A manufacturer’s relay service is a convenient second choice. Avoid opening ports on your router, turn off UPnP, enable two-step verification and keep a separate backup.
A network attached storage device, or NAS, is a small server for your photos, documents and backups. It is wonderful to reach it from your phone while you are away. The traditional way, opening a port on your router, is also one of the riskiest.
Why port forwarding is a problem
Opening a port makes your NAS login page visible to anyone on the internet. Automated tools find it quickly and try to break in. NAS devices exposed this way have been targeted repeatedly, including by ransomware that encrypts all your files and demands payment. Even a strong password cannot protect against a security flaw in the NAS software.
Option 1: a home VPN (recommended)
A VPN server on your router, or on the NAS itself, creates an encrypted tunnel. You connect to the VPN first, and your NAS appears on your home network as if you were sitting there. The only thing exposed is the VPN, which is built to be exposed. Our explanation of how a home VPN differs from a VPN app gives more detail.
Option 2: the manufacturer’s relay service
Many NAS brands offer a relay or cloud connection service that links your device to their servers, so you can connect without opening ports. It is simple, but it means trusting the vendor, and your account becomes the key. Use a long, unique password and two-step verification.
Option 3: a mesh VPN or overlay network
Tools in this category create a private network between your devices without opening ports on your router. They can be a good option where your broadband provider does not allow incoming connections, though they add another service to trust and manage.
Comparison
| Method | Safety | Convenience | Notes |
|---|---|---|---|
| Home VPN | Very good | Good | Needs a little setup |
| Vendor relay | Good | Very good | Relies on the vendor’s service |
| Mesh VPN | Good | Good | Adds another service to trust |
| Open port | Poor | Very good | Not recommended |
Secure the NAS itself
- Change or disable the default administrator account.
- Enable two-step verification for every account.
- Keep the NAS software and apps updated.
- Disable services you do not use, and turn off UPnP on the router.
- Use snapshots, so you can roll back after ransomware.
A NAS is not a backup
If the NAS is your only copy of something, one fault, fire or ransomware attack can wipe it out. A good rule is three copies, on two types of storage, with one off-site. For instance, the NAS, a second drive and a cloud or off-site copy.
A simple, secure setup in six steps
- Update the NAS and the router to the latest firmware.
- Turn off UPnP on the router and check there are no old port forwards.
- Create a separate user for remote access, with only the folders it needs.
- Switch on two-step verification for every NAS account.
- Set up a VPN on the router or NAS, and test it from mobile data.
- Enable snapshots and a separate backup, then test restoring a file.
Remote access to other things at home
The same approach works for other devices. Our guide to whether remote desktop is safe shows how to reach a PC through the VPN, and our article on accessing your home network remotely without getting hacked covers the wider picture.
HomeIT Services sets up secure VPNs, firewalls and NAS access for homes and small businesses across Essex. See VPN and secure remote access setup, or contact us from Southend-on-Sea, Rayleigh or nearby.
Frequently asked questions
It is risky. NAS devices exposed to the internet have repeatedly been targeted by attackers and ransomware. Keep them behind a VPN where possible.
Relay services avoid port forwarding and are convenient, but you rely on the vendor and your account security. Use strong passwords and two-step verification.
Yes. Once connected to your home VPN, your media server behaves as if you were at home, although speed depends on your home upload speed.
Yes. A NAS is not a backup by itself. Keep another copy on a separate device and off-site, so ransomware, fire or theft does not take everything.
UPnP lets devices open ports on your router automatically. It is convenient but risky, so many people turn it off and open only what they truly need.
Rather have it done properly?
Get a clear, fixed quote from a local engineer before any work starts.