In this guide · 8 sections
Short answer
Turn off port forwarding and UPnP for the NAS on the router and in the NAS, and use a VPN for remote access. Keep DSM or QTS updated automatically, disable the default admin account, enforce MFA, schedule snapshots and keep an offline or off-site backup.
Why an internet-facing NAS is a risk
A NAS runs its own operating system (Synology DSM or QNAP QTS and QuTS hero), web admin page and file services. If those are reachable from the internet, every new vulnerability is a way in, and attackers scan for them automatically. CSA's March 2024 alert on QNAP described an authentication bypass (CVE-2024-21899, CVSS 9.8) in QTS, QuTS hero, QuTScloud and myQNAPcloud that could let a remote attacker gain unauthorised access, and advised updating immediately.
Both vendors say the same thing first. Synology's ransomware prevention guide says do not expose DSM to the internet unless necessary, and strongly recommends a VPN if you must access file services remotely. QNAP's NAS security best practices start with 'Don't expose the NAS to the internet'.
Check whether your NAS is exposed
Exposure usually comes from a port forwarding rule someone added years ago, or from UPnP, which lets the NAS open router ports automatically.
Exposure check
Synology's Router Configuration help shows where DSM creates port forwarding rules on a UPnP router. If you find rules you didn't intend, note them before deleting, so you know what else might stop working.
Close the doors: port forwarding and UPnP
QNAP's best practices give the order of work, and the same applies to Synology.
Remove port forwarding rules on the router
QNAP says to disable forwarding of the NAS management ports, 8080 and 443 by default. For Synology the defaults are 5000 (HTTP) and 5001 (HTTPS).
Turn off UPnP port forwarding in the NAS
QNAP: open myQNAPcloud and deselect Enable UPnP Port forwarding. Synology: remove rules under Router Configuration and don't let DSM configure the router.
Turn off UPnP on the router
QNAP recommends disabling UPnP on both the NAS and the router, so no device can open ports silently.
Take the NAS out of any DMZ
A DMZ exposes every port. The NAS should sit behind the router's firewall.
Test again from outside
On mobile data, the NAS's public address should no longer answer.
If something does need to be open, Synology says to open only the ports for the services you use and to restrict them in the DSM firewall to specific IP addresses. QNAP says not to use default port numbers such as 443, 80, 8080 or 8081 if you forward ports at all.
Safer remote access to office files
Closing ports doesn't mean staff can't reach files from home. It means they go through a controlled path.
| Option | How it works | Suits |
|---|---|---|
| VPN to the office | Staff connect to a VPN on the router or NAS first, then see the NAS as if in the office | Most offices; recommended by Synology for remote file access |
| Vendor relay (QuickConnect, myQNAPcloud Link) | The NAS connects out to the vendor's service, so no inbound port is needed | Light use; set strong MFA, and keep the NAS updated because the login page is still reachable |
| Zero-trust tunnel | A connector on the network publishes one app to signed-in users only | Firms already using such a service |
| Move shared files to the cloud | OneDrive, SharePoint or Google Drive; the NAS stays internal for backups | Teams already on Microsoft 365 or Google Workspace |
QNAP's guide describes myQNAPcloud Link and its QVPN Service as the way to keep access after disabling port forwarding. Our guide to Cloudflare Tunnel for closing open ports explains the tunnel option in more detail.
Updates, accounts and built-in security tools
- Automatic updates: QNAP's guide shows how to set Control Panel > System > Firmware Update to check and install automatically. In DSM, set updates under Control Panel > Update & Restore. Follow the Synology Security Advisory and QNAP Security Advisories pages.
- Accounts: Synology's guide says to enable Auto Block, Account Protection and multi-factor authentication. Create a named admin account and disable the default 'admin'. Give staff accounts access only to the shared folders they need.
- Packages: Synology says it doesn't recommend installing third-party packages, and to keep any you do install patched. Remove apps you no longer use.
- Scans and logs: Synology suggests Security Advisor and Antivirus Essential for regular scans, and checking connection logs in Log Center. QNAP offers Security Center for checks and monitoring.
- PCs matter too: ransomware often reaches the NAS through a staff PC with mapped drives. Keep endpoint protection updated on every computer.
Snapshots and an offline backup copy
Snapshots are point-in-time copies on the NAS that let you roll a shared folder back to before the encryption. QNAP's guide covers scheduling them in Storage & Snapshots, and Synology offers Snapshot Replication, including immutable snapshots on supported models. But snapshots live on the same box: if the NAS fails, is stolen or the attacker gets full admin control, they can go too.
Synology's ransomware guide says to keep an offline, encrypted backup, follow the 3-2-1 rule, and regularly test that backups restore.
Recovery set-up
Our guides to immutable backups and Synology NAS vs cloud backup explain which combination suits a small office.
Do it yourself or get help?
Removing port forwarding, turning off UPnP and switching on MFA and automatic updates take about an hour with router and NAS admin access. The harder part is setting up remote access that staff will actually use, and a backup copy the NAS can't overwrite.
Our Backup & Ransomware Recovery (S$290) sets up an off-site backup and retention plan for your website and Microsoft 365 or Google Workspace, with a tested restore and a one-page recovery guide; on-site hardware isn't included. If you also run a server or web app, the Software & Server Protection Setup (S$590) covers malware scans, firewall with only the ports you need, automatic security updates and encrypted off-site backups for one server or app.
Frequently asked questions
It is the riskiest option. Synology advises not to expose DSM to the internet unless necessary and to use a VPN for remote access. QNAP's first best practice is to disable port forwarding and UPnP port forwarding. If you must open a port, open only the service you need, avoid default ports, and restrict access in the NAS firewall.
QuickConnect lets you reach the NAS without opening router ports, because the NAS connects out to Synology's service. It still makes the login page reachable from the internet, so use strong passwords, MFA, Auto Block and automatic updates. For regular access to office files, Synology recommends a VPN, which keeps the NAS off the public internet entirely.
For most small offices, yes. UPnP lets devices on your network open router ports automatically, which is how many NAS boxes and cameras end up exposed without anyone noticing. QNAP recommends disabling UPnP on both the NAS and the router. Check afterwards that the services you need still work through a VPN or relay.
They help. Snapshots let you roll shared folders back to before files were encrypted, and immutable snapshots resist deletion for their retention period. But they are stored on the same NAS, so a hardware failure, theft or full admin compromise can take them too. Keep an offline or off-site backup as well, and test restores regularly.
Turn on automatic update checks in DSM or QTS, and check the Synology Security Advisory and QNAP Security Advisories pages. CSA also publishes alerts for critical NAS vulnerabilities, such as its March 2024 alert on a QNAP authentication bypass. Apply critical updates as soon as possible, especially if the NAS is reachable from outside.