QuickConnect vs a VPN - Reaching Your Synology From Away

Why You'd Want to Reach Your NAS From Away

A NAS you can only touch at home is still useful. But being able to reach it from anywhere turns it into your own private cloud - and you own it, with no monthly fee to a big company.

In other words, your files travel with you, but they live safely at home under your control. The whole point of this guide is to give you that convenience without opening a door to strangers.

• Pull up a photo or document while you are out, straight from your own NAS.
• Share a big file with family without emailing it or paying a service.
• Check that a backup or download finished while you are traveling.
• Let a family member reach shared files without them driving over.

The Risky Old Way: Opening Ports

For years, the way to reach a device at home from the internet was to open a door in your router - called port forwarding - pointing straight at that device. For a NAS, this is a bad idea, and here is why.

Your router normally keeps the outside world out, like a locked front door. Port forwarding drills a permanent hole in that door and points it right at your NAS. Anyone on the internet can then knock on that hole - and there are automated programs that knock on every home, all day long, looking for a way in.

• It exposes your NAS login screen to the entire internet.
• Attackers run programs that guess passwords around the clock.
• A single weak password or an out-of-date NAS can lead to a break-in.
• This is how many NAS ransomware attacks have happened.

What QuickConnect Is

QuickConnect is Synology's own free service that lets you reach your NAS from away without touching your router at all. It is the friendliest safe option, and it is what I set up for most home users.

Instead of opening a hole in your router, your NAS quietly checks in with Synology's service. When you want to reach it from away, you connect through Synology, which acts as a trusted go-between - a relay - and passes you through to your NAS. No permanent open door, and nothing exposed to strangers scanning the internet.

• No router setup - it works around the router safely.
• You reach your NAS with a simple name, not a string of numbers.
• It works hand in hand with the Synology mobile apps.
• It is free and built into DSM.

Setting Up QuickConnect

Turning on QuickConnect takes just a few minutes in DSM. You do it once, and then you can reach your NAS from anywhere.

That is the whole setup. Notice what you did not do: you never touched your router, and you never opened any ports. That is exactly why QuickConnect is the safe choice.

• Log in to DSM on your NAS from a web browser at home.
• Open Control Panel, then look for QuickConnect.
• Sign in with a Synology account, or make a free one if you do not have it.
• Turn on the Enable QuickConnect switch.
• Choose a QuickConnect ID - a simple name you will remember.
• Save. Your NAS is now reachable from away through that name.

Your QuickConnect ID and the Mobile Apps

Once QuickConnect is on, Synology's mobile apps are the easiest way to reach your NAS from your phone or tablet. Each app does one job, and they all sign in with your QuickConnect ID.

To sign in, you open the app, type your QuickConnect ID, then your NAS user name and password. The app finds your NAS through Synology's relay - no numbers to type, no router to configure.

The Pros and Cons of QuickConnect

QuickConnect is my go-to for home users, but it is fair to know both its strengths and its limits before you lean on it.

• Very easy to set up - no router knowledge needed.
• Safe by design - no ports opened to the internet.
• Free, and works smoothly with the mobile apps.
• Uses a friendly name instead of hard-to-remember numbers.

What a VPN Is, in Plain Words

VPN stands for Virtual Private Network. It sounds technical, but the idea is simple: a VPN builds a private, locked tunnel between your phone or laptop and your home network.

When you connect to your home VPN from away, it is as if you ran a private, sealed pipe from wherever you are all the way back to your house. Once you are in that tunnel, your device behaves as though it is sitting at home on your own network - able to reach the NAS and other devices safely, with everything inside the tunnel scrambled so no one can peek.

• It is private - the connection is encrypted end to end.
• It puts you "on your home network" from anywhere.
• It can reach not just the NAS but other home devices too.
• Nothing is exposed to random strangers on the internet.

The Synology VPN Server Package

Your Synology can act as the home end of that tunnel itself, using a free add-on called VPN Server. You install it from Synology's own Package Center, right inside DSM.

VPN Server is a package - think of it as an app for your NAS - that lets your NAS accept private tunnel connections from your devices when you are away. Once it is set up, your phone or laptop can dial into your home and reach everything safely.

• Open Package Center in DSM.
• Search for VPN Server and install it.
• It supports a few tunnel types; a common friendly choice is OpenVPN.
• You turn on the type you want and create logins for the people who may connect.

Setting Up a VPN, at a High Level

You do not need every technical detail to understand the shape of it. Here is the big picture, so nothing feels mysterious when you set it up or watch me do it.

Unlike the risky old method, a VPN opens only a single, locked tunnel - not your NAS login screen. That is a world of difference in safety.

• Install VPN Server on the NAS from Package Center.
• Choose a tunnel type - OpenVPN is a common, well-trusted choice.
• Create a login for each person who will connect from away.
• Set your router to send that one tunnel type through to the NAS - this is the one careful bit of router setup.
• Give your home a friendly name with DDNS so you can find it from away.
• Install the matching VPN app on your phone or laptop and connect with your login.

DDNS: A Friendly Name for Your Home

Your home internet has an address, but your provider can change it without warning. DDNS gives your home a steady, friendly name that always points to it - even when the underlying address changes.

Imagine your home's internet address is a phone number that your provider occasionally reassigns. DDNS is like a name in a phone book that automatically updates to the new number, so you can always reach home by name. Synology offers its own free DDNS name that ends in synology.me.

• It gives your home a name that does not change.
• It updates itself when your provider changes your address.
• It is set up in DSM, under the External Access settings.
• QuickConnect users often do not need it; VPN users usually do.

HTTPS and Reverse Proxy, in Brief

These two terms sound intimidating, but they are just safety habits. You do not have to master them - only know what they are for.

HTTPS is the encrypted version of a web connection - the padlock you see in a browser. It scrambles what travels between you and your NAS so no one can read it along the way. Your Synology can get a free security certificate to turn this on, and you should always use HTTPS rather than plain, unlocked connections.

Which to Choose: A Comparison

Both QuickConnect and a VPN are safe when set up well. The right one depends on how much you need and how much setup you want. Here is a plain side-by-side.

For most people reading this, QuickConnect with two-factor sign-in is plenty. If you want a full private tunnel into your home network, or you run a small business with more at stake, a VPN is worth the extra setup.

Always Turn On Two-Factor Sign-In

This one setting does more to keep your NAS safe than almost anything else, no matter which access method you choose. Please do not skip it.

Two-factor sign-in means that after your password, you also enter a short code from an app on your phone. Even if a thief somehow learns your password, they cannot get in without your phone in their hand. It closes the door that password guessing tries to open.

• In DSM, open your personal account settings.
• Find the 2-Factor Authentication or security section.
• Follow the steps to link an authenticator app on your phone.
• Keep the backup codes it gives you somewhere safe.

Keep DSM and Packages Updated

Software updates are not just about new features. Most of them quietly close security holes that attackers have learned to use. An out-of-date NAS is a favorite target.

You can set DSM to install important updates automatically, which is the easiest way to stay protected. Check now and then that updates are actually being applied, so nothing falls behind quietly.

• DSM itself - the main system software on your NAS.
• Your installed packages - the add-ons like Photos, VPN Server, and others.
• The mobile apps on your phone or tablet.

Turn Off Services and the Admin Account You Don't Use

Every service running on your NAS is another door that has to be guarded. The fewer doors, the less there is to protect. A tidy NAS is a safer NAS.

Disabling the built-in admin account is a big, simple win. Attackers guess against that exact name constantly. If it does not exist to sign in to, all that guessing hits a wall.

• Turn off file-sharing services and packages you never actually use.
• Disable the default admin account - it is the first name every attacker tries.
• Instead, use your own named account that has administrator rights.
• Review who has accounts, and remove any that are no longer needed.

Using Synology C2 and the Relay

Synology also offers its own cloud services, gathered under the name C2, along with the relay that makes QuickConnect work. It helps to know what these are so the names do not confuse you.

These are optional. QuickConnect and its relay are free and cover remote access. C2 is worth a look if you want a professional offsite backup without setting one up yourself.

• The QuickConnect relay is the go-between service that passes your connection through to your NAS without opening your router.
• Synology C2 is a family of paid cloud services, such as C2 Backup, that store an offsite copy of your data on Synology's servers.
• C2 can give you the offsite backup that a home NAS by itself does not have.

Giving Family Safe Access

One of the joys of a NAS is sharing it with family. You can let them reach shared files from away without handing over the keys to everything. The trick is to give each person their own limited account.

This way, each person reaches only what you intend, and you can remove any account instantly if a phone is lost or a person no longer needs access. Nobody shares one password, which is always a mistake.

• Make a separate NAS user account for each family member.
• Give each account access only to the folders they should see.
• Have them use the mobile apps with their own login and QuickConnect.
• Ask them to turn on two-factor sign-in on their account too.

A Safe Remote-Access Checklist

Here is everything from this guide, gathered into one simple checklist. Work down the list and you will have safe, convenient access to your NAS from anywhere.

• Use QuickConnect (or a VPN) - never port-forward DSM to the internet.
• Turn on two-factor sign-in for every account.
• Disable the default admin account and use your own named admin account.
• Keep DSM, packages, and the mobile apps updated.
• Turn off services and packages you do not use.
• Always use HTTPS and look for the padlock.

What's in the 27-page PDF

• Why reaching your NAS from away is so handy
• The risky old way, and why you should never use it
• QuickConnect: what it is and how to turn it on
• A VPN: what it is and how it protects you
• A plain comparison to help you choose
• The safety basics that matter more than either choice

Why I wrote this

I write these as printable handouts because a guide you can keep in a drawer beats a web page you have to find again. No jargon, no judgment, no rushing. If you'd rather have someone sit beside you and go through it together, that's a flat $99 first visit with the 30-day follow-up included — serving Portage County from Atwater, Ohio. — Bill