In this tutorial I’ll explain the inherent risk of exposing your QNAP to the internet and how we can establish a setup secure enough to be able to connect and manage our unit from outside our LAN with minimal risk.
DISCLAIMER: Zero risk doesn’t exist. While there are different security grades depending on your setup, it is impossible to be 100% safe when your unit is connected to the internet.
If you need 100% security, follow these steps:
-
Turn off your unit
-
Unplug any attached cable, including power connection
-
Your QNAP is now 100% safe against remote attacks
DISCLAIMER 2: I’m not computer expert. What I say here is an oversimplification, so people not too tech savvy can understand. Please, don’t laugh too much at me.
First, some basics (you can skip to the setting tutorial at the end if you don’t care about “why” and only want to know “how”)
What does “to expose the NAS” means?
Your unit needs network connection to perform tasks, be them download, browse, connect to other computers, etc. Inside your LAN, usually any computer is directly accessible to any other computer, because your local network is considered “safe”. If your Raspberry Pi wants to access a Jellyfin server running in another computer, there is no reason to deny it, as we assume that the Pi will not be a malicious computer.
But outside your LAN (the internet) there are malicious actors, and so, your router needs to separate outside (WAN) from inside (LAN) and will, by default, negate access to any computer in your LAN to any inbound connection from WAN, while, at same time, allowing response from outside servers to reach the questions your computers make.
It goes more or less like this:
Computer A inside LAN wants to get a .jpg from server B in WAN, so it sends to your router a request. Router sends the request to server B, and it sends back an answer with the .jpg file to your router. Your router receives that connection, and since it’s a followup from a previous request from computer A, it allows the connection to reach computer A. Computer A shows the .jpg file.
But, if Server B directly sends a connection with .jpg file to your router that was not preceded by a question from computer A, your router do not know what to do with it, and blocks it.
By default, if you give internet access to your QNAP, you are not “exposing” it to WAN, because any random connection originated from WAN will not reach it. To expose it, you have to actively perform port forwarding on your router.
What is port forwarding
Port forwarding means redirecting inbound connections to specific ports originated from WAN into specific IP addresses inside your LAN.
Server B sends a connection request to your router in port “8000”. Your router gets that connection, and if you opened (port forwarded) port 8000 to IP 192.168.1.200 (computer A), then it will “forward” that connection to port 8000 on computer A, allowing server B to directly reach computer A.
Port forwarding exposes your computer to internet, and bad things can happen. You don’t usually expose “all ports” to internet, but specific ports, usually corresponding to services running in your NAS.
If you have Jellyfin server running on port 8096, Deluge on port 9000, and Jdownloader on port 5000, and you want to access them from any computer outside your LAN (the internet) then you can simply port forward those ports to your NAS, and any connection to your public IP (router) on port 8096, 9000 and 5000 will reach your NAS.
Easy, isn’t it?
OK, DON’T DO THIS
That would allow ANY computer to access those services running on your NAS. That is the way attackers (please, don’t say “hackers”) can reach your services and use them to invade your computer.
Let me stress this a little more: DO.NOT.OPEN.PORTS.TO.YOUR.NAS
If you do, you deserve what happens to your NAS.
Now, go to your QNAP ASAP and disable: MyQNAPcloud, and UPnP. Those are also security risk.
So, if I don’t open ports, I’m pretty safe, but it this will not allow me to access my services from internet, right
YES. This is the safest possible choice.
But I want to access my NAS or services from internet
Ok, then keep reading.
My service (insert here QTS, Plex, Jellyfin, Deluge, etc etc etc) is protected with a 64 digit password and 2FA. No one is going ever to guess my password
It’s not a matter of guessing or bruteforcing passwords. There are ways to gain access to any software bypassing login. Those are called vulnerabilities, and include a full array of techniques, including code injection, exploits, buffer overflow, bugs, and lots of other techniques. Vulnerabilities are often patched when published, but until they are (those are called 0-days or near-days) they can be very dangerous.
Wait, wait, wait, wait. So you are saying that there are/have been vulnerabilities in QNAP OS (QTS) that might allow attackers to gain access to my unit?
Mmmm…
Yes, a couple of them, maybe?
But those are old/outdated vulnerabilities
Yes, but vulnerabilities are always being discovered, and some never even get reported. Don’t push your luck.
I’m using myQNAPCloud, I’m safe?
No. myQNAPCloud just acts forwarding requests to your NAS through their severs. If you can reach QTS, you can exploit it. Disable MyQNAPCloud. NOW. Also, disable UPnP.
This only applies to QTS? Should I still port forward my other services (Plex, Jellyfin, Deluge, etc)?
This applies to every single service. More services available means more attack surface, just the same way that it is easier to penetrate a computer with SSH, FTP, Apache, MySQL, VNC services enables than a computer with only SSH enabled. As more services are reachable, chances of finding an unpatched vulnerability increase.
There are, of course, services more secure than others. Nexcloud instance will be much more secure than QTS (mainly because the FOSS nature of nextcloud), but why should you take the risk?
Those services are being run into a docker container // Virtual Machine, so, even if they are penetrated, they will not reach my unit’s OS
While it is true that container or virtualization add an extra layer of security, because in case of service breaching, attacker would find itself contained inside the container, not in the main OS, it is not impossible to escape a container or VM.
So, again, less attack surface means safer.
Fear not, there are ways to securely (mostly) access all your services that does not involve port forwarding all your services. One example could be using a reverse proxy like Nginx, but I sincerely lack the required network knowledge for this. So, as an alternative, I will teach (or at least try to) you how to access your services using a VPN server.
VPN stands for Virtual Private Network, and it’s just a way to create an encrypted tunnel between two computers.
You might have read about VPNs as a way to bypass network control (PIA, nordVPN, protonVPN, etc). Those are services that you pay for and allow to encrypt your connection from your computer to their servers, making difficult any data monitoring that exist in between. Well, this is the same, but instead of paying to connect to some random servers outside, you will connect to your NAS. The magic about this is, once you establish a VPN connection between a computer and your NAS, since your NAS is inside your LAN, you will have access to any other computer or service in your LAN. It is essentially, as if you were inside your house, connected to your WiFi.
Isn’t this wonderful? 
Any computer inside your LAN can act as VPN server (Raspberry Pi, Desktop PC, Router, NAS…) but not everyone has a Raspberry Pi laying around, or a router able to perform VPN server functions (usually, routers work the best for this, as they are specifically designed for this task, but low grade commercial models don’t allow this, so I will skip this). I will teach you how to configure your QNAP to act as VPN server using OpenVPN protocol. There are other protocols, like PPTP or L2TP/IPSec, but the most secure is OpenVPN, and this is the one we are going to use.
GUIDE STARTS HERE
This guide is based on this document available at QNAP
In first place, ensure you have QVPN installed in your QNAP. This is the software we are going to use in this tutorial.
Select the OpenVPN tab on the left side, and click “Enable OpenVPN server”. Now let’s configure:
- On VPN client IP Pool, select range 10.8.0.2 - 10.8.0.254. This is the subnet IP ranges you will be assigned when you connect.
- Server port: Select UDP, and whatever port you want to use, for example 33666
- Maximum number of clients: Select the max number of clients you want to connect simultaneously. i.e. 5
- Encryption: You can choose either AES 128 or 256 bit. 256 bit is more secure in case someone is snooping your connection and tries to decipher it (like a MITM attack), but it consumes more resources. Generally speaking, 128 bit is more than enough.
- Network interface: Select All
- DNS server: Whatever you want or leave it blank
- Check “use this connection as default gateway for remote devices” and “enable compressed VPN link”
- Then Apply changes.
- Click on “Download configuration files”. You will be prompted to save an .ovpn file. Save it. If you are curious, you can open it (it is a text file). You can edit the OpenVPN settings here. Note the “remote XXX.XXX.XXX.XXX 33666” line, were XXX is your public IP, and 33666 is the selected port. You can change this if your public IP changes. If you have dynamic IP, you want to put here your DDNS server, like this: “remote qnaptest.duckdns.org 33666”
Now, Go to privilege Settings tab (just under OpenVPN). There, you will see your QNAP users. Choose what users you want to enable access to the VPN server and check OpenVPN for those users. Apply.
Congrats. You got it
To be able to access your VPN service, you need to port forward the openVPN server port in your router. In this case, the target IP would be your NAS IP, and the port would be 33666. Each router configures differently, just search for your specific model’s instruction. Don’t worry, you are not exposing your full QNAP to internet, just a single port.
Now all that is left is to configure the OpenVPN client in the computers you want to be able to access to your VPN. You can download the OpenVPN client here:
- Windows
- Mac (I have not tested this one)
- Android
- Most Linux like Ubuntu and Mint have integrated VPN client, but if not, you can install it with the classic “apt-get install openvpn” CLI.
Install the software OpenVPN GUI. Create a new connection using the .ovpn file you downloaded before: Right click, Import File (the .ovpn file you saved before), Chose Connect and fill in user login and password. Establish connection. If everything went OK, you will now be connected securely to your QNAP. Now open browser and try to access QTS and your services as if you were inside your LAN and see if it works.
Now, each time you want to access your QNAP for anything (watch a movie, download a file, manage QTS, manage torrents, etc) just connect using OpenVPN, and you will be able to safely access.
You said that opening ports is bad, and that there is no way to be totally safe
Yes. You will be more safe if you can’t access your unit from WAN. But we are doing a compromise here. OpenVPN is a secure, Open Source protocol, that will provide you enough security while at same time allowing to access every single service on your QNAP opening a single port, in which is running a secure service (OpenVPN).
If you want to access your QNAP from internet, this, is the best you can do, and the only advisable way to do this. It is more uncomfortable that opening ports, but it is more secure. It is totally worth the effort.
That is all. I’ll be linking this tutorial in the wiki. Corrections and suggestions are welcomed.
Stay safe, folks.
Your opinion is pretty respectable.