On Tailscale, one point needs clarification. You can have more than 3 users as long as no more than 3 are connected at any given time. I have 7 devices registered with Tailscale, each with their own IP address but everything still works fine. Great video Frank.
Honestly DDNS with reverse proxy and restrictive FW and 2FA seems like the best way, for most people, at least if serving several family members or friends etc. Been doing that for years, and never had any (logged) unauthorized access attempts. One has to be able to manage router, have a public IP and also be fairly tech savvy ofc. Just IMHO.
Thx, for your films. I’ve watched most synology films I could find. Yours are incomparable to the one British guy or Rex something.. I found plenty brilliant and straight forward information here. Good luck with your channel! I hope will get the most followers from the synology and networking community.
Your vids and website have always been a huge help, but man am I'm loving this new format! I'm not sure if it's the way they're put together or just being able to actually see you talk, probably both, but these new vids seriously are making things click that I've struggled with for the past 4 years of using my Synology. Really appreciate it!
Hey mate, I currently use an SSH tunnel to access a remote PC through RDC. I was wondering if there was a way to apply the same tunnel but to access specific NAS folders rather than use a VPN. I'd be using public key authentication to eliminate brute force attacks. My aim is to remove remote access to my DSM and restrict it to direct access to NAS folders. Any pointers?
I have a WireGuard set up in a docker container on my 923+, with my Emby media server as its own container as well. I have created a synology domain theough the wireguard which ive been using to connect externally through an http url. It works, but i fear I've inadvertently combined half of the procedures mentioned here but left myself somewhat exposed from a security perspective. Problem is, it's all new to me so troubleshooting is difficult, not sure how to check if ive set all this up properly.
OpenVPN is generally slower than WireGuard (which is the underlying technology behind Tailscale), but I guess it depends how big of a difference you're seeing. Some loss is expected - a ton might indicate a problem.
Very good explanations for what is usually difficult to grasp material. Quick question: do you think it would be worth it to have a second Synology just for sharing purposes? And put that Synology on a DMZ instead of on the proper LAN? My thought is that it’s less likely an attacker will get into the LAN if the DMZ is isolated enough.
Thank you! That's a tough one. From the perspective of a "most secure" setup where you're still exposing a device, that is probably the "best" way to do it, but there are other ways that would probably be a lot cheaper (from a device perspective). Another way to do it would be to set up a DMZ as a VLAN, run Virtual DSM in VMM on your NAS and assign that vDSM instance to the DMZ VLAN. Still not as secure as an entirely separate device and VLAN hopping would be a separate concern (with a VLAN DMZ), but the cost of two Synology devices for the simple task of file sharing is a tough sell.
Thanks for the detailed explanation. I have a stupid question! I access my NAS usually through my local network by adding the address to my networks and browsing the files as I would usually with my local files on my computer. Which one of these ways provide the same experience? I know that with all of these I get access to DSM. But then I need to download every file to my local computer to read it ! Thanks for your time again
When you say that, do you mean that you navigate through the files with a mapped network drive? If so, a VPN would be the same experience, but you would have to connect to the VPN first. So when you're remote, the process would be [Connect to VPN > Access Mapped Network Drive]. When you're home, you'd just skip the "Connect to VPN" step. Other than that, it would work the same!
Use tailscale and then map a network drive to the volume you want shared. Change user permissions on your local system based on what you want shared or not
I use reverse proxy, my family can just go to files.domain or photos.domain to access what they need, no app required. Have 2fa, synology and cloudflare firewall, admin disabled, custom ports, etc and like you said would have to know my domain so feel pretty secure. No doubt tailscale would be better but this is easiest for my family.
Great job! I understood that for a NAS under CGNAT the best among the 5 options would be Tailscale. Considering the Plex server as the main demand and the limitation of some TVs in using Tailscale, what is the best option? Can IPV6 change the scenario? Under IPV6 would reverse proxy work?
@@Azaccaro The options are unfortunately limited. A Cloudflare tunnel would be great but Plex is against their terms of service. I'm not sure exactly how you can do it if a zero-config VPN and port forwarding isn't an option unfortunately.
Thanks for the video. Hmm I want to use my synology as a vpn service(working remotely from a cafe). Would tailscale be the right choice. I hear devices can act as end points.
It's hard to say what the right choice is because it depends on many factors. Generally, Tailscale is a great and easy-to-use VPN and if none of the downsides of it (Tailscale accounts, requirement on their servers, etc) are a problem, it's a great option. With that said, it's really up to you!
I think Cloudflare tunnels are great and I'm a huge fan of Cloudflare in general. I prefer a VPN for self-hosting, but as long as you're not breaking the TOS of Cloudflare (streaming a media server, etc), and you're aware of how it works (and are okay with it), it's a great option!
What would be the best remote access option to share a Plex server with friends and family? I've set up Synology firewall to limit access to local IP addresses and port forwarded on my router and in Plex. However I still encounter remote access problem (probably due to Xfinity "Advanced Security" feature). Was looking for an alternative that doesn't require the client to setup VPN
It sounds like the firewall rule might be causing the issue. If you disable the firewall temporarily, does it work? As for the "best", honestly, this is probably the best you're going to get. I have used reverse proxies in the past with Jellyfin and Plex, but Jellyfin handles it much better than Plex does. I had an old video that showed how it worked for Plex with a reverse proxy but I think it broke at some point along the way.
Cloudflare Tunnel run slow. I like Reverse proxy is fast but it do not support automatic transfer http to https. You must type https on browser address
I think Cloudflare Tunnels are great. You're just introducing a middle-man into it (just like Synology QuickConnect). If you trust Cloudflare (which I do, but everyone should make that determination themselves), it's a great option!
Thanks for the great video. Is there a way to use like site to site vpn? I mean if i want to backup my synology device to remote synology, without firewall device can i configure it on the both synology device?
Thanks! You can configure a site-to-site VPN, but if you only want to connect Synology NAS 1 and 2, you can use OpenVPN on one of them to connect to the other. This would allow both to be connected without having to configure both networks for a S2S VPN.
Can you do a detailed video around Tailscale. When I tried to set it up, I could either connect to the Internet or local network. Not both at the same time. I use pihole so local network is routed through that, so I'm unsure if Tailscale connection is trying to also route through the local pihole ip which it cannot reach.
Here you go! www.wundertech.net/how-to-set-up-tailscale-on-a-synology-nas/ There are a lot of things that might be, but quickly run through the tutorial and see if you have any questions after. I didn't run into that issue.
My setup is weird, but it works for me. I access my LAN through Tailscale. The DDNS on my NAS points to its Tailscale IP address. So externally I can resolve my FQDN, but it is not reachable for anyone else. Then I also have a reverse proxy that redirects me to all the services I host on the NAS. The main reason for that is I wanted to be able to access services using a memorable name and not via IP and ports. And without setting up an internal DNS. The only caveat is that if I want to access these services from a device on the LAN that is not on the Tailscale network, I have to manage the entries in the host file on that device.
Wish there were an option to disable Synology's applications all together and just run them through reverse proxies instead. Now they're tied to DSM rules and I do not necessarily want DSM-rules to Note Station or Surveillance Station.
This is great news since I am trying to share a specific folder for business, but don't want to burden my family members who want to access my plex server
![[Full] 4 ต่อ 4 Celebrity EP.922 | 10 พ.ย. 67 | one31](http://i.ytimg.com/vi/zmV5HRIxIBI/mqdefault.jpg)
On Tailscale, one point needs clarification. You can have more than 3 users as long as no more than 3 are connected at any given time. I have 7 devices registered with Tailscale, each with their own IP address but everything still works fine.
Great video Frank.
Thank you and great point! Could have definitely been clearer on that, so I appreciate you clarifying!
Honestly DDNS with reverse proxy and restrictive FW and 2FA seems like the best way, for most people, at least if serving several family members or friends etc. Been doing that for years, and never had any (logged) unauthorized access attempts. One has to be able to manage router, have a public IP and also be fairly tech savvy ofc. Just IMHO.
Thx, for your films. I’ve watched most synology films I could find. Yours are incomparable to the one British guy or Rex something.. I found plenty brilliant and straight forward information here. Good luck with your channel! I hope will get the most followers from the synology and networking community.
Your vids and website have always been a huge help, but man am I'm loving this new format! I'm not sure if it's the way they're put together or just being able to actually see you talk, probably both, but these new vids seriously are making things click that I've struggled with for the past 4 years of using my Synology. Really appreciate it!
That's awesome to hear! I really appreciate the kind words, thank you very much!
Hey mate, I currently use an SSH tunnel to access a remote PC through RDC. I was wondering if there was a way to apply the same tunnel but to access specific NAS folders rather than use a VPN. I'd be using public key authentication to eliminate brute force attacks. My aim is to remove remote access to my DSM and restrict it to direct access to NAS folders. Any pointers?
I have a WireGuard set up in a docker container on my 923+, with my Emby media server as its own container as well. I have created a synology domain theough the wireguard which ive been using to connect externally through an http url. It works, but i fear I've inadvertently combined half of the procedures mentioned here but left myself somewhat exposed from a security perspective. Problem is, it's all new to me so troubleshooting is difficult, not sure how to check if ive set all this up properly.
Hello, thanks for your videos. They helped me to setup my NAS, but I have a question. Why didn't you say anything about WebDAV?
Very idea triggering after learning from your video on this. Thx!
With the reverse proxy approach would you be able to map a network drive using the HostName used?
No, you can't unfortunately. You'd have to use WebDAV, but preferably, I'd recommend a VPN instead.
Do you know why openvpn self hosted seems to be ways slower than tailscale when it's about uploading \ dowloading files?
OpenVPN is generally slower than WireGuard (which is the underlying technology behind Tailscale), but I guess it depends how big of a difference you're seeing. Some loss is expected - a ton might indicate a problem.
Very good explanations for what is usually difficult to grasp material. Quick question: do you think it would be worth it to have a second Synology just for sharing purposes? And put that Synology on a DMZ instead of on the proper LAN? My thought is that it’s less likely an attacker will get into the LAN if the DMZ is isolated enough.
Thank you! That's a tough one. From the perspective of a "most secure" setup where you're still exposing a device, that is probably the "best" way to do it, but there are other ways that would probably be a lot cheaper (from a device perspective).
Another way to do it would be to set up a DMZ as a VLAN, run Virtual DSM in VMM on your NAS and assign that vDSM instance to the DMZ VLAN. Still not as secure as an entirely separate device and VLAN hopping would be a separate concern (with a VLAN DMZ), but the cost of two Synology devices for the simple task of file sharing is a tough sell.
Absolutely phenomenal video Frank. Enjoyed every minute of it.
Thank you so much, Tony! I appreciate you watching!
Thanks for the video after reading all your wonderful guides. Having a router with WireGuard am I still protected?
Yes, that's a great option to connect home!
Fantastic explanation. Best I've found online yet.
Thanks for the detailed explanation.
I have a stupid question! I access my NAS usually through my local network by adding the address to my networks and browsing the files as I would usually with my local files on my computer.
Which one of these ways provide the same experience? I know that with all of these I get access to DSM. But then I need to download every file to my local computer to read it !
Thanks for your time again
When you say that, do you mean that you navigate through the files with a mapped network drive? If so, a VPN would be the same experience, but you would have to connect to the VPN first.
So when you're remote, the process would be [Connect to VPN > Access Mapped Network Drive]. When you're home, you'd just skip the "Connect to VPN" step. Other than that, it would work the same!
Which sharing protocol would allow me to share only ONE of my volumes? Or, specific folders? It seems I have to share all, or nothing.
Use tailscale and then map a network drive to the volume you want shared. Change user permissions on your local system based on what you want shared or not
I use reverse proxy, my family can just go to files.domain or photos.domain to access what they need, no app required. Have 2fa, synology and cloudflare firewall, admin disabled, custom ports, etc and like you said would have to know my domain so feel pretty secure. No doubt tailscale would be better but this is easiest for my family.
Great job!
I understood that for a NAS under CGNAT the best among the 5 options would be Tailscale. Considering the Plex server as the main demand and the limitation of some TVs in using Tailscale, what is the best option?
Can IPV6 change the scenario? Under IPV6 would reverse proxy work?
Thanks! If it's just for Plex, I'd recommend taking a look at this: support.plex.tv/articles/216766168-accessing-a-server-through-relay/
@@WunderTechTutorials Thanks! but using relay the maximum speed is too low thats limiit the resolution.
@@Azaccaro The options are unfortunately limited. A Cloudflare tunnel would be great but Plex is against their terms of service. I'm not sure exactly how you can do it if a zero-config VPN and port forwarding isn't an option unfortunately.
Thanks for the video. Hmm I want to use my synology as a vpn service(working remotely from a cafe). Would tailscale be the right choice. I hear devices can act as end points.
It's hard to say what the right choice is because it depends on many factors. Generally, Tailscale is a great and easy-to-use VPN and if none of the downsides of it (Tailscale accounts, requirement on their servers, etc) are a problem, it's a great option. With that said, it's really up to you!
Very well done. This is just what I was looking for. Trying to learn....
Thanks for the video. But just yes Cloudflare Zero-Trust. No port forwarding. Manage scope. The best firewall. Just amazing.
Thanks for your videos, one can learn a lot from them. You didn't mention anything about Cloudflare Tunnel, are you against this solution?
I think Cloudflare tunnels are great and I'm a huge fan of Cloudflare in general. I prefer a VPN for self-hosting, but as long as you're not breaking the TOS of Cloudflare (streaming a media server, etc), and you're aware of how it works (and are okay with it), it's a great option!
What would be the best remote access option to share a Plex server with friends and family? I've set up Synology firewall to limit access to local IP addresses and port forwarded on my router and in Plex. However I still encounter remote access problem (probably due to Xfinity "Advanced Security" feature). Was looking for an alternative that doesn't require the client to setup VPN
It sounds like the firewall rule might be causing the issue. If you disable the firewall temporarily, does it work? As for the "best", honestly, this is probably the best you're going to get. I have used reverse proxies in the past with Jellyfin and Plex, but Jellyfin handles it much better than Plex does. I had an old video that showed how it worked for Plex with a reverse proxy but I think it broke at some point along the way.
Cloudflare Tunnel run slow. I like Reverse proxy is fast but it do not support automatic transfer http to https. You must type https on browser address
Yes, but using links and/or bookmarks takes care of that.
I cant wait to checkout the tailscale video. Could never get OpenVPN to work well for me
Here you go! Tailscale has generally worked very well for me. www.wundertech.net/how-to-set-up-tailscale-on-a-synology-nas/
I've been admiring the PC in the background for some time now. Would you mind sharing what kind of case and rgb components it is?
Thank you very much!! Yes, everything is listed here: www.wundertech.net/pc-and-av-setup/
Amazing video. High quality information. Thank you
Thank you very much!
Do you not consider Cloudflare tunnel a viable access method?
I think Cloudflare Tunnels are great. You're just introducing a middle-man into it (just like Synology QuickConnect). If you trust Cloudflare (which I do, but everyone should make that determination themselves), it's a great option!
Thanks for the great video. Is there a way to use like site to site vpn? I mean if i want to backup my synology device to remote synology, without firewall device can i configure it on the both synology device?
Thanks! You can configure a site-to-site VPN, but if you only want to connect Synology NAS 1 and 2, you can use OpenVPN on one of them to connect to the other. This would allow both to be connected without having to configure both networks for a S2S VPN.
@@WunderTechTutorials Sounds good! Honestly if you can share a tutorial with us could be great! Maybe a video :)
Thks
PS: I can use these strategies when my synology NAS finally go-out of its 5year warranty ;)
Can you do a detailed video around Tailscale. When I tried to set it up, I could either connect to the Internet or local network. Not both at the same time. I use pihole so local network is routed through that, so I'm unsure if Tailscale connection is trying to also route through the local pihole ip which it cannot reach.
Here you go! www.wundertech.net/how-to-set-up-tailscale-on-a-synology-nas/
There are a lot of things that might be, but quickly run through the tutorial and see if you have any questions after. I didn't run into that issue.
@@WunderTechTutorials will check it out. Thanks
My setup is weird, but it works for me. I access my LAN through Tailscale. The DDNS on my NAS points to its Tailscale IP address. So externally I can resolve my FQDN, but it is not reachable for anyone else. Then I also have a reverse proxy that redirects me to all the services I host on the NAS. The main reason for that is I wanted to be able to access services using a memorable name and not via IP and ports. And without setting up an internal DNS. The only caveat is that if I want to access these services from a device on the LAN that is not on the Tailscale network, I have to manage the entries in the host file on that device.
Very cool way of approaching it!
If I am using the NAS strictly for surveillance station, is a VPN still the best option?
Yes, you'll just have to connect to the VPN first, and then access the SSS.
Wish there were an option to disable Synology's applications all together and just run them through reverse proxies instead. Now they're tied to DSM rules and I do not necessarily want DSM-rules to Note Station or Surveillance Station.
Brill vid thank you
Great
I use openVpn on my synolgy and plex. My users do not need openvpn on their systems to watch my plex server as plex bypasses it.
This is great news since I am trying to share a specific folder for business, but don't want to burden my family members who want to access my plex server
Any geeks need to know how to setup openvpn😁🍺
Here you go! th-cam.com/video/2gkbwxm72lE/w-d-xo.html