Synology NAS External Access Quick Start Guide
Synology NAS External Access Quick Start Guide
What is external access?
External access is the ability to remotely access your Synology NAS from any device with an internet connection. DSM allows you to easily set up remote access to your Synology NAS, so you can sign in to DSM or other services by simply entering a custom domain name into your web browser. Moreover, if you need to access certain services directly, you can set up port forwarding rules and open specific ports on your NAS for each service.
What methods are available to remotely access my Synology NAS?
This article provides information for the following methods for accessing your Synology NAS.
- Creating a customized ID or address with QuickConnect.
- Setting up a hostname for the IP address of your NAS using DDNS.
- Mapping a port on your router to the IP address of your NAS using port forwarding.
Set up QuickConnect
QuickConnect allows you to connect to DSM over the internet using a customizable ID or address, such as QuickConnect.to/example
(QuickConnect.cn/example
if in China). Refer to this article to see which packages and services support QuickConnect.
Follow the steps below to set up and start using QuickConnect. You can also refer to the respective help articles for DSM 7.0 and DSM 6.2 for more details.
-
Do one of the following according to your DSM version:
- DSM 7.0 and above: Go to Control Panel > External Access > QuickConnect.
- DSM 6.2 and below: Go to Control Panel > QuickConnect.
- Tick the Enable QuickConnect checkbox. If you have not signed in or registered for a Synology Account, click Log in to or register a Synology account.
- Enter your desired QuickConnect ID in the QuickConnect ID field, then tick the By checking here you are agreeing to the Terms of Service and the Privacy Policy checkbox. Click Apply.
- If the specified QuickConnect ID is available, a section should appear displaying your QuickConnect ID and the address where DSM can be accessed.
-
If you want to adjust other options or permissions settings, do one of the following according to your DSM version:
- DSM 7.0 and above: Click the Advanced Settings button.
- DSM 6.2 and below: Go to the Advanced tab.
-
With QuickConnect enabled, you can access DSM services through the following methods:
- Via a computer: Open a web browser and enter your QuickConnect URL (e.g.,
http://QuickConnect.to/example123
orhttp://QuickConnect.cn/example123
). Hit Enter, and you will be redirected to the DSM login screen. -
Via a mobile device:
- Open a Synology mobile app, such as DS file.
- Enter your QuickConnect ID, plus your DSM account and password.
- Click Login.
- Via a computer: Open a web browser and enter your QuickConnect URL (e.g.,
Create a hostname with DDNS
DDNS (Dynamic Domain Name System) simplifies connection to your Synology NAS over the Internet by mapping a hostname, such as example123.synology.me, to its IP address.
Follow the steps below to learn how to access DSM using DDNS. You can also refer to the respective help articles for DSM 7.0 and DSM 6.2 for more details.
Set up a DDNS hostname
- Go to Control Panel > External Access > DDNS.
- Click Add.
- A dialog box will appear, prompting you to edit the following settings:
- Service provider: Select a service provider. To register for a free hostname provided by Synology, choose Synology from the drop-down menu. You can also buy and register a hostname for the IP address of your NAS with a DDNS service provider of your choosing.
- Hostname: Enter a DDNS hostname, such as example123.synology.me.
- Username/Email: If you did not choose Synology for your Service Provider, you will need to enter the username/email for your DDNS provider here.
- Password/Key: If you did not choose Synology for your Service Provider, you will need to enter the password/key for your DDNS provider here.
- External address: If you did not choose Synology for your Service Provider, you will need to enter the external IP address of the Synology NAS which will use the hostname.
- Click Test Connection to check if the settings are correct.
- If you select Synology as the service provider, you can configure the following settings:
- Get a certificate from Let's Encrypt and set it as default: Tick the checkbox to apply a Let's Encrypt SSL certificate for your Synology DDNS and set it as the default certificate for DSM. However, if an SSL certificate is already matched for your DDNS hostname, the checkbox will be disabled. For more information on the SSL certificate, please refer to the respective articles for DSM 7.0 and DSM 6.2.
- Enable Heartbeat: Tick the checkbox to receive alerts regarding the status of the mapped hostname.
- Click OK to save and finish.
- Continue to the next section to set up port forwarding on your NAS.
After the setup is complete, you can access your Synology NAS over the Internet by entering the DDNS hostname in a web browser, followed by a colon and the port number of DSM. The default port number for DSM is 5000 for HTTP and 5001 for HTTPS.
For example, if your DDNS hostname is example123.synology.me and you're using HTTPS, you can type "example123.synology.me:5001" into your web browser to access DSM.
Configure port forwarding
What is port forwarding?
Port forwarding is a technique used to allow external devices to access services on your local network by mapping an external port of the router or gateway to the internal IP address that identifies your NAS. This can be done by setting up port forwarding rules on your NAS.
The IP address is what identifies your NAS, but how can you identify a specific service on your NAS? With a number of services available, such as MailPlus, Surveillance Station, etc., you may want to set up different port forwarding rules and open specific ports for each service that you want to access. This way, you can directly access the service from an external source by using its specific IP address and port number.
To learn which network ports are used by DSM or SRM services, you can refer to the following articles:
Set up port forwarding rules
Before setting up port forwarding rules, make sure that you have administrative privileges to your router. For more information on router configuration for DSM, you can refer to the respective articles for DSM 7.0 and DSM 6.2. Follow the steps below or follow along with this video to set up port forwarding rules.
- Go to Control Panel > External Access > Router Configuration.
- Click Create, then click Set up Router in the window to launch the setup wizard.
-
Click Start in the wizard, and DSM will begin testing several required network settings. There are two types of test results:
- A UPnP router has been detected: Click Next, and you will be directed to a page that shows the information of your router. Click Done to complete the setup.
- No UPnP router has been detected: Click Next, and you will be prompted to manually set up a connection to your router. Enter the router information and click Done to complete the setup.
- Click Create to launch the port forwarding setup wizard.
-
Select one of the setup methods below and follow the instructions provided:
- Built-in application: You can choose one or more built-in applications (e.g., FTP, Web Station, etc.) to be forwarded. Click Done when complete.
- Custom port: You can add a port forwarding rule for custom ports. Define the protocol, local port, and the router port, and then click Done.
- Click Done again on the Router Configuration page to complete the setup process.
Notes:
- If your router is a Synology Router, go to SRM's Network Center > Local Network > General, and select Enabled from the Enable UPnP drop-down menu before setting up port forwarding rules for your Synology NAS.
-
You can use the following syntax to specify port numbers and range:
- Use "-" to describe a port range, e.g., "6881-6890".
- Use "," to separate ports,e.g., "21,22", "21,55536-55663".
- Each port of the gateway router can be used for only one forwarding rule. Using a router port for two or more rules will cause conflicts, and a warning message will appear on the screen. You will need to set another port for the rule to avoid conflicts.
- Some routers do not allow using custom ports for system service forwarding.
Configure your router manually
- If the above method does not work, you will need to sign in directly to your router's management interface. Please consult the instruction manual provided by your router's manufacturer for more information.
- Once you have found the router port forwarding configuration page, refer to this article for a complete list of port numbers used by Synology products' applications and services.
Keep your external connection secure
Enable Auto Block
The auto block feature helps improve the security of your Synology NAS by blocking the IP addresses of clients with too many failed login attempts. This helps reduce the risk of your accounts being broken into by brute-force attacks.
To learn how to enable auto block and add IP addresses to your Allow List, refer to the respective help articles for DSM 7.0 and DSM 6.2.
Enable Account Protection
Account Protection protects your Synology NAS accounts from untrusted clients that have too many failed login attempts. This helps to minimize the risk of brute-force attacks to your accounts.
To learn how to enable account protection, refer to the respective help articles for DSM 7.0 and DSM 6.2.
Enable HTTPS
A certificate can be used to secure SSL services on your Synology NAS, such as web (all HTTPS services), mail, or FTP. Having a certificate allows users to validate the identity of a server and the administrator before sending out any confidential information. Synology offers a free and secure SSL/TLS certificate from Let's Encrypt.
To learn how to get a Let's Encrypt certificate on your Synology NAS, refer to this article.
Enable Firewall
Similar to a PC, your Synology NAS also has a built-in firewall. Enabling firewall, creating firewall rules, and configuring firewall settings can help prevent unauthorized login and control service access. You can also choose to allow or deny access to certain network ports from specific IP addresses.
To learn how enable the firewall and create firewall rules, refer to this article.
Further reading
Related articles
- What are the differences between QuickConnect and DDNS?
- How do I change the QuickConnect ID for my Synology NAS?
- My Synology NAS is using a VPN connection. Can I connect to it via DDNS?
- How do I set up port forwarding rules on my Synology Router?
- How do I customize the alias, port, or domain for specific Synology services?
- For more tutorials, FAQ's, and other articles related to QuickConnect, DDNS, and port forwarding, you can visit this page.