Protect your NAS

Martin Jud

20.5.2019

Translation: machine translated

Is your NAS sufficiently protected against a hacker attack? Mine was not. But now I have improved it.

This article will help you to avoid any major blunders when setting up a NAS. The security tips start with the first title. But first a foreword, which is honest but I don't like writing.

I apologise for the storm in a teacup. Due to sudden, persistent speed problems and my IP being published on the Internet by mistake, I was afraid that I had configured it badly and that someone was fiddling with my NAS.

As you can see, my first LAN port only delivers around 350 kilobytes per second, but the second one works as it should.

So my NAS is up and running again. But what gives me pause for thought is that, as I feared, I made some major blunders when configuring it. I actually forgot to redirect two standard ports correctly. This meant that the login pages for the web interface and the Plex server were accessible to interested parties. Ouch - I should be pilloried for that!

If something like this happens to you, don't be surprised if some script kid steals your film database or misuses the CPU of the NAS for coin mining.

NAS and security: you need to think about this

No system offers complete protection against misuse. But if you think about the basics before setting up a home network or NAS, you can protect yourself to a large extent. Take enough time to inform yourself and set up your NAS carefully. Don't get distracted in the process.

Only store data on the NAS that you can bear to lose

Be aware that network scans and attacks are carried out around the clock on the internet. Even if you configure and secure your network hardware well, you will never be able to rule out the possibility of someone accessing your data. Apart from that, a NAS does not serve as a backup medium. All the more reason not to store important files on the NAS. Only store what you can live with if it falls into someone else's hands.

Fundamental security principles: Router and NAS

Before you connect your NAS to the network, you should first take a look at your router. It is the first line of security in your network. You should check/implement the following points. Of course, these also apply to your NAS:

Services and port forwarding: Do not use standardised ports

Port forwarding pitfalls

If you set up your Internet access on a Synology NAS using the wizard or activate a new service, port forwarding is automatically suggested to you.

How to forward ports correctly

The best thing to do is to deactivate UPnP on the router and create the port forwarding manually. You can find out how this works for your router either in the manual or on this page. Of course, if you have not already done so, you must first assign a fixed IP to your NAS. You can also find out how this works on the aforementioned homepage.

Test whether an unwanted port is open

Once you have finished port forwarding, you should test whether a loophole has been left open somewhere. To do this, perform a port scan. You can do this, for example, from this homepage.

Enter your IP and the standardised ports to be scanned and off you go. If you have done everything correctly, you will not receive any feedback from the ports:

Enable SSL, use HTTPS

Encrypted transmission should not only be used for all your NAS services. It should also be used on the network in general. This is because encryption guarantees the authenticity of transmitted data. Thanks to HTTPS, what the server sends to you arrives. This prevents manipulation or man-in-the-middle attacks.

Here is an example of how you can enable SSL for accessing the web interface of a Synology NAS:

1. Enable the option "Automatically redirect HTTP connections to HTTPS" under "Control Panel/Network/DSM Settings".
2. Enter the host name of the NAS and the desired external port under "Control Panel/External Access/Advanced".
3. Configure a port forwarding in which the external port just defined is redirected to the port of the web interface (default is 5001).

Use a VPN

Access via VPN generally has the following advantages:

• Search history, online behaviour, usage patterns and the location of downloads are hidden from your internet service provider.
• If your internet service provider or government blocks/censors certain content on the internet, you can access it again thanks to VPN.
• Geo spoofing allows you to hide your true location and access content that is normally restricted to certain countries

• You can also use a VPN to ensure that your surfing behaviour, logins and data remain hidden even when using a free public WiFi supplier (airport, train station, kebab shop).

You can find instructions on how to set up a VPN on a Synology NAS here.

Is there more?

If you implement the safety tips described above, you should be in a relatively good position. However, not everything is said and done. The topic is so complex that it never hurts to keep researching and rethinking/redefining your own security concept.

In addition to this, there are also rules of behaviour that you should set yourself. For example, you should think carefully about whether and to whom you want to entrust logins for certain services. Only give out access data very carefully. In addition, it is always important to use common sense. If you also use your NAS as a mail server, clicks on suspicious links are of course taboo. Especially if they have been forwarded to your local network.

Want one last tip? Well, I have one more: You can activate notifications on most NAS. For example, a notification by email, which is sent as soon as someone makes a successful or incorrect login attempt.

So, that's the end of the story for now. If you have any other important points that have not been mentioned here, I would be very grateful for your tips. I will also be happy to expand/update the article with them if necessary. <p

Martin Jud

Senior Editor

martin.jud@digitecgalaxus.ch

I find my muse in everything. When I don’t, I draw inspiration from daydreaming. After all, if you dream, you don’t sleep through life.

---

Guide

Practical solutions for everyday problems with technology, household hacks and much more.

Show all

These articles might also interest you