I can't thank you enough for an amazing series of videos. I watched all of them , They're a top notch quality. I learned a lot from you. Please continue producing these kind of videos. I will be waiting for it. Thank you again, I really appreciate it. 😁😁😁
Just finishing up having spent most of today going through each of your videos and making notes. WOW, what a tremendous resource you are. Great style; Not too fast and not too slow; Well broken-up modules allowing me to skip a very few things I’m not interested in for now. Tomorrow I plan to finish up my plans and place an order for a new DS1520+ to house my 17TB of existing media and data, thanks to the confidence you’ve instilled in me, and answering a couple long-standing questions as to “why” some of the options may be something I should consider or not. There is still a whole lot to this world of NAS from what I explored a few years ago with Synology, and there is more complexity compared to the various types of DAS I’ve owned, including two Drobo, but I’m looking forward to the new experience and possibilities only a NAS can provide. Thank you again. I don’t have higher praise for what you’ve provided the community.
Absolutely brilliant series of videos without which my computer, NAS and router would have been launched out the window! 👍🏼Looking forward to future videos!
MY Router Does not detect UPnP even though i have it enabled, I know how to port forward but can you recommend a video that does port forwarding specifically for Synology NAS.
The same goes for me, really top notch instruction video series. I am in the process of watching and implementing them on my NAS and is of great help to at least understand basic properties of such a complex system. I can’t thank you enough for these highly professional and excellent explanatory video’s. you have gained another follower in me!
As many ISPs have specific (and cheap) gateway devices (modem/router combos) that have limited capability (e.g. NVG599), I suspect many people (like myself) have purchased better quality routers and are using the ISP's device only as a modem. However, for external access, this requires trying to accomplish Port Forwarding through 2 devices (using IP Passthrough), which has been quite challenging (I have been unsuccessful - under External Access, Router Configuration, Connection Test Result , the UPnP fails, even though the rules show up in the router's UI). It would be great if you could address that scenario for those of us who have 2 devices and want external access for our NAS. (BTW - Your videos are absolutely fantastic - head and shoulders above the rest - very professional - can't wait for the VPN segment.)
Hi Steve, I agree, so I plan to make a follow up video that will try and cover generic issues and how to get around them. I'm a little worried that I will not be able to cover, every eventuality, simply because of the number of router/modems in existence, individual ISP rules and the numerous ways that someone could have configured their home network. So I want to monitor the comments for this video to see where people are having difficulties. Which means that I may not get a chance to post the follow up video until next year. In the meantime, these are the potential gotcha's I have identified so far. So I have noted them here as they might help point others in the right direction. Double NAT, where the router provided by an ISP is connected to a new wireless router, but the router from the ISP has not been set to bridge mode. Which means your running a Local network (192.168.1.*) inside of a second Local network (192.168.0.*). However, I suspect that Bridge mode may not be possible with all ISP provided hardware. UPnP is not compatible with your model of Synology NAS and the router you are using. While I once did use a router that was classed as not compatible with my NAS. My NAS was still able to create port forward rules, which did allow me to connect remotely via the internet. So its worth testing your connection even if your NAS reports that the router is not UPnP compatible. If UPnP compatibility is a problem, then you will have to manually create port forwarding rules from your router to your NAS.
Thank you so much for your reply. Regarding your suggestions: 1) I have a separate subnet for the NAS. The local network from the ISP's modem / router is 192.168.1.X and the NAS's network is 172.X.X.X. 2) DSM determined that UPnP was compatible for the NAS (DS1817) and the router (see step 4 below). 3) I did set up a static IP (192.168.1.Y) for the 2nd router (a Nighthawk x10 9000). Could I suggest walking through the following in a future video: 1) On the ISP's modem / router, you have set up IP Passthrough (Allocation Mode: Passthrough, Passthrough Mode: DHCP-fixed, Passthrough Fixed MAC Address: [MAC address of 2nd router]), you have disabled all firewall settings (confirming with the ISP that this is their only means of Port Blocking) and have disabled all wireless networks. You have not set this modem / router to Bridge Mode because this cheap modem / router does not have a Bridge Mode setting. 2) For your 2nd router, you have established a static IP address and you have ensured the NAS is in a separate subnet. 3) You start in DSM from "External Access, Router Configuration, Set up router". You get green check marks from "Detect Router Information, except for "Checking Network Environment", with a note at the bottom that states "WARNING: Two or more routers were found on your network. Please consult your Internet service provider to set the modem/router to Bridge Mode, or try setting your router to Bridge Mode." 4) After hitting Next, the 2nd router is found to be UPnP compatible (though it may not be one of the Wireless Routers in the Compatibility List on the Synology website) and you hit Apply and Save. 5) You create the port forwarding rules using Create (as per Part 34 of your series). 6) After hitting Apply and Save, the Connection Test Result column shows Failed. 7) You try to access the public IP via your smartphone and you are unable to do so. 8) However, the port forwarding rules are all found properly in the UPnP section of the 2nd router's UI - all data is confirmed to be correct (Protocol, Int & Ext Port, IP address). At this point, are there certain settings to check / tests to run to determine what could be interfering (either from the ISP's modem / router or the 2nd router)? Is it better to abandon UPnP (turn UPnP off the 2nd router) and manually create port forwarding rules in the 2nd router's UI? How do you test along the way / diagnose if something goes wrong (like Connection Test Result shows Failed)? How will VPN play into this environment? I know there are a ton of routers, but perhaps you could demonstrate using the top 3-4 brands (e.g. T-P Link, Asus, Netgear, D-Link) as: 1) The user interface is usually similar across various routers from the same company, and 2) The value of your videos (above the rest) is that other do a step-by-step demo - assuming everything will be go perfectly the first time, whereas you flush out the objectives, terminology and why the choices are made. By using the top 3-4 routers, it should provide enough examples to help others who use a less popular brand of router - even if the interface is different. My humble suggestion / food for thought...and if, in the interim, you have any thoughts, I would appreciate it. Once again, thank you for your videos and your support.
ISSUE SOLVED (and I'm a little embarrassed) - A static IP was set up for the second router, not allowing the public IP to be passed through. Aaauuggghh! Everything is working just fine now. Moving on to VPN.
@@stevemayfield1667 Thanks Steve for sharing your experience. As long as your home network works the way you want it to you have nothing to be embarrassed about.
Unfortunately, my router is not supported. This guide saved me though. You showed me which ports I only need to put in my router (4, later 2) to gain file access over network and that was super helpful. Thank you :)
Hello. Like many others have posted, your videos are amazing. I’ve watched the entire series on “How to set up a Synology NAS” and your detailed explanations for each step are incredibly helpful. Thank you so much for these tutorials. I am, however, having an issue with my NAS related to “Part 34: Configuring a NAS for External Access” and hoping you can provide advice to help get this set up. As I attempt to set up my router, I get the following two error messages: 1 - Warning: Two or more routers were found on your network. Please consult your Internet service provider to set the modem/router to Bridge Mode or try setting your router to Bridge Mode. 2- Note: Your router is not listed in the Synology UPnP compatibility database. Please click Next to go to the compatibility test page. To address the first warning message, I spoke with my ISP service technician and he confirmed that I have only one router on my home network. In addition to this, they have installed a booster to provide better wireless coverage throughout our house, but he assured me that the booster system was not a second router and stated that this should not be causing this issue. For the second note, I accessed my router’s settings and did confirm that it is UPnP compatible. When clicking “Next” during this Synology router set up, it does show that a “UPnP router” (my router) was found and lists its brand, model and firmware version. When I select the “Quick (recommended)” option, I get the following message: Failed to save all port forwarding rules. Please make sure you have enabled all necessary UPnP configurations on the router. If the problem persists, this UPnP router may be incompatible. I then click “Exit”, leaving the option to submit the results to Synology to contribute to their product development selected. I’ve reattempted this router set up a number of times over the last couple of months thinking Synology may provide updates to their compatibility database, but each time it is unsuccessful. Can you provide any insight into what the issue might be and how/if I might resolve without purchasing a new router? Thanks
Before I start, in the first instance I would suggest that you try using Synology’s QuickConnect rather than External Access. While External Access is my preferred method for connecting a NAS to the internet, QuickConnect may prove the easier solution to the one I’m about to discuss. Unfortunately, what you have described is a complicated issue made more difficult to fix due to the way your home network has been configured. However, it’s possible that by fixing one problem the second problem might automatically fix itself. So let’s start with the biggest issue. I suspect that you were on the correct path, when you spoke to your ISP service technician about your router and the wireless extender that they installed into your home. Like you, based on the warning messages that you have received, I would contradict your ISP service technician and suggest that your “WiFI booster” system is causing network problems for your NAS. This is related to something called Double NAT. As defined by Netgear, “Double NAT is when you connect your router behind another router creating two different private networks. For example, connecting your NETGEAR router behind a modem/router provided by your ISP. Double NAT does not prevent your devices access to the internet but may cause problems with playing online games, opening a specific service port, connecting to a VPN tunnel, or visiting secure sites with SSL. Also, the devices connected to the first private network may not be able to communicate to the devices connected to the other private network.” - kb.netgear.com/30186/What-is-Double-NAT Your ISP probably issued you with an all in one modem/WiFi router. However as WIFi was not able to cover your whole house they then fitted what you have described as a WiFi booster. As you did not mention specific models, the WIFi booster could be a Mesh network or a simple wifi extender. Unfortunately, a common mistake to make when fitting WiFI extenders is to simply disable DHCP and WiFi on the modem/WiFi router supplied by the ISP. Then by plugging the WiFI booster into one of the network ports on the back of the modem/WiFI router you create a new WIFi network. However, as you are running a router behind another router you have also created a Double NAT. What should happen is the ISP modem/WiFi router is placed in bridge mode (also referred to as “modem mode” on some models of WIFI routers) . The wifi booster or extender is then connected to the modem/WiFi router and configured without creating a Double NAT. With luck your WIFi booster has a firewall and is compatible with your NAS so External Access should start to work. However, if your WiFI booster is not compatible, then you will have to manually configure the Firewall and any port forwarding rules to your NAS. It’s worth noting that ISP engineers do have to work within the limitations of the hardware that the ISP provide. This means that they are often working with cheep and poor quality components. So it possible that your home network is simply the best that your ISP engineer can offer based off the hardware that they have available. Also from a compatibility stand point, Synology definitely support their own models of WiFI routers to make sure they are fully compatible with their NAS devices. Unfortunately, because of the number of brands and models of routers on the market, I do suspect that Synology are not able to keep their compatibility list up to date. So you might find manually configuring your firewall and port forwarding rules is the only way to make your NAS remotely accessible. Sorry, that this response is a little generic, unfortunately as this is a complicated topic with many variables I cant be too specific. However, I do hope that this at least points you in the right direction. Please note that I will be making a video on Double NAT, manually configuring router firewalls and port forwarding as soon as I purchase a router that is not compatible with my NAS so please look out for that video.
Thank you for taking the time to submit these instructional videos. I have followed each one to the letter as much I was able with a slightly different configuration here and there. I am almost to the finish line but I'm stuck on this lesson. When I try to "set up router" I get this note: "Your UPnP router did not pass the compatibility test. You can click Next and set up port forwarding rules manually...". When I hit "next" and click "select your router", it doesn't show up under the updated list. So, at this point, I'm lost. I can get into my router's settings via a web browser but I'm ignorant as to how to set up the port forwarding I need. I saw somewhere that you were thinking about submitting a video for those who need to be walked through this. I would very much appreciate a video on this. Thank you, again. I have subscribed to your channel.
From the comments, I have come to realise that anyone looking to setup External Access on their Synology NAS, potentially face two basic issues, Double NAT and Port Forwarding. However, as Double NAT and Port Forwarding are issues specific to the make and model of router that someone has. I have decided that the "How to setup a Synology NAS" series will only show someone how to complete a basic setup of DSM6, from within an ideal network. So I'm slowly starting to wind-down the series. Then when DSM7 is released, I will start a new series. However, this series while running through the same basic content, will take on board what I learnt from my previous series. So while we wait for DSM7, I will be making a few additional videos for the Synology NAS tips series. These will include, data recovery, migrating to a new NAS and providing a summary of the issues and problems someone might face when setting up External Access. However, as these issues and problems tend to be related to, the make and model of Wireless router someone is using. My plan/idea going forward is to spend some time posting videos about how to setup a few of the more popular brands of Wireless Routers and Mesh networks. Then for each of these series I will try and specifically look at how to avoid Double NAT and how to deal with port forwarding for a Synology NAS. That way I can give people a walk through on how to set-up port forwarding. Currently I am working on a series about how to setup Google Nest Wifi, which I hope will be finished in January. It is then my intention to use the video footage from that series to make my follow up video on External Access. However, that video will be very generic.
It was a good tutorial and mine is working now just as I wanted it to. No more quick connect! It seems to use R3 now instead of Let's encrypt. Mine didn't work with port 5001 for about half an hour, but I think this was due to updates to DNS.
So easy to follow! I'm still having issues getting my external access - I have followed all the steps carefully, however when I try to navigate to my public IP address, it keeps saying the site can't be reached. I have two other IP addresses that show up when I run the synology assistant, and I have tried those externally, and still can't get it to load. My quickconnect id works though! Any thoughts? Please!
As it's difficult to know exactly where the problem might be. The following troubleshooting tips might help you isolate where the problem is. 1. Make sure that your network has not been configured with Double NAT - two wireless routers connected together. If I remember correctly, Synology Easy Access is designed to work around Double NAT, but Direct Access is not. 2. I'm not sure why you are seeing two additional IP addresses when you use Synology Assistant. Do you have more than one network cable plugged into your NAS? So I would suggest that you check to see what public IP address your home network is using and compare it to the one your use when trying to connect remotely. You can do this by doing the following in Windows - ua-cam.com/video/6rVON42BQNo/v-deo.html or by doing - ua-cam.com/video/nGZVJCNJEYw/v-deo.html in macOS. 3. Shields-up (www.grc.com) can be very useful as it will tell you if the correct ports to your NAS are open. However, rather than trying to do an "All Service Ports" test. You need to use the "User Specified Customer Port Probe" and test the ports that need to be open for remote access to work. For example try testing ports 5000 (http) and 5001 (https) as these are the ports used by DSM. You should expect Shields-up to report that the ports are open and not closed. However, your router might be protecting your network so your router could also be making the ports "Stealth". 4. If Shields-up is not able to see that you have ports open. You need to double check that port forwarding on your router has been correctly configured. Unfortunately, I can't offer any advice as this will be dependent on the make and model of router you are using. 5. Double check the firewall on your NAS and make sure that ports 5000 and 5001 have been placed above the close all ports rule. That an easy mistake to make. 6. If you are using an iPhone to test your connection to your NAS. In Safari I would recommend that you type the full address to your NAS in. For example [ipaddress or domain name]. For some reason Safari will fail to load the DSM the first time you try to access it remotely, unless you type the bit. Hope these tips make sense and help fix your problem.
Very well expained video! In understand this is to access my NAS from a browser. But how can I have access externally in order to open files from a software? I mean, that my NAS could appear in my Finder? Thanks in advance!
Once you have completed this stage, there are a number of ways to remotely access NAS files from Finder. However, the one I recommend you look into is via VPN. Hopefully the following videos from our series will help you setup what you are looking to do. How to setup a Synology NAS - part 35 - ua-cam.com/video/mciaffXvXAM/v-deo.html How to setup a Synology NAS - part 36 - ua-cam.com/video/xlAXJnisPB4/v-deo.html How to setup a Synology NAS - part 37 - ua-cam.com/video/iqgp2L1K6RQ/v-deo.html 😃
Hi, great video on remotely accessing the Synology Nas. I had a few quick questions on remotely accessing the Synology NAS over the internet: 1) I've read that the most secure way of having your Nas over the internet is to have the VPN server installed at the edge of your network (by the router) instead of the NAS. Any truths to this? Instead of installing a VPN Server on the Synology (as one of your later videos shows), I set up a VPN Server using OpenVPN on my Router (ASUS RT-86u) instead. I managed to set it up on the router. And I used OpenVPN Connect as the client on the remote computer to connect to my Synology Nas. I am able to access the Synology DSM file station to browse files remotely from the remote computer. 2) However, and this is my second question - I want the remote computer to be able to also use the Synology network shared drives as an internal windows drive - without having to go through the Synology web interface. So by this I mean when opening a Windows 10 folder on the remote computer, I want the user of that computer to be able to see the Synology network share folder on the left hand side and being able to edit, move, rename files all within Windows 10 - not on the Synology web interface. I find using Synology's web interface is clunky and slow. How would I best be able to set up network mapping of my Synology drives to the Windows 10 computer? 3) I have read that WebDAV maybe the way to do it? Is that the only way? I'm looking for a simpler solution. I know that when I want to access the NAS via LAN in my internal network its easy to map a network drive via Windows. But for remote computers I am having great difficulty if you can please help me figure this part out? What am I missing?
Lets take a look at your quick questions. 1. I’m not sure if installing a VPN server on your router is any more or less secure than installing it on your NAS. However, the primary reasons why I installed VPN server on the NAS rather than the router are as follows: a) Not everyone has a router that can be configured to work as a VPN Server. b) I wanted to try and keep things as simple to understand as possible. c) Routing tables might be an issue. You may have noticed that in my series, I demonstrated how to install and configure a DNS server. The underlying reason for me doing this, was to fix a routing problem between macOS, VPN Server and my Synology NAS. 2. I would suggest that if you are having to use Synology’s Web interface to access your network drives when you VPN in. You might have a problem. In the video we look at how to setup TCP/IPSec VPN on both macOS and Windows 10. However, because IPSec will not allow Bonjour and NETBIOS broadcast traffic through the VPN tunnel. We were not able to use File Explorer or Find to navigate to the shares on our NAS. Instead we have to manually mount our network shares each time we want to use them. However, I don’t think this should be a problem for you as you are using OpenVPN. So as a test, try accessing your network shares by opening File Explorer and in the address bar typing //192.168.1.x/folder name. When you press enter on the keyboard it should open your network shares. Then as a work around simply use File Explorer to create map network drives for your shares. As the location where you create a mapped network drive has changed a bit over time. If you are using Windows 10 update 2004 (or above), in File Explorer under the Computer tab, is an option called map network drive. Just follow the wizard to create a mapped drive. The mapped drive will remain in File Explorer regardless of its connection state. However, if File Explorer is not able to connect to your NAS, the mapped drive icon will display a red cross. 3. I don’t think that WebDAV is the way to go. WebDAV is basically a web technology that makes remotely accessing network drives simpler, and in theory without the need for a VPN connection. However, you really should not need to be using a secondary service to access network shares if you are already using VPN. As mentioned above you should be able to access your network shares when you use VPN. However when using VPN, check to see what IP address you computer is using. Also try running a PING test to see if your NAS is viable along with trying to access your NAS using its IP address. If all of these test work, then create maps to your network shares. In the past I would have recommended that you create a batch file or a Power Shell Script to auto mount your network drives at log in. However, Microsoft in their infinite wisdom decided that being able to run scripts in Windows was a security issue. So both batch and Power Shell scripts will no longer run unless you start fiddling with Windows 10. However if you find that none of the tests work, that would lead me full circle to wonder if perhaps you have a routing problem to your NAS when you VPN in. So maybe investigate how you would change the routing tables on your NAS or router. Hope this points you in the right direction, sorry I cant be of more help.
Hy, thank you for the video. It help alot for my nas problem. I have one more problem that I hope you can help me with. I need to use printer/scanner xerox docucentre IV 5070 to automatically send scanned documents to My Synology Nas. I've search around the web for quite some time for this problem, but can't find any solution yet. Can you help me with this problem? Thanks in advance.
Firstly, I want to say thank you for this well made walk-through. It was very thorough. My question is related to what happens to other port forwarding I already have on my home router. After the router identification, if I click to save, it warns "this will overwrite existing port forwarding rules for the router". Does this apply only to the router configuration on Synology interface? Or Does this imply it will delete my other port forwarding configuration on my Netgear router for other computers/apps? I'm asking as I have tons of other port forwarding rules on my Netegear router that I want untouched. Thanks for your help.
I would suspect that because UPnP is enabled on your Netgear router. Your NAS will clear down your existing port forwarding rules, and presume that any devices that had previously created port forwards, would simply recreate their forwarding rules. So for example, I have a Playstation. So when my NAS enables port forward rules on my router. My Playstation will simply re-add its port foward rules to my router the next time I switch it on. Personally, if I were in your situation I would err on the side of caution and first make a note of all the existing port forwards being made to my router. Then as you have tons of other port forwards I would be tempted to manually create all of the port forwards to my NAS rather than rely on using UPnP. Hope that helps.
@@mydoodads You're simply amazing. I wasn't expecting a response so quickly. It's well appreciated and I'll definitely take screenshots of my port forwarding rules before I do anything further. Thanks once again and I hope more people will subscribe to your amazing channel. HAPPY NEW YEAR 2021!
I am using Google Wifi router which does not have additional ethernet ports for connecting to my Synology NAS directly. As such, I am using a 5-port Ethernet Switch (Cisco SE2500) to make the connection. I have checked that my Google Wifi router is already uPnP enabled. Upon performing the Set-up router configuration, the message shown was that no uPnP router was found and that I should proceed to manual installation. Any advice from anyone on what to do next? Thanks.
This is a great series of videos. I think I have followed this correctly, byt when I attempt to use my phone to access synology NAS I get the following message 'Web station has been enabled. To finish setting up your website please use theWeb Service section of DSM Help. I cant get beyond this? Any advice please
On your mobile phone try adding the port number of either 5000 or 5001 at the end of your domain address. For example mydoodads.synology.me:5000 or my doodads.synology.me:5001 Port 5000 is for the port without SSL and port 5001 is for the port with SSL. This should take you to the DSM and your mobile phone should remember the url from that point forward.
please do another one where the router is not a synology and is not a supported one for doing it automatically through DMS. At 5:30, my router is not supported so I need tutorial on how to port manually. I already made a static ip for the nas and ddns. Another problem I might have is that the router is hooked to a cable modem. DMZ? Bridge?
I think this will depend on the router, as turning off (the routers) UPnP might make the router lose the port forward rules that UPnP initially created. However, you are right to start thinking about disabling UPnP. So, I would suggest taking screenshots of your routers port forward rules, and then disabling UPnP. If your router loses its list of port forward rules, just refer to your screenshots and manually recreate your port forwards. Hope this helps.
@@mydoodads Does UPnP IGP need to be port forwarded in order to be able to write to the router's firewall settings? BTW, I'm using an Asus RT-AC68u. When I apply the rules, it says that it writes the rules correctly and shows that it tests properly, but when I check on the firewall within the router settings, shouldn't those rules now appear in the Firewall settings of the router?
@@Brossy76 Your routers firewall more than likely will be set to block incoming traffic (ie from the internet), but allow all traffic from your Local Area Network (LAN) to pass to be internet. So there should be no need to set port forwarding for UPnP. That is unless your creating some sort of super complicated firewall. Taking a quick look at the user manual for the RT-AC68u, I think that the router will only display a port forward in the port forward panel. Which to my way of thinking would be correct, as I perceive a firewall rule to being something that is slightly different to a Port forward. However, I'm sure that the "internets" will happly correct me if I'm wrong on this 😉
Everything worked until I deselected the non-secure ports. Since we can't (nor should we!) see your secure address, I'm missing the "typology" to ensure the encrypted address is launched. These videos are fantastic. You've taken the mystery out of this. Agreeing with those below, I was about to chuck the whole thing in the trash bin! I read the reply way below regarding 5000 vs 5001. I have 5001 ticked and 5000 unticked on the "Management UI...etc" I checked the connection after saving and get OK. I guess the router & DSM are happy! When I put in my **********.synology.me address into my iPhone browser, I get a "Server not responding". So, I put in the URL again and added 5001 to the end of my .synology.me and still get locked up with "400 Bad Request" The plain HTTP request was sent to HTTPS port". I was doing great until I got to this step! Thanks again for these fantastic videos. I am a flight instructor for a major airline. One of the rules of "instructor 101" is to "KISS"... keep it simple stupid and these videos are KISS!
Thank you for the really helpful videos! When I try to log into my NAS from my phone typing my public IP address into my browser, I get the following message "Web Station has been enabled. To finish setting up your website, pleas see the "Web Service" section of DSM Help." Any advice? Web Station automatically downloaded on my NAS and I'm not sure if there is a setting on it I should be deleted so that it does not interfere with how I am trying to configure my NAS. However, if I try to connect using QuickConnect, it directs my to the hostname I had created for NAS. Thank you again for this!
IT is save if open to external access? What best practice to secure synology for external access and i use active directory user on Windows 2016 server
As suggested in Part 34, in order to configure NAS for External Access, I have enabled UPnP on my router, then I have selected the ports as per the video, but when I click on "Test Connection", it is showing failed, not OK. What could be wrong here?
The list of routers compatible with Synology nas hardware is not that extensive. So there is a good chance that Test Connection will fail. However, even though you're NAS reports a fail, That may not be the case. So in the first instance check your router to see any ports have been opened and if they are being forwarded to your NAS. If not then I'm afraid you will have to manually configure your router to port forward to your NAS. Hope this helps
Hi, I too am enjoying your series a lot, so thank you! But I got stuck here in this lesson, because when I try to "Set up router", I get an error message for "Checking network environment". The warning below reads: "Two or more routers were found..." Now, I don't know what second router it thinks it found. As far as I know I only have one. And yes, Upnp is activated on it. Any tips much appreciated.
I think that your error message is implying that your home network is using double NAT. - support.ubisoft.com/en-gb/Article/000062048?isSso=true&refreshStatus=noLoginData So for example you might be using a wireless router provided by your ISP, but because its wifi coverage is no good, you connected a third party wireless router. If you then connect your NAS to the third party router. As each router has a firewall, your NAS is unable to navigate through both firewalls. Unfortunately, this is a problem that is not that easy to fix, as the fixes are not well documented on the internet. I think this is because ISP's all use different hardware and settings, so instructions that work for one person will not work for another. However, the three main fixes are as follows: 1. If possible, place the router provided by your ISP into bridge mode (sometimes called modem mode). 2. Create a DMZ on the router provided by your ISP. Then connect your second router to the DMZ. 3. Manually setup port forwarding rules from one router to the other that will all your NAS to communicate with the internet. This is as stated in the Ubisoft article. Sorry I can't be more help.
@@mydoodads Hi, thanks very much for your detailed response. But I have no third party wireless router in addition to the router provided by the ISP (a Fritzbox). Should I nonetheless place it into bridge mode?
@@mydoodads One more update, sorry: I have compared the internet address of the router in the router setting with the address I get when I go to a website to check my public IP. They are the same, which I guess confirms there is no double NAT at play here.... Any thoughts?
@Armin As I'm not familiar with Fritzbox, I would try setting up port forwards from the router to my NAS and then seeing what happens. As a tip, for testing the number of routers in your network. Try using the Traceroute command on your computer via the terminal (Mac) or the Command Prompt (Windows). Presuming that your Fritzbox is using 192.168.1.1. If you use a Mac try using something like: traceroute -m 10 192.168.1.1 On Windows try using the command: tracert 192.168.1.1 The Traceroute command should show you the route that your computer used to reach your ISP's router.
This is great but I can never get this to work. DSM shows the DDNS is okay and I am manually opening the ports on my router, but when I try the link never works :( Quick connect works fine.
If you are new to a networking and NAS devices, or only have limited or no prior knowledge of Double NAT, Firewalls, public static IP addresses, domain names, public DNS and SSL certificates. Quick Connect is the best way to go. However, if you are looking to learn or you want to keep your NAS as independent as possible. Then definitely use External Access. Personally I use External Access for the following reasons. a) In my opinion External Access is more secure. This is because you are not using a domain name that makes it obvious that you are using a Synology NAS. b) You don't give third parties as much information about your connection and NAS using Direct Access, as you do with QuickConnect. c) You have better control over services like SSL certificates, DNS server settings and domain names. Which in turn makes troubleshooting easier. d) Less can go wrong with External Access compared to QuickConnect However these reasons may force you to use QuickConnect a) Ideally you need a Static IP address. Something that is not possible with all Internet Service Providers b) It will cost more to use External Access rather than QuickConnect ie you need to buy your own domain name and SSL certificate. c) OpenSSL will automatically update the SSL certificate on your NAS every 3 months (I think). However, a third party SSL certificate will have to be manually updated (by you) every year. Which is something I have difficultly remembering how to do. So a video is coming sometime in the new year on manually adding/updating an SSL certificate. d) It can be more difficult, and time consuming to configure Direct Access. Which in turn makes it very easy to make a mistake. As I'm currently in the process of remaking this series for DSM7. My intention is to look at configuring both QuickAccess and Direct Access. The idea being to allow someone to setup with QuickAccess, and then show them how to convert to Direct Access if they want. However, as I'm currently finishing off SMB network shares. I don't expect to get to this topic until late 2024. Hope that helps answer your question :)
@@mydoodads *You're quite the amazing super smart/wise fellow. For exampls, yous tailor your communication to me whether than talk at-me, over-my-head, down-to-me, etc (quite-refreshing oh-boy ;). *I justs-gots my DS723+ & I'm going thru your super-professional DSM7&6 playlists all tailored to home/office users (perfect for a professional NAS hobbist like me). It's kinda hard buts all the rest are much ... much harder. In-fact ,my brains melted a few times on the last few videos in the playlist. Nevertheless, I will keeps doing them all over & ... & over again until I suppass The-MASTER (thks-many ;). *I knows you're a busy computer-genius &-all buts what I miss most is a short/pragmatic test on the key concepts/points at the end of the videos. Of course you dos-do a most excellent summary. However passing a short/pragmatic test of key concepts/points right after your video ensures competency in/with them. Conversely failing any of them hi-lites what your hungry disciplines gots to review before moving-on to your next video. Justs-thinks; if I pass all the tests, I mights-gets my MyDoosDads professional certification (don't-laugh, it could happen ;). *I justs really hates it when I thinks I knows-it-all, tell everyone else I knows-it-all tos, & then finally realize I've been just an egotistical idiot all along (happens much to often to me unfortunately ;).
Followed step-by-step, awesome information, learned so much! Thank you for your contribution! I was unable to access via mobile browser, used the HTTPS:// then like magic I was able to reach my synology. Thank you again!
So glad i stumbled across your video's they are immensely helpful, i have just one question, is the load time after only allowing ssl cert connections meant to increase 10 fold? or is it my phone?
As other comments have stated: Great videos! Thanks a lot for all the help in setting up my NAS! Currently I cant get connecting to my NAS through DDNS to work. Quickconnect works fine, but DDNS is more secure right? I set up everything that is needed, domain name, SSL-certificate, etc etc. The domainname works on my network, but on cellular date on my phone neither the domainname or the ip-adress can connect. I thought I'd take a look at the ports forwarded on my router. Indeed, by using the 'Test Connection' feature through router configuration on DSM I see that the ports fail to connect. Weird, since EZ-connect did say it forwarded everything for me. Weirdly enough, after I manually portforward on my router.... they still fail to connect. I really want this to work and not be forced to use quickconnect. Any ideas? Does it maybe have to do with my router using ipv6? I read somewhere portforwarding works differently with ipv6. Either way, thanks again for all the help!
I’ll admit I prefer DDNS or a Static IP address over Quick Connect. While I believe Quick Connect is secure, I do worry that if Synology has a data breach, it could put my NAS at risk. So I tend to only suggest Quick Connect if I cant make a NAS accessible via the internet. Unfortunately, I don’t really have any experience with ipv6 so I doubt I can offer any useful advise or be of much help. However as an anecdote, I have a second network which is my own personal network. On that network I have a domain name that uses a Static IP address provided by my ISP. I then use a Synology RT1900 to act purely as a firewall. The reason I bring this up is that originally when configuring my RT1900, for some reason not only did I have to create port forwards to my NAS. I also had to open the same ports on my routers firewall if I wanted to be able to access my NAS externally. So maybe your router also works in the same illogical way that my Synology router did, in that you will have to open ports on your firewall and then also set port forward rules.
@@mydoodads Thanks for the reply! Unfortunately I can not seem to adjust any specific router firewall settings. I've decided to just be content with the NAS not connected to the internet, I don't really need it as a cloud to begin with and I guess it's safer all around. Keep up the good work with your videos!
great video! i have 1 question : how to mount the drive from mac's "connect to server" when we access externally (not in lan network)? i set up the forwarding ports on my router for the external connection, everything works fine on web browser using the external connection, but everytime i tried to mount it from mac "connect to server", it asked for our password (i assumed it connected), but then after i typed the user and password, "there was a problem connecting to the server "..."
There are a number of methods that you can use to remotely access the network shares on your Synology NAS. However, based on your limited description it sounds like you are trying to use WebDAV. For others that might be interested Synology define WebDAV as “an extension of the HTTP protocol that allows users to manage files stored on remote servers. Common client programs supporting WebDAV include Windows File Explorer, macOS Finder, and Linux File Browser.” So if you are using WebDAV, when you select Go - Content to Server on your Mac. Is the server address to your Synology NAS correctly configured. So for example I think it should look something like the following: domainname:5006 or possibly domainname/foldername:5006 However, if you are using WebDAV, I would recommend that you switch over to VPN instead. As WebDAV uses the HTTP protocol to link back to your NAS, I have always been a little dubious of its security. So I personally only use VPN to remotely access my NAS. While VPN is a bit more work to setup on your NAS. By using VPN your computer and its data will be encrypted in a slightly different way. So not only will VPN allow you to remotely access the data on your NAS, it will also protect your privacy when working remotely. Hope this helps.
Thank you for the great videos! Question. Whenever I turn on my Firewall feature on my NAS, can't seem to access the PMS via Package Center However, when I can access whenever the Firewall is turned off. I I am a Google Wifi user. The router does not appear from the drop down list. I have to manually set the Port Forwarding in the app. Please advise.
To your first question, as I don’t use Plex I’m not the best person to ask, but hopefully someone else might be able to shed some light on the issue. As to your second question. One of Google WiFi’s great strengths is simplicity, but if you want to connect something as complex as a Synology NAS onto Google WiFi. That simplicity starts to become a major weakness. While I personally did not pursue using Google WiFi in my home network, mostly because it lacked features that I thought I needed better control over. I have just started making a series on setting up Google Nest Wifi, so at some point in the future I will be take a look at how you connect a Synology NAS to Google WiFi. In the meantime, I seriously doubt that Google WiFi is compatible with the Router Configuration Wizard on your NAS. So yes that will mean that you will have to manually set Port Forwarding in the Google WiFi app. It’s also worth noting that if you have connected Google WiFi to the Internet hub that was provided by your Internet Service Provider. You need to check that you have not created something called Double NAT. Double NAT is where a router is behind a router, which will cause problems when remotely trying to access your NAS. - kb.netgear.com/30186/What-is-Double-NAT
Learned a lot from these well thought out videos . Have you done a video on manually Port forwarding ? My Netgear NF18ACV router is not recognised by Synology so unable to use your External Access method .
While I can't cover Port Forwarding for every model of non compatible router. I think I have a few ideas for a video that will cover issues people might be experiencing with External Access. However, I'm not sure when I will be making this video as I still want to cover VPN Server, VPN Clients, log in scripts for Windows and Mac, DNS Server, Dual Authentication and installing SSL Certificates. As Synology will be releasing DSM 7 sometime in 2020, I do intent to end this current series soon. So please look out for something before the end of Spring.
The URL works from my phone but not the PC. I've tried turning the firewall off on the PC and in the DSM. Anybody help a brother out here? PS, this is the best video there is on this. Thanks.
This sounds like you might be trying to use the URL to your NAS, from a computer connected to your home network. If a computer is connected to your home network. In order to connect to your NAS, the computer will use the NAS's local IP address (ie 192.168.1.2). In this scenario, because the SSL certificate you have created is for your public IP address and not for the local IP address of your NAS. The SSL certificate and its associated public URL will not work properly. However, when you completed your test using your mobile phone. As the phone was connected directly to the internet. It used the public IP address you created when you setup your DDNS service and its associated SSL certificate. You can test this if you tether your computer to your mobile phone. As your computer will now be connected directly to the internet and not your home network. You should find that your URL and its SSL certificate will work. Hope that this helps explain what's happening.
@@mydoodads Thanks for the detailed response, I did have this working before. The PC is connected via WiFi the same as the phone. So, in this case, it should work and there's something else at fault perhaps?
I cannot find my router (Linksys MX4200) in the UPnP since it asked me to set up the UPnP manually. I asked Synology and they said that they do not have MX4200. What can I do?
UPnP is used to automatically allow specific types of traffic through your routers firewall. So in this instance you will need to manually allow data through your firewall and direct it specifically to your NAS. This is done by using the port forwarding function on your MX4200 - www.linksys.com/us/support-article?articleNum=138535 As you will have to learn about how to port forward on your router. I would recommend that you work slowly and methodically. Perhaps start by testing your routers firewall to see if any ports are currently open or closed. I would recommend testing your firewall using shields up - www.grc.com That will give you a baseline as you work. Then while you are learning about port forwarding on your router, initially start with a service that only requires one or two ports to be open. For example Disk Station Manager (ports 5000 and 5001). A piece of advice. While Shields up suggest that open ports are bad, and only stealth ports are good. It's not that black and white. In order for your NAS to communicate certain ports will need to be marked as Open. The trick is to make sure that any ports you do have open are only directing data to specific services on your NAS. I think you will find the following information regarding Synology Ports very useful, as it identifies which ports need to be opened for the different services on your NAS - kb.synology.com/en-me/DSM/tutorial/What_network_ports_are_used_by_Synology_services Sorry I can't be more help, but while it may initially seem daunting, it's not really as difficult as you might initially think it is.
Thanks, for the very clear video. However, my router does not support UPnP, so I configured it manually via the router by port forwarding. The part I don't understand, is that if I connect via my mobile phone via 4G, I am able to login (via ....synology.me). However using my LAN IP in my home network, either 192.168... or via ....synology.me, I get a certificate error? Do you have any solution?
The problem relates to the Let’s Encrypt SSL certificate, being used to certify your public IP address. As the SSL certificate is using the public IP address identified by your DDNS service. When you try and access your NAS locally, the certificate does not match the local IP address (ie 192.168.1.x) being used by your NAS. This in turn prevents you from getting the padlock symbol, while also giving you the “Connection is not Private” message in your browser. How I got around the problem, was to abandon using DDNS and Lets Encrypt. Instead I purchased a static IP address for my broadband connection, a domain name and an SSL certificate. Then through my host (the company I purchased my domain name from) I associated my new domain name with my new Static IP address. As the host also gave me a free SSL certificate I used that certificate to make my static IP address secure. This allowed me to receive a secure connection whenever I access my NAS from the internet. Then so that I could access my NAS securely when on my LAN. I installed DNS server and then created a DNS record for my NAS. I then assigned the SSL certificate I purchased, to my NAS so that my NAS was secure when I try to access it locally. However, I realise that not everyone will want to do what I have done. This maybe because of cost or possibly that their Internet Service Provider does not allow them to buy static IP addresses. So I would suggest that you take a look at a video made by Willie Howe, as he covers how to fix your problem using DDNS and Lets Encrypt - ua-cam.com/video/daIelVuKlYQ/v-deo.html Hope this works for you.
So, if not using a Synology router how does one go about setting up the WAN access. Can one use any available VPN? Or, does a router's game mode port forwarding work?
VPN is certainly one way to go, and my preferred choice. However, if being able to access your NAS through a web browser is more what you are looking for. Then yes, you would have to enable port forwards on your router.
Hello, First of all, thank you for posting all those videos! Just have a question.. will there be any difference if we set up Quick connect feature? is that a complementary option we might think on using it?
I think it’s better where possible that everyone uses Direct Access, partly from a learning and understanding perspective, but also because I do have a number of small concerns about QuickConnect. From what I have been able to workout, QuickConnect will create a secure connection between a NAS and a Synology Server. Something a little like a VPN connection, that punches through your home networks security so that you do not have to worry about configuring Firewalls or Port forwards. You then use a Synology Account to connect to your NAS via a Synology server. However, I cant seem to find any info on if Synology data mine or if Synology store basic information about your NAS, such as your admin password. So, how secure would a NAS be if Synology’s servers were hacked. While I’m sure that Synology are being careful with QuickConnect data, particularly as up to this point, I have heard no instances of data breaches. I prefer to recommend that you use QuickConnect as a fallback in the event that you cant use Direct Access. For example if your ISP does not allow you to change firewall settings, you can’t create port forwards on your router or you have double NAT. Hope this helps to answer your query and thank you for your support.
@@mydoodads with all these ports opened, aren't you exposing to many services to the external world (internet)? Wouldn't you need to set-up a third party VPN or even a bastion running dedicated security SW, vPN and Firewall in order to have better protection?
@@jormol In order for you to be able to access services remotely, you do need to have the ports open to the services you want to use. However, you protect your NAS by ensuring that you only open ports to services that you need. You should also make sure that any services you are using, are running on the latest software versions with the newest updates and patches. From what I have been able to work out (not a security expert), its exploits to a service and not the open port that's the real security risk. Then you need to make sure that you add layers of additional security to protect your NAS. This should be long complex passwords and perhaps 2 step authentication. Please see these video for more on the security settings you should consider enabling - ua-cam.com/video/v6KKViXCK1U/v-deo.html and ua-cam.com/video/_wgBVayaIGE/v-deo.html However, you are right in that using VPN will give you more protection. Personally, I have configured my NAS so that I can only access Video, Audio and PhotoStation from the DS apps on my smart phone or tablet. This is because, while there will still be ports open. These ports are not as obvious as the http ports. So will require a little more effort for a hacker to exploit. A little tip, I did this by enabling/disabling port forwards on my router and not fiddling with settings on the firewall of my NAS. That way, on my LAN I can access web services like Synology Cloud or Audio Station, but these services will not be available via the internet unless I use the corresponding app. This has the useful knock on effect, that fewer ports are now open. Then when working remotely, I use Synology VPN server and the VPN client on my computer to connect me back to my home network. From there I can access my network shares and other NAS services as if I was working locally. As I mentioned Im not a securities expert, but I'm comfortable with how how my NAS is locked down.
@@Brossy76 Originally, I intended to make an episode for both Direct Access and QuickConnect. However because Synology keep teasing the imminent release of DSM7, I decided to just focus on QuickConnect for this series. However, as I intend to make a series for DSM7, I'm thinking of moving away from QuickConnect and focusing on Direct Access. I think that I will make QuickConnect one of my quick tip videos.
At the moment it's looking like January. Mostly because of Windows 10 testing and I need a break over Christmas. I'm planning to divide the video into three parts. The first being the setup of VPN Server, then post two videos showing you how to configure the Windows and Mac VPN client. Currently, having Windows 10 VPN client be reliable is proving to be a challenge. However, MacOS VPN client is super easy to configure and very reliable.
i am not able to use ddns while i am on my home wifi, as soon as i connect to cellular service or cellular hotspot then i am able to access my synology through ddns. why is this like it? is it true we cannot access synology nas on ddns while on home wifi?
You can still access your NAS from within your home network. So try use your NAS's local IP address. For example 192.168.1.2:5000 or 192.168.1.2:5001 However, if you want to be able to access your NAS using a domain name. Try setting up a local DNS server on your NAS. ua-cam.com/video/iqgp2L1K6RQ/v-deo.html It is through this local DNS server (rather than DDNS) that you can instruct devices connected to your home network, to use the local IP address and domain name you have given your NAS.
Having issues with the router config (it's a TP-Link ArcherC7) on Port 80 - for some reason all of the other ports (5000,5001,443 and 9025-9040) work absolutely fine just not 80 - keeps saying the connection test failed. Not sure what to do now...HELP!!!
As I don’t have a TP-Link Archer C7, I cant offer advice that I know will work to solve your problem. However, I suspect that the Firewall on your Archer C7 has been designed not to allow UPnP on your NAS to automatically control port 80 on the router. I would suggest looking at page 54 of the Archer C7 user manual - static.tp-link.com/2019/201901/20190109/1910012372_Archer%207_UG_REV5.0.1.pdf In typical TP-Link fashion, they seem to have veered away slightly from the conventions for naming and configuring features within their products. So based on the manual it looks like you might have to setup something called a Virtual Server on your router which will then allow Port forwarding on Port 80 to your NAS. Hope this help.
I should have finished the video as I disabled port 80 anyway. Thanks for making the series, NAS working like a dream and I haven’t got A CLUE how about stuff like this!
In December 2020, Let’s Encrypt started using a new form of LTS certificate. - lwn.net/Articles/838811/ I’m no expert but I think that R3 simply refers to how the certificate is signed for better security - letsencrypt.org/certificates/
If I try to access to the IP of my NAS on my smartphone with 4G, it doesn't show anything. But every port is working on the routeur's configuration :/ What did I do wrong ?
@@lemosky7762 No, on your home network you NAS will have a local IP address. Something like 192.168.1.2 Instead, you will need to use your public IP address. This address is the one that has been provided to you by your internet service provider. The easiest way to find out what your public IP is, is to simply google from a computer connected to your home network, "what is my IP address" Google should then display the IP address your broadband connection is using for example something like 172.219.22.14 This article might help explain things better - www.lifewire.com/what-is-a-public-ip-address-2625974 Hope this helps
I've followed the video but it doesn't seem to work, everything is exactly as shown in the video. The only different is on the router configuration the local port 80 and 443 are different for the router port is that why?
For my videos I have made the networking side of things as vanilla as possible. So while Im not sure I completely understand your routers configuration, like you I would also suspect the local port 80 and 443 being different for the router port. However, a couple of other things to consider include: If you have a router connected to a router, that would create something called double NAT. Double NAT could be one explanation as to why you are having problems connecting to your NAS. - kb.netgear.com/30186/What-is-Double-NAT Its also worth checking the firewall on your router. I noticed, that if I manually configure my Synology RT2200ac router rather than trying to use UPnP. I had to manually open ports on its firewall as well as set my port forwards. You might find, that on your router you have to also open ports on your firewall. If your model of router can be managed remotely, you might find that your router has reserved ports 80 and 442 for its own use. As this might be the cause of the problem, it could be worth looking into switching off the routers remote management feature. Although I would expect port forwarding to override that setting. If you have configured the firewall on your NAS, double check that your NAS is not blocking traffic to port 80 and 442. Its worth double checking the Port Forwarding rules have been set on your router. You are looking to make sure that the forwarding rules for port 80 and 443 are pointing to the local static IP address of your NAS. Finally it could be worth trying to manually create port forwarding rules on your router rather than trying to use UPnP. Sorry I can't be more specific with a solution, but I hope that one of these suggestions help.
@@mydoodads For some reason its decided to work! However I'm now having issues with the certificate. I've done everything it says in the video but when I go to the address example.synology.me it says the connection is not private or it won't connect to it, is there any reason for this?
@@joshforth8493 I have tried to replicate your problem, and was able to recreate the issue you found. However, after rebooting my NAS the problem went away and I was no longer able to replicate the problem. So a reboot might be worth a try.
i'm having isssues with setting my ds918+ to have external acess. it says 2 or more router were found. Even when it detects upnp, the rules show "failed." Any video on that tha t shows the steps to fix this issue. Please share.
I am having the same issue despite only having one Router. Except my issue is that my rules come up with OK, yet three of them are assigned new Router Ports. Sadly, despite displaying as OK, My NAS does not respond and is not connected to the internet. Even trying again and trying to do it manually does not work as the Plusnet hub one is not on the Synology options of Routers to choose from. :(
Hi, this is a great vid but I could not go through as described, I did everything as you directed until 7:55, but the NAS informed me that port 80 & 443 are being used and should be reconfigured (something like this). I allowed to do so, upon test everything OK as on your screen at 758, but trying to connect with my phone via 4G nothing happens. I have an ASUS RT-AC68U router, which was found OK for this operation... PLEASE HELP HOW TO CARRY ON!!!! Tnx in advance :-)
@@mydoodads Good question. If ISP stands for internet service provider I have a nice box supplied by them and my WiFi router is connected to that unit.
Then I think your problem is something called Double NAT. This is when a router is behind a second router. As both routers are acting like firewalls, when you try and connect to you NAS externally. the ISP Router is blocking the link.
As mentioned in other comments. When testing from a phone, you might need to type the full SSL domain name into your browser ie domain.name. This is because it seems that (certainly in Safari on iPhone) the browser defaults to opening web pages using http rather than https. Another issue that's worth mentioning, is that certain makes and models of routers. Use port 443 for remote access. So depending on the router you are using you might need to turn off remote access to your router so that your NAS can use port 443.
@@mydoodads Thanks for fast response, l am trying from PC browsers, and l have 2 NAS servers in a different location and both of them are not forwarding to HTTPS, remote was turned off from the beginning
Try checking that in Control Panel - Network - DSM Settings. The option "Automatically redirect HTTP connection to HTTPS for DSM desktop is enabled. I would also suggest that you double check the firewall rules on your NAS and the port forwarding rule for port 443 on your router. As you need to troubleshoot where the connection problem is on your network. I would recommend that you use a network scanning tool. This will allow you to test if port 443 on your NAS is open. To test the firewall on your router (outside coming in) try using the website shields up - www.grc.com/x/ne.dll?bh0bkyd2 To test the firewall on your NAS (internal to your home network) try using the app WiFiman. WiFiman will runs on iOS or Android, and has in the Discovery section a port scanner.
@@mydoodads yes 443 on both site is open, l manage to make port-fw also 5001 to directly open only nas.domain.com, but the issue is here that always l have to write full path url: https:/nas.domain.com, in case l writte just nas.domain.com hangs on and it not redirect to https
@@MrDjegsi I think that the redirect problem can be fix by configuring Nginx on your NAS. However, currently this is not something I have had a chance to tinker with yet. So I think that by editing the config file for Nginx on your NAS, with the following code. Should force a redirect to your SSL connections. serversforhackers.com/c/redirect-http-to-https-nginx Hope this points you in the right direction.
im stuck, i dont know how to move forward .im stuck, i hava a progblem with network enviroment, it said i need to set my modem to a brige mode bur i dont know how :( and now i cant share any folde :| i have a ds918+
It sounds like your network environment consists of two routers connected together. For example you might have a router provided by your Internet Service Provider, but because this router did not provided very good WiFi to your home, you connected a second wireless router. While this works for basic internet access, it creates something called double NAT. Basically, as each router on your network has its own firewall. Your NAS is not able to get through both firewalls in order to access the internet. Also as you have two networks isolated from each other, depending on which network you connected your NAS to, will dictate if your computer can connect to your network shares. In order words, if your NAS is on one network, and your computer is on the other. Your computer will not be able to access your network shares. When your NAS says that you need to set your modem to bridge mode, basically you are looking to place one of the routers into bridge mode. This is so that the routers in your network create and behave as a single network and not two isolated networks. So I would recommend, talking to your ISP and have them help you get their hardware set to bridge mode (sometimes called modem mode). You may also need to have them help you properly setup your second router for wifi. Hope this helps point you in the right direction.
Hey there! This is an amazing tutorial series, thank you for that! Two questions: Is there also a security benefit of not using "quick connect" by Synology or just the better upgradeability? And, in one of your answers below you talked about 44 videos in this series - you meant 34, or did I miss something? Thx!
Hi J Hi J Thanks for watching the videos. Your support is greatly appreciated. However, you are right in that I made a mistake and it should be 34 videos not 44. In my defence, there are a bunch of Synology quick tip videos which supplement this main how to series? To answer your other question, I had two reasons for deciding not to make a video on setting up and using Quick Connect on a Synology NAS. Firstly, as Quick Connect tries to simplify the process for connecting a NAS to the internet. It hides the complexity involved in the process, ie configuring firewalls, Port forwarding, setting up domain name etc. So if something goes wrong with Quick Connect, because you do not have any understanding of the services that Quick Connect has configured for you. How will you be able to troubleshoot a connection problem if one occurs? The second reason I decided not to make a video on Quick Connect, does relates specifically to security. While I am not a security expert, I do have a few concerns about Quick Connect. My first is the use of a hostname for your NAS that uses a Synology domain name. So for example, by using mydoodads.synology.me, a hacker instantly knows that there is a very high probability that the device behind the domain name is a Synology NAS. So I have instantly made their lives a little easier. I also have concerns about what information Synology’s Quick Connect collects and how secure Synology’s own servers are. I would have thought that to hack Synology’s Quick Connection servers would produce a mine of useful information to any hacker. Especially, if DSM has a zero day exploit. As I personally do not use Quick Connect, but instead use a static broadband IP address, with my own unique domain name. I felt it would be hypocritical to suggest that everyone uses Quick Connect. So instead I made a video on External Access so you can see the steps involved in making a NAS accessible via the internet. The nice thing about using External Access its that you can change settings as you build your knowledge and become more confident with your NAS. However, the risk in using Quick Connect are very low, and I tend to be overly cautious when talking to others about security. So to provide some balance, Quick Connect does have its uses. For example in the comments I did recommend to someone that they use Quick Connect. This was because while they did try to setup External Access, their ISP and router would not work with DDNS. So, as a work around we used Quick Connect. Hope this answers your query.
Yes if you want to. It would just be a standard user account with limited access privileges. Edited - I would recommend not calling the account guest, enabling two factor authentication and disabling the account when it’s not being used by someone.
ive been trying to figure this out for years but unfortunately it doesn't work. i guess fritzbox routers are not made to make this work. followed every step no errors. also manually added the ports in my router. type in myname.synology.me and it doesn't load :( i'm giving up at this point.
While I don't recommend using Quick Connect, and I feel it would be better if you could use External Access. As you are having problems, and the issues could be related to the router/modem being provided by your internet service provider. Before you give up completely give Quick Connect a try.
Hello! Thank you for the precious information & indications regarding setting a NAS. I have the 1-bay model, DS120j NAS. Despite following literally all the steps described in the videos, it gives me an error: "This site can`t be reached! octavianh.synology.me refused to connect. Try: Checking the connection; Checking the proxy and the firewall; ERR_CONNECTION_REFUSED". At details it shows me this: Check your Internet connection Check any cables and reboot any routers, modems, or other network devices you may be using. Allow Chrome to access the network in your firewall or antivirus settings. If it is already listed as a program allowed to access the network, try removing it from the list and adding it again. If you use a proxy server… Check your proxy settings or contact your network administrator to make sure the proxy server is working. If you don't believe you should be using a proxy server: Go to the Chrome menu > Settings > Show advanced settings… > Change proxy settings… > LAN Settings and deselect "Use a proxy server for your LAN". Could you please tell me what should I do? Thank you!
I think that you might have a problem with the port forwarding from your router to your NAS. I know that certain models of routers, do require that both the ports on the routers firewall and port forwarding rules need to be enabled, in order for you to access your NAS via the internet.
Great video. Can you do a video on connecting to the NAS via VPN as well as using VPN on the NAS to allow Download Station to run without interrupting other services.
When I try to access it from my phone browser, it gives me an error saying page not found. If i try the public IP with port :5000 it takes me to the login page. What could i be doing wrong?
I don’t think you have done anything wrong. In order for you to be able to access services on your NAS, each service will require its own port number. For example in order to access the DSM you would use port 5000 or 5001. Port 5001 being the port used for an SSL connection. So when you type the host name of your NAS into your phone browser, by default that browser will try and access content on port 80 or port 443. However, if Web Station has not been installed on your NAS (as in the NAS in the video) because your NAS is unable to redirect you to a Web Server, you will be automatically directed to the DSM login page. If you do have Web Station installed on your NAS, it will automatically point any web traffic to the contents of your Web Server. If you open File Station and take a look at the folder structure. You should see a folder called Web. This is were your NAS is redirecting visitors. Check to see if you have an index.html file at the top of the file structure in the Web folder. If you don’t, try creating a simple html page (called index.html, and then see if you can load that page from your phones browser. Its also worth checking your Firewall to see if traffic for ports 80 and port 443 have been blocked. Hope this helps.
@@mydoodads Hello. Just trying to follow this thread as I seem to have the same problem. Having read your reply I have checked a few things but I am still unable to access from from mobile device. Noting that I don't have Web station installed, so would expect to be directed to DSM Login page. Also My port 80 on my Firewall is ticked and so is 443, but I don't see port 442 anywhere. I've also ensured that ports 80 & 443 are at the top of the firewall rules, so where else could I be going wrong? thanks
@@martinpayne5251Sorry I was being a muppet and mistyped 442, it should be 443. My apologies and I have edited my previous comment. As I used an iPhone in the video to test the connection. I have subsequently noticed that iOS has a quirk that will prevent it from loading your NAS front-page if you just try and type name.synolog.me Instead, I found that you need to type name.synology.me:5001 or name.synology.me:5000 If/once you successfully connect using that method, subsequent attempts to connect only require that you type name.synology.me, iOS seems to figure out the rest. Hopefully, this is also were your problem lays.
Quick Connect works by establishing a secure connect to a Synology server that then connects your NAS to the internet. As data will be passing through Synology’s servers it’s possible that Synology might be collecting our data. However, I would think this unlikely as Synology need us as consumers to trust their products. Instead the main security concern I have, would be what happens if Synology’s servers are hacked? So I choose to use Direct Access as it gives me the illusion of control over my NAS. This is not to say Quick Connect does not have its uses. If you are new to servers, Quick Connect is very easy to setup and requires less understand of networking. So I personally recommend that people try setting up Direct Access first, but if they can’t get it to work they should try defaulting to Quick Connect. Hope that helps answer your query.
@@mydoodads Thank you for your response! I tried setting up direct connect using your tutorial and it worked. Now I have https and will attempt to setup PIA VPN. Not quite sure yet if once I setup VPN on my NAS any user will be automatically using that VPN or will they need some client on their end. I just use a client on my PC and don't know much about setting it up on a NAS.
A pleasure. It might be worth checking out my videos on setting up VPN server. There are also video on how to configure VPN clients in Windows 10, macOS, iOS and Android.
Brilliant series of videos, thank you! Makes our lives a lot easier as Synology do not provide useful manuals. Quick question for anyone out there ... my Asus router with UPnP enabled does get rules from the Synology NAS, but gives me local port 80 and router port e.g. 46410 say and I cannot force port mapping. Any ideas why or a work around? Is there a way to wipe the ports forward rules in the router (yes I dd factory reset but to no avail.) thanks all
@@Mr.PetePrice Unfortunately, I don't have a video on your specific problem. However, to try and point you in the right direction. My initial suspicion would be to double check your firewall ports. This could be the firewall on your NAS (if enabled) or the firewall on your router, or a combination of both firewalls. Also try using Shields up, which can be found on the www.grc.com website to help you identify which ports on your routers firewall are open. By using this Synology article and by using Shields up you can double check which ports are open and which ports you need to have open in order to get different services working - www.synology.com/da-dk/knowledgebase/DSM/tutorial/Network/What_network_ports_are_used_by_Synology_services Its also worth noting that while your NAS might report that its compatible with your router. It may not fully be able to configure the routers firewall. So you might need to manually configure port forwarding rules on your router. Just for your reference this is the UA-cam playlist for all my How to setup a Synology NAS - ua-cam.com/video/Yua6dGpg4qo/v-deo.html However, I think the playlist from my website is easier to work with - my-doodads.com/series/how-to-setup-and-configure-a-synology-nas/ Hope this helps you find and fix your problem.
Everything works fine for me until I get to the step where he disables ports 5000 and 80 to force connections to use SSL. After I do that, I can no longer connect from my phone using the DDNS name. Anyone have any idea why? Also, every time I connect with my laptop it tells me my connection is not private. I don't have the same issue from my phone.
I found that (particularly on a smart phone) I would have to type the link ie mydomain.com into my browser in order to connect securely. The browser would then automatically default to using after that point. The other problem relates to the Let’s Encrypt SSL certificate, being used to certify your public IP address. As the SSL certificate is using the public IP address identified by your DDNS service. When you try and access your NAS locally, the certificate does not match the local IP address (ie 192.168.1.x). This in turn prevents you from getting the padlock symbol, while also giving you the “Connection is not Private” message in your browser. You could simply force your browser to accept that you are not using a fully authenticated SSL connection when connecting via your LAN (Local Area Network). This is the easiest fix, and should be fine as long as your home network has not been compromised. However, the actual fix is more complicated in that it requires that you basically undo all of your current settings and then recreate them using different services. What you are basically looking to do is use an internal and external DNS service. However, as this is not something that I have covered please take a look at this video made by WIllie Howe - ua-cam.com/video/daIelVuKlYQ/v-deo.html Hope this helps
@@mydoodads Thank you, manually typing in in front of the domain name worked! One other question I have is that in your video, you disable the http port forwarding rules. However, I noticed there was an option to automatically forward http to https. Is there a difference in terms of security in either 1) disabling the http port forwarding, and 2) leaving http port forwarding enabled but selecting the option to forward http to https?
@@mdaily733 I don't think there is a right or wrong answer to that question. The reason why in the video I disabled the http port via the firewall in the video. Was that I thought it would help people to better understand their firewalls, and help build confidence in navigating the settings when configuring their Synology NAS. In terms of security, it often does not do any harm to use a belt and braces approach. So, by blocking http traffic in your firewall, you will know for sure that no http links can be made to your NAS. Also while I might be looking in the wrong place. I think you are referring to a setting on my NAS called "Automatically redirect http connection to https for DSM desktop" . This is a setting which can be found in the DSM - Control Panel - Network - General I think this setting use to be called "Automatically redirect HTTP connections to HTTPS (Web Station and Photo Station excluded)" So its meaning may have changed over time, or different models of NAS display slightly different setting options. Either way, I can't see it doing any harm to both enable the HTTP to HTTPS redirect, setting and also change your firewall.
I tried this but all I'm getting on my phone browser is "connection timed out" I get a notification on my nas "Failed to register ip address 109.78.**.** to hostname to TonyNAS.synology.me (This hostname is already used) I'm confused ?
When you were testing, were you able from your phone, to connect to your NAS using only the IP address that was assigned to your broadband connection? If you did, then that test confirms that your NAS was able to configure the firewall on your router using UPnP. However, if it did not then there was a problem reconfiguring the firewall on your router. So you might have to manually create port forwards on your router rather than rely on UPnP. A potential issue, may be if you have "upgraded" the WiFi in your home. As many ISP's can be difficult about using third party routers. If you simply disable WiFi on the router provided by your IPS and then connected a second Wireless router. You will have created something called a double NAT. So while your second router may pass the UPnP test. That router is unable to get past the firewall on the router provided by your ISP. Unfortunately, in order to get around this issue you will have to work out how to resolve you double NAT problem. If you can access your NAS by using your broadband connection's IP address, then the problem relates to DDNS. One of the issues with using any "free" DDNS service, it that you are dependent on that service providing a good level of service. So it's possible, something is wrong with Synology's DDNS service. So it might be worth trying a different DDNS service provider. As, updating DNS servers may not be instantaneous, and it's not unheard of for an update to DNS to take up to 72 hours. If you are inheriting a hostname from someone who no longer uses that host name. You might have to wait for the multiple DNS servers on the internet to update, before you host name is able to connect back to your NAS. Hope this helps.
@@mydoodads Thank you for your very detailed reply. However I will be the first to say that beyond this point I am totally out of my depth & wouldn't know how to go forward with this. I will look at the video & your reply again & see if I can understand how to proceed further. I have followed all your videos on the Synology NAS & up to now was able to carry out the instructions they contained without any problem. I will say that the modem provided by my ISP isn't of a great standard & quite a few people have repeatedly complained about their quality. My ISP will not give the required details in order to allow its subscribers to use a third party modem / router. They simply say they will nor provide any support for third party routers.
@@tonydaly2642 Hi Tony, can I suggest you try QuickConnect first. Synology claim that it can punch through firewalls so it might offer you a simple solution.
@@mydoodads I've tried QuickConnect & it worked fine. I was able to log into my Synology NAS & view all settings etc. Using the various DS programs I was able to play movies, listen to music, view photo's etc. Thanks for the suggestion & all your help. Tony.
As you UPnP on your NAS will not automatically allow you to configure your Virgin Media Hub. You will need to manually enable port forwarding yourself. So you will need to do the following: 1. Note down the Port numbers to the services on your NAS that you want to have access to remotely. I would recommend that until you get familiar with what you are doing. Try enabling only one service at a time. I would suggest starting with something like DSM (ports 5000 and 5001). www.synology.com/en-us/knowledgebase/DSM/tutorial/Network/What_network_ports_are_used_by_Synology_services 2. Access the settings on your Virgin Media Hub, and make sure that from within DHCP you have assigned a static IP address to your NAS. 3. Try and setup DDNS on your NAS (if you have not already enabled it) 4. Return to your Media Hub and create the port forwards to your NAS for Audio Station. As I am not familiar with Virgin Media Hub 3, these notes on port forwarding might help you - www.cfos.de/en-gb/cfos-personal-net/port-forwarding/virgin-media-hub-30.htm 5. Test that you can remotely access the DSM 6. Rinse and repeat for any services you want remote access to. Hope this points you in the right direction.
@@mydoodads I have followed all your lessons on UA-cam Belinda now on lesson 34 for it tells me I need to set my router to bridge mode but my router don't have Bridge mode and to check that my public domain name is checked Does that mean I need to buy a new router
What happens if you type yourname.diskstation.me:5001? For example does it open your DSM rather than your QNAP NAS page? If it does then the issue might be related to your routers firewall and port forwarding rules. While Im not as familiar with QNAP NAS devices, I think they will open QTS via port 8080. Just for your info DSM opens on ports 5000 and 5001. It's worth noting that Port 80 and port 8080 are both default web services ports. either
@@mydoodads Man, you really know your stuff! You did it again!! :-) It was in fact opening with port 8080! However, I don't understand why it resolves to port 8080 instead of 5000 when I simply type myname.diskstation.me ? Not a big issue but odd. Anyway, I now know how to get to each NAS with only changing the port number instead of a dedicated DDNS for each....that's the upside of this annoyance ;-)
I have a question. With the help of your videos, I was able to set up external access securely. Here is the problem... the site works well using mysite.synology.me (and I get the padlock).... I have blocked 5000 non secured connections... but the site is accessible with myIPaddress:5001 and that's not secured. How can I stop the connection with the IP address? Thanks!
@@akheraj81 I think in the first instance try checking that a setting on your NAS called "Automatic redirect HTTP connections to HTTPS (Web Station and Photo Station excluded" has been enabled. You will find this setting in Control Panel - Network - DSM Settings
@@mydoodads Thank you. It was not checked, so I checked it. But that didn't solve the problem. I can still access it by external IP address, so when I go to :5001, it works but doesn't have the padlock so it's not secured. The certificate I believe is for mydomainname.synology.me
I have the same issue. I can access my NAS using the *.synology.me:5001 on my phone, but not on my PC. On PC i can access it only using the internal IP and this IP is not secured
@mydoodads when I enter my ip into my browser, I get this message; "Web Station has been enabled. To finish setting up your website, please see the "Web Service" section of DSM Help" And if I try using my synology.me DDNS, I get THIS message; This site can't be reached XXXXXXX.synology.me took too long to respond Try: Checking the connection ERR_CONNECTION_TIMED_OUT -------------------------------------------------------------------------- So what does that mean doodads ?
WebStation is automatically enabled when you install the Photo Station package. As WebStation is a web page server, it automatically becomes the default service that your NAS points to. So when you enter the IP address of your NAS into your browser, you are automatically shown whatever file has been placed in WebStation. However by default, as currently you have no web pages in WebStation you get the message you see. So if you create a simple HTML file on your computer and name it index.htm. By placing that file in the Web folder of your NAS (you will find a share called Web if you open File Station). Now when you enter your IP address in your browser, you will see your html file. As your IP address now defaults to WebStation. In order to access other services you will need to use either its alias or its port number. So for example to access the DSM you would use 192.168.1.2:5000 Then for something like Video Station you would use 192.168.1.2/video On my personal NAS I was able to stop WebStation from hosting web pages. I think it was simply to uninstall WebStation, so I’ll add this to my list of tip videos to make in the future. As to your second question, on your home network do you have a branded wireless router which you have connected to the WiFi router that was provided by your Internet Service Provider?
@@mydoodads -- Ok, I'll give that tip you mentioned a try. I'll let you know how it works. I THINK I understand what you're saying, but I'll give it a shot ! No, I'm not using my ISP's router/modem. I'm using it in "bridged mode", and I have an ASUS RT AC-5300, a top drawer tri-band router that runs on DD-WRT, so it's a very flexible piece of kit.. . . not cheap either. This is what I use to run my network.
@@mydoodads -- Well I gave it a try. .. . and for a short time it seemed to work. . . . then same error message and stalled web page. Allow me to explain; -- I created a simple html doc and placed it in my "PUBLIC" folder [the folder I want to designate as where I will drop files etc for friends I want to grant access to look at and download. -- I tested it with my iphone with wifi turned off to put my device "outside" my network, as you did in this video. -- I tested it and it worked ! ! ! ! I used the username and password I gave to my friend and it worked just fine. -- I notified him that it was up and go at it [btw, I live in Canada, and he is in Ireland. . . but that shouldn't matter right ? ] -- He tried it and got essentially a stalling web page that failed to load and gave him a message like "Hmmmm cannot reach this webpage. .. blah blah check that the address is correct, check your internet is working, , , same standard crap. -- I went in and tried it again with my device "outside my network, and sure enough I could not get in either. -- I decided to re-UPDATE my ddns address, it did it's thing and I got the green letters saying normal. And i re-did the "configure router" settings as well. Then I hit test and got ok's for the connections I wanted. -- Tried it again and now the test connections tab is stalling. I am at a loss as to what to do mydoodads.
All connections keep showing failed under External Access - Router Configuration. I've gone back to part 33 and meticulously checked everything all the way through to this failure. I have a Netgear Nighthawk ax12 router and everything else has worked perfectly up to this point. any suggestions?
Hi Fred, I did try to be as generic as I could when making the video. As I do realise that there are so many different models and makes of router on the market. I suspect that the Nighhawk ax12 router may not be supported by your Synology NAS. I did a quick check and I can't see your router listed in Synology's compatibility document - www.synology.com/en-uk/compatibility?search_by=category&category=routers&p=7 If that is the case, then you are going to need to manually setup port forwarding rules from your router to your NAS. If you did not assign your NAS with a static IP address, I would recommend that you do that first. Please see part 4 in the series. Can I also suggest that you keep things simple and start by just creating a port forward rule for Management UI - TCP 5000 and 5001. Then test to see if it works. If you are successful, then create port forwards to the other services you want remote access to on your NAS. I took a quick look at the user manual for your router. It should be fairly straight forward to manually create any port forwarding rules that you need. There is even a section in the manual called "Manage port forwarding to a local server" page 152 Netgear manual - www.downloads.netgear.com/files/GDC/RAX120/RAX120_UM_EN.pdf Sorry, I cant be more help.
@@fredwright3790 Jesus he took like 30 min to write his answer and you have nothing more to say that "Thank you, I will try that." without even letting him know if it worked. What a lack of education.
I am downloading this series and storing it in my NAS - I need a backup of such a wonderful series. Thank you
This was what I was looking for long time. This is huge time savings and fully explainable for new Synology users. Thanks a ton.
I can't thank you enough for an amazing series of videos. I watched all of them , They're a top notch quality. I learned a lot from you.
Please continue producing these kind of videos. I will be waiting for it.
Thank you again, I really appreciate it. 😁😁😁
Just finishing up having spent most of today going through each of your videos and making notes. WOW, what a tremendous resource you are. Great style; Not too fast and not too slow; Well broken-up modules allowing me to skip a very few things I’m not interested in for now. Tomorrow I plan to finish up my plans and place an order for a new DS1520+ to house my 17TB of existing media and data, thanks to the confidence you’ve instilled in me, and answering a couple long-standing questions as to “why” some of the options may be something I should consider or not. There is still a whole lot to this world of NAS from what I explored a few years ago with Synology, and there is more complexity compared to the various types of DAS I’ve owned, including two Drobo, but I’m looking forward to the new experience and possibilities only a NAS can provide. Thank you again. I don’t have higher praise for what you’ve provided the community.
Thank you, and good luck with your build.
Absolutely brilliant series of videos without which my computer, NAS and router would have been launched out the window! 👍🏼Looking forward to future videos!
MY Router Does not detect UPnP even though i have it enabled, I know how to port forward but can you recommend a video that does port forwarding specifically for Synology NAS.
The same goes for me, really top notch instruction video series. I am in the process of watching and implementing them on my NAS and is of great help to at least understand basic properties of such a complex system. I can’t thank you enough for these highly professional and excellent explanatory video’s. you have gained another follower in me!
As many ISPs have specific (and cheap) gateway devices (modem/router combos) that have limited capability (e.g. NVG599), I suspect many people (like myself) have purchased better quality routers and are using the ISP's device only as a modem. However, for external access, this requires trying to accomplish Port Forwarding through 2 devices (using IP Passthrough), which has been quite challenging (I have been unsuccessful - under External Access, Router Configuration, Connection Test Result , the UPnP fails, even though the rules show up in the router's UI). It would be great if you could address that scenario for those of us who have 2 devices and want external access for our NAS. (BTW - Your videos are absolutely fantastic - head and shoulders above the rest - very professional - can't wait for the VPN segment.)
Hi Steve,
I agree, so I plan to make a follow up video that will try and cover generic issues and how to get around them.
I'm a little worried that I will not be able to cover, every eventuality, simply because of the number of router/modems in existence, individual ISP rules and the numerous ways that someone could have configured their home network.
So I want to monitor the comments for this video to see where people are having difficulties. Which means that I may not get a chance to post the follow up video until next year.
In the meantime, these are the potential gotcha's I have identified so far. So I have noted them here as they might help point others in the right direction.
Double NAT, where the router provided by an ISP is connected to a new wireless router, but the router from the ISP has not been set to bridge mode. Which means your running a Local network (192.168.1.*) inside of a second Local network (192.168.0.*). However, I suspect that Bridge mode may not be possible with all ISP provided hardware.
UPnP is not compatible with your model of Synology NAS and the router you are using. While I once did use a router that was classed as not compatible with my NAS. My NAS was still able to create port forward rules, which did allow me to connect remotely via the internet. So its worth testing your connection even if your NAS reports that the router is not UPnP compatible.
If UPnP compatibility is a problem, then you will have to manually create port forwarding rules from your router to your NAS.
Thank you so much for your reply. Regarding your suggestions:
1) I have a separate subnet for the NAS. The local network from the ISP's modem / router is 192.168.1.X and the NAS's network is 172.X.X.X.
2) DSM determined that UPnP was compatible for the NAS (DS1817) and the router (see step 4 below).
3) I did set up a static IP (192.168.1.Y) for the 2nd router (a Nighthawk x10 9000).
Could I suggest walking through the following in a future video:
1) On the ISP's modem / router, you have set up IP Passthrough (Allocation Mode: Passthrough, Passthrough Mode: DHCP-fixed, Passthrough Fixed MAC Address: [MAC address of 2nd router]), you have disabled all firewall settings (confirming with the ISP that this is their only means of Port Blocking) and have disabled all wireless networks. You have not set this modem / router to Bridge Mode because this cheap modem / router does not have a Bridge Mode setting.
2) For your 2nd router, you have established a static IP address and you have ensured the NAS is in a separate subnet.
3) You start in DSM from "External Access, Router Configuration, Set up router". You get green check marks from "Detect Router Information, except for "Checking Network Environment", with a note at the bottom that states "WARNING: Two or more routers were found on your network. Please consult your Internet service provider to set the modem/router to Bridge Mode, or try setting your router to Bridge Mode."
4) After hitting Next, the 2nd router is found to be UPnP compatible (though it may not be one of the Wireless Routers in the Compatibility List on the Synology website) and you hit Apply and Save.
5) You create the port forwarding rules using Create (as per Part 34 of your series).
6) After hitting Apply and Save, the Connection Test Result column shows Failed.
7) You try to access the public IP via your smartphone and you are unable to do so.
8) However, the port forwarding rules are all found properly in the UPnP section of the 2nd router's UI - all data is confirmed to be correct (Protocol, Int & Ext Port, IP address).
At this point, are there certain settings to check / tests to run to determine what could be interfering (either from the ISP's modem / router or the 2nd router)? Is it better to abandon UPnP (turn UPnP off the 2nd router) and manually create port forwarding rules in the 2nd router's UI? How do you test along the way / diagnose if something goes wrong (like Connection Test Result shows Failed)? How will VPN play into this environment?
I know there are a ton of routers, but perhaps you could demonstrate using the top 3-4 brands (e.g. T-P Link, Asus, Netgear, D-Link) as:
1) The user interface is usually similar across various routers from the same company, and
2) The value of your videos (above the rest) is that other do a step-by-step demo - assuming everything will be go perfectly the first time, whereas you flush out the objectives, terminology and why the choices are made. By using the top 3-4 routers, it should provide enough examples to help others who use a less popular brand of router - even if the interface is different.
My humble suggestion / food for thought...and if, in the interim, you have any thoughts, I would appreciate it.
Once again, thank you for your videos and your support.
ISSUE SOLVED (and I'm a little embarrassed) - A static IP was set up for the second router, not allowing the public IP to be passed through. Aaauuggghh! Everything is working just fine now. Moving on to VPN.
@@stevemayfield1667 Thanks Steve for sharing your experience.
As long as your home network works the way you want it to you have nothing to be embarrassed about.
Unfortunately, my router is not supported. This guide saved me though.
You showed me which ports I only need to put in my router (4, later 2) to gain file access over network and that was super helpful. Thank you :)
Thank you for your time and work put into this series! I am able to make better use of my NAS! Looking forward to whats next. Cheers! and THX again!
Such a great explanation, deep, informative, and straight to the point! Huge thanks for your work!
Hello. Like many others have posted, your videos are amazing. I’ve watched the entire series on “How to set up a Synology NAS” and your detailed explanations for each step are incredibly helpful. Thank you so much for these tutorials.
I am, however, having an issue with my NAS related to “Part 34: Configuring a NAS for External Access” and hoping you can provide advice to help get this set up.
As I attempt to set up my router, I get the following two error messages:
1 - Warning: Two or more routers were found on your network. Please consult your Internet service provider to set the modem/router to Bridge Mode or try setting your router to Bridge Mode.
2- Note: Your router is not listed in the Synology UPnP compatibility database. Please click Next to go to the compatibility test page.
To address the first warning message, I spoke with my ISP service technician and he confirmed that I have only one router on my home network. In addition to this, they have installed a booster to provide better wireless coverage throughout our house, but he assured me that the booster system was not a second router and stated that this should not be causing this issue.
For the second note, I accessed my router’s settings and did confirm that it is UPnP compatible. When clicking “Next” during this Synology router set up, it does show that a “UPnP router” (my router) was found and lists its brand, model and firmware version. When I select the “Quick (recommended)” option, I get the following message:
Failed to save all port forwarding rules. Please make sure you have enabled all necessary UPnP configurations on the router. If the problem persists, this UPnP router may be incompatible.
I then click “Exit”, leaving the option to submit the results to Synology to contribute to their product development selected.
I’ve reattempted this router set up a number of times over the last couple of months thinking Synology may provide updates to their compatibility database, but each time it is unsuccessful.
Can you provide any insight into what the issue might be and how/if I might resolve without purchasing a new router?
Thanks
Before I start, in the first instance I would suggest that you try using Synology’s QuickConnect rather than External Access. While External Access is my preferred method for connecting a NAS to the internet, QuickConnect may prove the easier solution to the one I’m about to discuss.
Unfortunately, what you have described is a complicated issue made more difficult to fix due to the way your home network has been configured. However, it’s possible that by fixing one problem the second problem might automatically fix itself. So let’s start with the biggest issue.
I suspect that you were on the correct path, when you spoke to your ISP service technician about your router and the wireless extender that they installed into your home. Like you, based on the warning messages that you have received, I would contradict your ISP service technician and suggest that your “WiFI booster” system is causing network problems for your NAS. This is related to something called Double NAT.
As defined by Netgear, “Double NAT is when you connect your router behind another router creating two different private networks. For example, connecting your NETGEAR router behind a modem/router provided by your ISP. Double NAT does not prevent your devices access to the internet but may cause problems with playing online games, opening a specific service port, connecting to a VPN tunnel, or visiting secure sites with SSL. Also, the devices connected to the first private network may not be able to communicate to the devices connected to the other private network.” - kb.netgear.com/30186/What-is-Double-NAT
Your ISP probably issued you with an all in one modem/WiFi router. However as WIFi was not able to cover your whole house they then fitted what you have described as a WiFi booster. As you did not mention specific models, the WIFi booster could be a Mesh network or a simple wifi extender.
Unfortunately, a common mistake to make when fitting WiFI extenders is to simply disable DHCP and WiFi on the modem/WiFi router supplied by the ISP. Then by plugging the WiFI booster into one of the network ports on the back of the modem/WiFI router you create a new WIFi network. However, as you are running a router behind another router you have also created a Double NAT.
What should happen is the ISP modem/WiFi router is placed in bridge mode (also referred to as “modem mode” on some models of WIFI routers) . The wifi booster or extender is then connected to the modem/WiFi router and configured without creating a Double NAT.
With luck your WIFi booster has a firewall and is compatible with your NAS so External Access should start to work. However, if your WiFI booster is not compatible, then you will have to manually configure the Firewall and any port forwarding rules to your NAS.
It’s worth noting that ISP engineers do have to work within the limitations of the hardware that the ISP provide. This means that they are often working with cheep and poor quality components. So it possible that your home network is simply the best that your ISP engineer can offer based off the hardware that they have available.
Also from a compatibility stand point, Synology definitely support their own models of WiFI routers to make sure they are fully compatible with their NAS devices. Unfortunately, because of the number of brands and models of routers on the market, I do suspect that Synology are not able to keep their compatibility list up to date. So you might find manually configuring your firewall and port forwarding rules is the only way to make your NAS remotely accessible.
Sorry, that this response is a little generic, unfortunately as this is a complicated topic with many variables I cant be too specific. However, I do hope that this at least points you in the right direction. Please note that I will be making a video on Double NAT, manually configuring router firewalls and port forwarding as soon as I purchase a router that is not compatible with my NAS so please look out for that video.
@@mydoodads Thank you very much for your response. I’ll read through your recommendations and try again.
Thank you for taking the time to submit these instructional videos. I have followed each one to the letter as much I was able with a slightly different configuration here and there. I am almost to the finish line but I'm stuck on this lesson. When I try to "set up router" I get this note: "Your UPnP router did not pass the compatibility test. You can click Next and set up port forwarding rules manually...". When I hit "next" and click "select your router", it doesn't show up under the updated list. So, at this point, I'm lost. I can get into my router's settings via a web browser but I'm ignorant as to how to set up the port forwarding I need. I saw somewhere that you were thinking about submitting a video for those who need to be walked through this. I would very much appreciate a video on this. Thank you, again. I have subscribed to your channel.
From the comments, I have come to realise that anyone looking to setup External Access on their Synology NAS, potentially face two basic issues, Double NAT and Port Forwarding.
However, as Double NAT and Port Forwarding are issues specific to the make and model of router that someone has. I have decided that the "How to setup a Synology NAS" series will only show someone how to complete a basic setup of DSM6, from within an ideal network. So I'm slowly starting to wind-down the series.
Then when DSM7 is released, I will start a new series. However, this series while running through the same basic content, will take on board what I learnt from my previous series. So while we wait for DSM7, I will be making a few additional videos for the Synology NAS tips series. These will include, data recovery, migrating to a new NAS and providing a summary of the issues and problems someone might face when setting up External Access.
However, as these issues and problems tend to be related to, the make and model of Wireless router someone is using. My plan/idea going forward is to spend some time posting videos about how to setup a few of the more popular brands of Wireless Routers and Mesh networks.
Then for each of these series I will try and specifically look at how to avoid Double NAT and how to deal with port forwarding for a Synology NAS. That way I can give people a walk through on how to set-up port forwarding.
Currently I am working on a series about how to setup Google Nest Wifi, which I hope will be finished in January. It is then my intention to use the video footage from that series to make my follow up video on External Access. However, that video will be very generic.
When i load my page, it was still on port 5000, when i restart the NAS, i get 5001, well done, thank you.
Amazing video, top quality (as usual)
It was a good tutorial and mine is working now just as I wanted it to. No more quick connect! It seems to use R3 now instead of Let's encrypt. Mine didn't work with port 5001 for about half an hour, but I think this was due to updates to DNS.
So easy to follow!
I'm still having issues getting my external access - I have followed all the steps carefully, however when I try to navigate to my public IP address, it keeps saying the site can't be reached. I have two other IP addresses that show up when I run the synology assistant, and I have tried those externally, and still can't get it to load.
My quickconnect id works though! Any thoughts? Please!
Remove quickconnect and add port 80 manually :)
As it's difficult to know exactly where the problem might be. The following troubleshooting tips might help you isolate where the problem is.
1. Make sure that your network has not been configured with Double NAT - two wireless routers connected together. If I remember correctly, Synology Easy Access is designed to work around Double NAT, but Direct Access is not.
2. I'm not sure why you are seeing two additional IP addresses when you use Synology Assistant. Do you have more than one network cable plugged into your NAS?
So I would suggest that you check to see what public IP address your home network is using and compare it to the one your use when trying to connect remotely. You can do this by doing the following in Windows - ua-cam.com/video/6rVON42BQNo/v-deo.html or by doing - ua-cam.com/video/nGZVJCNJEYw/v-deo.html in macOS.
3. Shields-up (www.grc.com) can be very useful as it will tell you if the correct ports to your NAS are open.
However, rather than trying to do an "All Service Ports" test. You need to use the "User Specified Customer Port Probe" and test the ports that need to be open for remote access to work.
For example try testing ports 5000 (http) and 5001 (https) as these are the ports used by DSM.
You should expect Shields-up to report that the ports are open and not closed. However, your router might be protecting your network so your router could also be making the ports "Stealth".
4. If Shields-up is not able to see that you have ports open. You need to double check that port forwarding on your router has been correctly configured. Unfortunately, I can't offer any advice as this will be dependent on the make and model of router you are using.
5. Double check the firewall on your NAS and make sure that ports 5000 and 5001 have been placed above the close all ports rule. That an easy mistake to make.
6. If you are using an iPhone to test your connection to your NAS. In Safari I would recommend that you type the full address to your NAS in. For example [ipaddress or domain name]. For some reason Safari will fail to load the DSM the first time you try to access it remotely, unless you type the bit.
Hope these tips make sense and help fix your problem.
Fantastic tutorial. Many thanks for this clear presentation. It works like a charm.
Very clear and practical instructions! Thank you.
Very well expained video!
In understand this is to access my NAS from a browser. But how can I have access externally in order to open files from a software? I mean, that my NAS could appear in my Finder?
Thanks in advance!
Once you have completed this stage, there are a number of ways to remotely access NAS files from Finder. However, the one I recommend you look into is via VPN.
Hopefully the following videos from our series will help you setup what you are looking to do.
How to setup a Synology NAS - part 35 - ua-cam.com/video/mciaffXvXAM/v-deo.html
How to setup a Synology NAS - part 36 - ua-cam.com/video/xlAXJnisPB4/v-deo.html
How to setup a Synology NAS - part 37 -
ua-cam.com/video/iqgp2L1K6RQ/v-deo.html
😃
Hi, great video on remotely accessing the Synology Nas. I had a few quick questions on remotely accessing the Synology NAS over the internet:
1) I've read that the most secure way of having your Nas over the internet is to have the VPN server installed at the edge of your network (by the router) instead of the NAS. Any truths to this? Instead of installing a VPN Server on the Synology (as one of your later videos shows), I set up a VPN Server using OpenVPN on my Router (ASUS RT-86u) instead. I managed to set it up on the router. And I used OpenVPN Connect as the client on the remote computer to connect to my Synology Nas. I am able to access the Synology DSM file station to browse files remotely from the remote computer.
2) However, and this is my second question - I want the remote computer to be able to also use the Synology network shared drives as an internal windows drive - without having to go through the Synology web interface. So by this I mean when opening a Windows 10 folder on the remote computer, I want the user of that computer to be able to see the Synology network share folder on the left hand side and being able to edit, move, rename files all within Windows 10 - not on the Synology web interface. I find using Synology's web interface is clunky and slow. How would I best be able to set up network mapping of my Synology drives to the Windows 10 computer?
3) I have read that WebDAV maybe the way to do it? Is that the only way? I'm looking for a simpler solution. I know that when I want to access the NAS via LAN in my internal network its easy to map a network drive via Windows. But for remote computers I am having great difficulty if you can please help me figure this part out? What am I missing?
Lets take a look at your quick questions.
1. I’m not sure if installing a VPN server on your router is any more or less secure than installing it on your NAS. However, the primary reasons why I installed VPN server on the NAS rather than the router are as follows:
a) Not everyone has a router that can be configured to work as a VPN Server.
b) I wanted to try and keep things as simple to understand as possible.
c) Routing tables might be an issue. You may have noticed that in my series, I demonstrated how to install and configure a DNS server. The underlying reason for me doing this, was to fix a routing problem between macOS, VPN Server and my Synology NAS.
2. I would suggest that if you are having to use Synology’s Web interface to access your network drives when you VPN in. You might have a problem. In the video we look at how to setup TCP/IPSec VPN on both macOS and Windows 10. However, because IPSec will not allow Bonjour and NETBIOS broadcast traffic through the VPN tunnel. We were not able to use File Explorer or Find to navigate to the shares on our NAS.
Instead we have to manually mount our network shares each time we want to use them. However, I don’t think this should be a problem for you as you are using OpenVPN.
So as a test, try accessing your network shares by opening File Explorer and in the address bar typing //192.168.1.x/folder name. When you press enter on the keyboard it should open your network shares.
Then as a work around simply use File Explorer to create map network drives for your shares. As the location where you create a mapped network drive has changed a bit over time. If you are using Windows 10 update 2004 (or above), in File Explorer under the Computer tab, is an option called map network drive. Just follow the wizard to create a mapped drive.
The mapped drive will remain in File Explorer regardless of its connection state. However, if File Explorer is not able to connect to your NAS, the mapped drive icon will display a red cross.
3. I don’t think that WebDAV is the way to go. WebDAV is basically a web technology that makes remotely accessing network drives simpler, and in theory without the need for a VPN connection. However, you really should not need to be using a secondary service to access network shares if you are already using VPN.
As mentioned above you should be able to access your network shares when you use VPN. However when using VPN, check to see what IP address you computer is using. Also try running a PING test to see if your NAS is viable along with trying to access your NAS using its IP address.
If all of these test work, then create maps to your network shares. In the past I would have recommended that you create a batch file or a Power Shell Script to auto mount your network drives at log in. However, Microsoft in their infinite wisdom decided that being able to run scripts in Windows was a security issue. So both batch and Power Shell scripts will no longer run unless you start fiddling with Windows 10.
However if you find that none of the tests work, that would lead me full circle to wonder if perhaps you have a routing problem to your NAS when you VPN in. So maybe investigate how you would change the routing tables on your NAS or router.
Hope this points you in the right direction, sorry I cant be of more help.
Certificates will auto renew every 90 days. Do we need to enable port 80 on NAS and router for renewal process by Lets Encrypt?
Hy, thank you for the video.
It help alot for my nas problem. I have one more problem that I hope you can help me with. I need to use printer/scanner xerox docucentre IV 5070 to automatically send scanned documents to My Synology Nas. I've search around the web for quite some time for this problem, but can't find any solution yet. Can you help me with this problem? Thanks in advance.
Firstly, I want to say thank you for this well made walk-through. It was very thorough.
My question is related to what happens to other port forwarding I already have on my home router.
After the router identification, if I click to save, it warns "this will overwrite existing port forwarding rules for the router".
Does this apply only to the router configuration on Synology interface?
Or
Does this imply it will delete my other port forwarding configuration on my Netgear router for other computers/apps?
I'm asking as I have tons of other port forwarding rules on my Netegear router that I want untouched. Thanks for your help.
I would suspect that because UPnP is enabled on your Netgear router. Your NAS will clear down your existing port forwarding rules, and presume that any devices that had previously created port forwards, would simply recreate their forwarding rules.
So for example, I have a Playstation. So when my NAS enables port forward rules on my router. My Playstation will simply re-add its port foward rules to my router the next time I switch it on.
Personally, if I were in your situation I would err on the side of caution and first make a note of all the existing port forwards being made to my router.
Then as you have tons of other port forwards I would be tempted to manually create all of the port forwards to my NAS rather than rely on using UPnP.
Hope that helps.
@@mydoodads You're simply amazing. I wasn't expecting a response so quickly. It's well appreciated and I'll definitely take screenshots of my port forwarding rules before I do anything further.
Thanks once again and I hope more people will subscribe to your amazing channel.
HAPPY NEW YEAR 2021!
I am using Google Wifi router which does not have additional ethernet ports for connecting to my Synology NAS directly. As such, I am using a 5-port Ethernet Switch (Cisco SE2500) to make the connection. I have checked that my Google Wifi router is already uPnP enabled. Upon performing the Set-up router configuration, the message shown was that no uPnP router was found and that I should proceed to manual installation. Any advice from anyone on what to do next? Thanks.
This is a great series of videos. I think I have followed this correctly, byt when I attempt to use my phone to access synology NAS I get the following message 'Web station has been enabled. To finish setting up your website please use theWeb Service section of DSM Help. I cant get beyond this? Any advice please
On your mobile phone try adding the port number of either 5000 or 5001 at the end of your domain address. For example mydoodads.synology.me:5000 or my doodads.synology.me:5001
Port 5000 is for the port without SSL and port 5001 is for the port with SSL.
This should take you to the DSM and your mobile phone should remember the url from that point forward.
please do another one where the router is not a synology and is not a supported one for doing it automatically through DMS. At 5:30, my router is not supported so I need tutorial on how to port manually. I already made a static ip for the nas and ddns. Another problem I might have is that the router is hooked to a cable modem. DMZ? Bridge?
Great videos. One question though, can I turn off my UPnP on the router side after everything is set up?
I think this will depend on the router, as turning off (the routers) UPnP might make the router lose the port forward rules that UPnP initially created.
However, you are right to start thinking about disabling UPnP. So, I would suggest taking screenshots of your routers port forward rules, and then disabling UPnP.
If your router loses its list of port forward rules, just refer to your screenshots and manually recreate your port forwards.
Hope this helps.
@@mydoodads
Does UPnP IGP need to be port forwarded in order to be able to write to the router's firewall settings?
BTW, I'm using an Asus RT-AC68u. When I apply the rules, it says that it writes the rules correctly and shows that it tests properly, but when I check on the firewall within the router settings, shouldn't those rules now appear in the Firewall settings of the router?
@@Brossy76 Your routers firewall more than likely will be set to block incoming traffic (ie from the internet), but allow all traffic from your Local Area Network (LAN) to pass to be internet.
So there should be no need to set port forwarding for UPnP. That is unless your creating some sort of super complicated firewall.
Taking a quick look at the user manual for the RT-AC68u, I think that the router will only display a port forward in the port forward panel.
Which to my way of thinking would be correct, as I perceive a firewall rule to being something that is slightly different to a Port forward.
However, I'm sure that the "internets" will happly correct me if I'm wrong on this 😉
Have you noticed that Video ports are gone on the latest DSM? Do we have to check some other ports instead?
Everything worked until I deselected the non-secure ports. Since we can't (nor should we!) see your secure address, I'm missing the "typology" to ensure the encrypted address is launched. These videos are fantastic. You've taken the mystery out of this. Agreeing with those below, I was about to chuck the whole thing in the trash bin! I read the reply way below regarding 5000 vs 5001. I have 5001 ticked and 5000 unticked on the "Management UI...etc" I checked the connection after saving and get OK. I guess the router & DSM are happy! When I put in my **********.synology.me address into my iPhone browser, I get a "Server not responding". So, I put in the URL again and added 5001 to the end of my .synology.me and still get locked up with "400 Bad Request" The plain HTTP request was sent to HTTPS port". I was doing great until I got to this step! Thanks again for these fantastic videos. I am a flight instructor for a major airline. One of the rules of "instructor 101" is to "KISS"... keep it simple stupid and these videos are KISS!
Try adding the bit at the beginning of the address on your iPhone. For example mynasname.synology.me:5001
TA DA! That worked! https:*****.synology.me:5001 WORKED! Thanks very much. Again, these videos are so great.
Thank you for the really helpful videos! When I try to log into my NAS from my phone typing my public IP address into my browser, I get the following message "Web Station has been enabled. To finish setting up your website, pleas see the "Web Service" section of DSM Help." Any advice? Web Station automatically downloaded on my NAS and I'm not sure if there is a setting on it I should be deleted so that it does not interfere with how I am trying to configure my NAS.
However, if I try to connect using QuickConnect, it directs my to the hostname I had created for NAS.
Thank you again for this!
IT is save if open to external access? What best practice to secure synology for external access and i use active directory user on Windows 2016 server
As suggested in Part 34, in order to configure NAS for External Access, I have enabled UPnP on my router, then I have selected the ports as per the video, but when I click on "Test Connection", it is showing failed, not OK. What could be wrong here?
The list of routers compatible with Synology nas hardware is not that extensive. So there is a good chance that Test Connection will fail.
However, even though you're NAS reports a fail, That may not be the case. So in the first instance check your router to see any ports have been opened and if they are being forwarded to your NAS.
If not then I'm afraid you will have to manually configure your router to port forward to your NAS.
Hope this helps
Hi, I too am enjoying your series a lot, so thank you! But I got stuck here in this lesson, because when I try to "Set up router", I get an error message for "Checking network environment". The warning below reads: "Two or more routers were found..." Now, I don't know what second router it thinks it found. As far as I know I only have one. And yes, Upnp is activated on it. Any tips much appreciated.
I think that your error message is implying that your home network is using double NAT. - support.ubisoft.com/en-gb/Article/000062048?isSso=true&refreshStatus=noLoginData
So for example you might be using a wireless router provided by your ISP, but because its wifi coverage is no good, you connected a third party wireless router.
If you then connect your NAS to the third party router. As each router has a firewall, your NAS is unable to navigate through both firewalls.
Unfortunately, this is a problem that is not that easy to fix, as the fixes are not well documented on the internet. I think this is because ISP's all use different hardware and settings, so instructions that work for one person will not work for another.
However, the three main fixes are as follows:
1. If possible, place the router provided by your ISP into bridge mode (sometimes called modem mode).
2. Create a DMZ on the router provided by your ISP. Then connect your second router to the DMZ.
3. Manually setup port forwarding rules from one router to the other that will all your NAS to communicate with the internet. This is as stated in the Ubisoft article.
Sorry I can't be more help.
@@mydoodads Hi, thanks very much for your detailed response. But I have no third party wireless router in addition to the router provided by the ISP (a Fritzbox). Should I nonetheless place it into bridge mode?
@@mydoodads Or skip this step and instead forward the ports on the router? Have you maybe done a video on this? Thanks 👋
@@mydoodads One more update, sorry: I have compared the internet address of the router in the router setting with the address I get when I go to a website to check my public IP. They are the same, which I guess confirms there is no double NAT at play here.... Any thoughts?
@Armin As I'm not familiar with Fritzbox, I would try setting up port forwards from the router to my NAS and then seeing what happens.
As a tip, for testing the number of routers in your network. Try using the Traceroute command on your computer via the terminal (Mac) or the Command Prompt (Windows).
Presuming that your Fritzbox is using 192.168.1.1.
If you use a Mac try using something like: traceroute -m 10 192.168.1.1
On Windows try using the command: tracert 192.168.1.1
The Traceroute command should show you the route that your computer used to reach your ISP's router.
This is great but I can never get this to work. DSM shows the DDNS is okay and I am manually opening the ports on my router, but when I try the link never works :( Quick connect works fine.
very clear instruction , thank you very much !
Can I use the quickconnect domain that synology provides?
nice info router config
Thks many buts;
????What your opinion on Synology's Quick-Connect????
If you are new to a networking and NAS devices, or only have limited or no prior knowledge of Double NAT, Firewalls, public static IP addresses, domain names, public DNS and SSL certificates. Quick Connect is the best way to go.
However, if you are looking to learn or you want to keep your NAS as independent as possible. Then definitely use External Access.
Personally I use External Access for the following reasons.
a) In my opinion External Access is more secure.
This is because you are not using a domain name that makes it obvious that you are using a Synology NAS.
b) You don't give third parties as much information about your connection and NAS using Direct Access, as you do with QuickConnect.
c) You have better control over services like SSL certificates, DNS server settings and domain names. Which in turn makes troubleshooting easier.
d) Less can go wrong with External Access compared to QuickConnect
However these reasons may force you to use QuickConnect
a) Ideally you need a Static IP address. Something that is not possible with all Internet Service Providers
b) It will cost more to use External Access rather than QuickConnect ie you need to buy your own domain name and SSL certificate.
c) OpenSSL will automatically update the SSL certificate on your NAS every 3 months (I think). However, a third party SSL certificate will have to be manually updated (by you) every year. Which is something I have difficultly remembering how to do. So a video is coming sometime in the new year on manually adding/updating an SSL certificate.
d) It can be more difficult, and time consuming to configure Direct Access. Which in turn makes it very easy to make a mistake.
As I'm currently in the process of remaking this series for DSM7. My intention is to look at configuring both QuickAccess and Direct Access. The idea being to allow someone to setup with QuickAccess, and then show them how to convert to Direct Access if they want. However, as I'm currently finishing off SMB network shares. I don't expect to get to this topic until late 2024.
Hope that helps answer your question :)
@@mydoodads
*You're quite the amazing super smart/wise fellow. For exampls, yous tailor your communication to me whether than talk at-me, over-my-head, down-to-me, etc (quite-refreshing oh-boy ;).
*I justs-gots my DS723+ & I'm going thru your super-professional DSM7&6 playlists all tailored to home/office users (perfect for a professional NAS hobbist like me). It's kinda hard buts all the rest are much ... much harder. In-fact ,my brains melted a few times on the last few videos in the playlist. Nevertheless, I will keeps doing them all over & ... & over again until I suppass The-MASTER (thks-many ;).
*I knows you're a busy computer-genius &-all buts what I miss most is a short/pragmatic test on the key concepts/points at the end of the videos. Of course you dos-do a most excellent summary. However passing a short/pragmatic test of key concepts/points right after your video ensures competency in/with them. Conversely failing any of them hi-lites what your hungry disciplines gots to review before moving-on to your next video. Justs-thinks; if I pass all the tests, I mights-gets my MyDoosDads professional certification (don't-laugh, it could happen ;).
*I justs really hates it when I thinks I knows-it-all, tell everyone else I knows-it-all tos, & then finally realize I've been just an egotistical idiot all along (happens much to often to me unfortunately ;).
Followed step-by-step, awesome information, learned so much! Thank you for your contribution! I was unable to access via mobile browser, used the HTTPS:// then like magic I was able to reach my synology. Thank you again!
So glad i stumbled across your video's they are immensely helpful, i have just one question, is the load time after only allowing ssl cert connections meant to increase 10 fold? or is it my phone?
I think that’s your phone rather than SSL.
As other comments have stated: Great videos! Thanks a lot for all the help in setting up my NAS!
Currently I cant get connecting to my NAS through DDNS to work. Quickconnect works fine, but DDNS is more secure right? I set up everything that is needed, domain name, SSL-certificate, etc etc. The domainname works on my network, but on cellular date on my phone neither the domainname or the ip-adress can connect. I thought I'd take a look at the ports forwarded on my router. Indeed, by using the 'Test Connection' feature through router configuration on DSM I see that the ports fail to connect. Weird, since EZ-connect did say it forwarded everything for me.
Weirdly enough, after I manually portforward on my router.... they still fail to connect. I really want this to work and not be forced to use quickconnect. Any ideas? Does it maybe have to do with my router using ipv6? I read somewhere portforwarding works differently with ipv6.
Either way, thanks again for all the help!
I’ll admit I prefer DDNS or a Static IP address over Quick Connect. While I believe Quick Connect is secure, I do worry that if Synology has a data breach, it could put my NAS at risk. So I tend to only suggest Quick Connect if I cant make a NAS accessible via the internet.
Unfortunately, I don’t really have any experience with ipv6 so I doubt I can offer any useful advise or be of much help.
However as an anecdote, I have a second network which is my own personal network. On that network I have a domain name that uses a Static IP address provided by my ISP. I then use a Synology RT1900 to act purely as a firewall.
The reason I bring this up is that originally when configuring my RT1900, for some reason not only did I have to create port forwards to my NAS. I also had to open the same ports on my routers firewall if I wanted to be able to access my NAS externally.
So maybe your router also works in the same illogical way that my Synology router did, in that you will have to open ports on your firewall and then also set port forward rules.
@@mydoodads Thanks for the reply! Unfortunately I can not seem to adjust any specific router firewall settings. I've decided to just be content with the NAS not connected to the internet, I don't really need it as a cloud to begin with and I guess it's safer all around.
Keep up the good work with your videos!
great video! i have 1 question :
how to mount the drive from mac's "connect to server" when we access externally (not in lan network)?
i set up the forwarding ports on my router for the external connection, everything works fine on web browser using the external connection,
but everytime i tried to mount it from mac "connect to server", it asked for our password (i assumed it connected), but then after i typed the user and password, "there was a problem connecting to the server "..."
There are a number of methods that you can use to remotely access the network shares on your Synology NAS. However, based on your limited description it sounds like you are trying to use WebDAV.
For others that might be interested Synology define WebDAV as “an extension of the HTTP protocol that allows users to manage files stored on remote servers. Common client programs supporting WebDAV include Windows File Explorer, macOS Finder, and Linux File Browser.”
So if you are using WebDAV, when you select Go - Content to Server on your Mac. Is the server address to your Synology NAS correctly configured. So for example I think it should look something like the following: domainname:5006 or possibly domainname/foldername:5006
However, if you are using WebDAV, I would recommend that you switch over to VPN instead. As WebDAV uses the HTTP protocol to link back to your NAS, I have always been a little dubious of its security. So I personally only use VPN to remotely access my NAS.
While VPN is a bit more work to setup on your NAS. By using VPN your computer and its data will be encrypted in a slightly different way. So not only will VPN allow you to remotely access the data on your NAS, it will also protect your privacy when working remotely.
Hope this helps.
Thank you for this so well explained video :)
Thank you for the great videos! Question. Whenever I turn on my Firewall feature on my NAS, can't seem to access the PMS via Package Center However, when I can access whenever the Firewall is turned off. I I am a Google Wifi user. The router does not appear from the drop down list. I have to manually set the Port Forwarding in the app. Please advise.
To your first question, as I don’t use Plex I’m not the best person to ask, but hopefully someone else might be able to shed some light on the issue.
As to your second question. One of Google WiFi’s great strengths is simplicity, but if you want to connect something as complex as a Synology NAS onto Google WiFi. That simplicity starts to become a major weakness.
While I personally did not pursue using Google WiFi in my home network, mostly because it lacked features that I thought I needed better control over. I have just started making a series on setting up Google Nest Wifi, so at some point in the future I will be take a look at how you connect a Synology NAS to Google WiFi.
In the meantime, I seriously doubt that Google WiFi is compatible with the Router Configuration Wizard on your NAS. So yes that will mean that you will have to manually set Port Forwarding in the Google WiFi app.
It’s also worth noting that if you have connected Google WiFi to the Internet hub that was provided by your Internet Service Provider. You need to check that you have not created something called Double NAT. Double NAT is where a router is behind a router, which will cause problems when remotely trying to access your NAS. - kb.netgear.com/30186/What-is-Double-NAT
Learned a lot from these well thought out videos . Have you done a video on manually Port forwarding ? My Netgear NF18ACV router is not recognised by Synology so unable to use your External Access method .
While I can't cover Port Forwarding for every model of non compatible router. I think I have a few ideas for a video that will cover issues people might be experiencing with External Access.
However, I'm not sure when I will be making this video as I still want to cover VPN Server, VPN Clients, log in scripts for Windows and Mac, DNS Server, Dual Authentication and installing SSL Certificates.
As Synology will be releasing DSM 7 sometime in 2020, I do intent to end this current series soon. So please look out for something before the end of Spring.
Thank you so much for this video. Awesome explanation!!!
The URL works from my phone but not the PC. I've tried turning the firewall off on the PC and in the DSM. Anybody help a brother out here? PS, this is the best video there is on this. Thanks.
This sounds like you might be trying to use the URL to your NAS, from a computer connected to your home network.
If a computer is connected to your home network. In order to connect to your NAS, the computer will use the NAS's local IP address (ie 192.168.1.2).
In this scenario, because the SSL certificate you have created is for your public IP address and not for the local IP address of your NAS. The SSL certificate and its associated public URL will not work properly.
However, when you completed your test using your mobile phone. As the phone was connected directly to the internet. It used the public IP address you created when you setup your DDNS service and its associated SSL certificate.
You can test this if you tether your computer to your mobile phone. As your computer will now be connected directly to the internet and not your home network. You should find that your URL and its SSL certificate will work.
Hope that this helps explain what's happening.
@@mydoodads Thanks for the detailed response, I did have this working before. The PC is connected via WiFi the same as the phone. So, in this case, it should work and there's something else at fault perhaps?
I cannot find my router (Linksys MX4200) in the UPnP since it asked me to set up the UPnP manually. I asked Synology and they said that they do not have MX4200. What can I do?
UPnP is used to automatically allow specific types of traffic through your routers firewall. So in this instance you will need to manually allow data through your firewall and direct it specifically to your NAS. This is done by using the port forwarding function on your MX4200 - www.linksys.com/us/support-article?articleNum=138535
As you will have to learn about how to port forward on your router. I would recommend that you work slowly and methodically.
Perhaps start by testing your routers firewall to see if any ports are currently open or closed. I would recommend testing your firewall using shields up - www.grc.com
That will give you a baseline as you work.
Then while you are learning about port forwarding on your router, initially start with a service that only requires one or two ports to be open. For example Disk Station Manager (ports 5000 and 5001).
A piece of advice. While Shields up suggest that open ports are bad, and only stealth ports are good. It's not that black and white. In order for your NAS to communicate certain ports will need to be marked as Open.
The trick is to make sure that any ports you do have open are only directing data to specific services on your NAS.
I think you will find the following information regarding Synology Ports very useful, as it identifies which ports need to be opened for the different services on your NAS - kb.synology.com/en-me/DSM/tutorial/What_network_ports_are_used_by_Synology_services
Sorry I can't be more help, but while it may initially seem daunting, it's not really as difficult as you might initially think it is.
Thanks, for the very clear video. However, my router does not support UPnP, so I configured it manually via the router by port forwarding. The part I don't understand, is that if I connect via my mobile phone via 4G, I am able to login (via ....synology.me). However using my LAN IP in my home network, either 192.168... or via ....synology.me, I get a certificate error? Do you have any solution?
The problem relates to the Let’s Encrypt SSL certificate, being used to certify your public IP address. As the SSL certificate is using the public IP address identified by your DDNS service. When you try and access your NAS locally, the certificate does not match the local IP address (ie 192.168.1.x) being used by your NAS. This in turn prevents you from getting the padlock symbol, while also giving you the “Connection is not Private” message in your browser.
How I got around the problem, was to abandon using DDNS and Lets Encrypt. Instead I purchased a static IP address for my broadband connection, a domain name and an SSL certificate.
Then through my host (the company I purchased my domain name from) I associated my new domain name with my new Static IP address. As the host also gave me a free SSL certificate I used that certificate to make my static IP address secure. This allowed me to receive a secure connection whenever I access my NAS from the internet.
Then so that I could access my NAS securely when on my LAN. I installed DNS server and then created a DNS record for my NAS. I then assigned the SSL certificate I purchased, to my NAS so that my NAS was secure when I try to access it locally.
However, I realise that not everyone will want to do what I have done. This maybe because of cost or possibly that their Internet Service Provider does not allow them to buy static IP addresses. So I would suggest that you take a look at a video made by Willie Howe, as he covers how to fix your problem using DDNS and Lets Encrypt - ua-cam.com/video/daIelVuKlYQ/v-deo.html
Hope this works for you.
Absolutely brillian !!!! Thank You
So, if not using a Synology router how does one go about setting up the WAN access. Can one use any available VPN? Or, does a router's game mode port forwarding work?
VPN is certainly one way to go, and my preferred choice. However, if being able to access your NAS through a web browser is more what you are looking for. Then yes, you would have to enable port forwards on your router.
Very good video!
Hello, First of all, thank you for posting all those videos!
Just have a question.. will there be any difference if we set up Quick connect feature? is that a complementary option we might think on using it?
I think it’s better where possible that everyone uses Direct Access, partly from a learning and understanding perspective, but also because I do have a number of small concerns about QuickConnect.
From what I have been able to workout, QuickConnect will create a secure connection between a NAS and a Synology Server. Something a little like a VPN connection, that punches through your home networks security so that you do not have to worry about configuring Firewalls or Port forwards.
You then use a Synology Account to connect to your NAS via a Synology server. However, I cant seem to find any info on if Synology data mine or if Synology store basic information about your NAS, such as your admin password. So, how secure would a NAS be if Synology’s servers were hacked.
While I’m sure that Synology are being careful with QuickConnect data, particularly as up to this point, I have heard no instances of data breaches.
I prefer to recommend that you use QuickConnect as a fallback in the event that you cant use Direct Access. For example if your ISP does not allow you to change firewall settings, you can’t create port forwards on your router or you have double NAT.
Hope this helps to answer your query and thank you for your support.
@@mydoodads with all these ports opened, aren't you exposing to many services to the external world (internet)? Wouldn't you need to set-up a third party VPN or even a bastion running dedicated security SW, vPN and Firewall in order to have better protection?
@@jormol In order for you to be able to access services remotely, you do need to have the ports open to the services you want to use.
However, you protect your NAS by ensuring that you only open ports to services that you need.
You should also make sure that any services you are using, are running on the latest software versions with the newest updates and patches. From what I have been able to work out (not a security expert), its exploits to a service and not the open port that's the real security risk.
Then you need to make sure that you add layers of additional security to protect your NAS. This should be long complex passwords and perhaps 2 step authentication. Please see these video for more on the security settings you should consider enabling - ua-cam.com/video/v6KKViXCK1U/v-deo.html and ua-cam.com/video/_wgBVayaIGE/v-deo.html
However, you are right in that using VPN will give you more protection. Personally, I have configured my NAS so that I can only access Video, Audio and PhotoStation from the DS apps on my smart phone or tablet. This is because, while there will still be ports open. These ports are not as obvious as the http ports. So will require a little more effort for a hacker to exploit.
A little tip, I did this by enabling/disabling port forwards on my router and not fiddling with settings on the firewall of my NAS. That way, on my LAN I can access web services like Synology Cloud or Audio Station, but these services will not be available via the internet unless I use the corresponding app. This has the useful knock on effect, that fewer ports are now open.
Then when working remotely, I use Synology VPN server and the VPN client on my computer to connect me back to my home network. From there I can access my network shares and other NAS services as if I was working locally.
As I mentioned Im not a securities expert, but I'm comfortable with how how my NAS is locked down.
@@mydoodads Would love to see a video describing how you set this up properly as it's a bit more complex. Thansk again.
@@Brossy76 Originally, I intended to make an episode for both Direct Access and QuickConnect.
However because Synology keep teasing the imminent release of DSM7, I decided to just focus on QuickConnect for this series.
However, as I intend to make a series for DSM7, I'm thinking of moving away from QuickConnect and focusing on Direct Access.
I think that I will make QuickConnect one of my quick tip videos.
any luck finishing up the VPN server video mentioned.?
At the moment it's looking like January. Mostly because of Windows 10 testing and I need a break over Christmas.
I'm planning to divide the video into three parts. The first being the setup of VPN Server, then post two videos showing you how to configure the Windows and Mac VPN client.
Currently, having Windows 10 VPN client be reliable is proving to be a challenge. However, MacOS VPN client is super easy to configure and very reliable.
@@mydoodads Awesome, looking forward to it. Your videos have been so helpful for me. Thank you
Notification emails are still using the local IP instead of host name. How to change?
From within DSM - Control Panel - Notifications - Email - try changing what is inside the brackets of the Subject Prefix field.
i am not able to use ddns while i am on my home wifi, as soon as i connect to cellular service or cellular hotspot then i am able to access my synology through ddns. why is this like it? is it true we cannot access synology nas on ddns while on home wifi?
You can still access your NAS from within your home network. So try use your NAS's local IP address. For example 192.168.1.2:5000 or 192.168.1.2:5001
However, if you want to be able to access your NAS using a domain name. Try setting up a local DNS server on your NAS. ua-cam.com/video/iqgp2L1K6RQ/v-deo.html
It is through this local DNS server (rather than DDNS) that you can instruct devices connected to your home network, to use the local IP address and domain name you have given your NAS.
Having issues with the router config (it's a TP-Link ArcherC7) on Port 80 - for some reason all of the other ports (5000,5001,443 and 9025-9040) work absolutely fine just not 80 - keeps saying the connection test failed. Not sure what to do now...HELP!!!
As I don’t have a TP-Link Archer C7, I cant offer advice that I know will work to solve your problem. However, I suspect that the Firewall on your Archer C7 has been designed not to allow UPnP on your NAS to automatically control port 80 on the router.
I would suggest looking at page 54 of the Archer C7 user manual - static.tp-link.com/2019/201901/20190109/1910012372_Archer%207_UG_REV5.0.1.pdf
In typical TP-Link fashion, they seem to have veered away slightly from the conventions for naming and configuring features within their products.
So based on the manual it looks like you might have to setup something called a Virtual Server on your router which will then allow Port forwarding on Port 80 to your NAS.
Hope this help.
I should have finished the video as I disabled port 80 anyway. Thanks for making the series, NAS working like a dream and I haven’t got A CLUE how about stuff like this!
Hi may I know why me certifications is from r3?
In December 2020, Let’s Encrypt started using a new form of LTS certificate. - lwn.net/Articles/838811/
I’m no expert but I think that R3 simply refers to how the certificate is signed for better security - letsencrypt.org/certificates/
If I try to access to the IP of my NAS on my smartphone with 4G, it doesn't show anything. But every port is working on the routeur's configuration :/ What did I do wrong ?
I have to enter the IP (the one I can access my NAS with when I'm connected to my home's wifi) of my NAS. Right ?
@@lemosky7762 No, on your home network you NAS will have a local IP address. Something like 192.168.1.2
Instead, you will need to use your public IP address. This address is the one that has been provided to you by your internet service provider.
The easiest way to find out what your public IP is, is to simply google from a computer connected to your home network, "what is my IP address"
Google should then display the IP address your broadband connection is using for example something like 172.219.22.14
This article might help explain things better - www.lifewire.com/what-is-a-public-ip-address-2625974
Hope this helps
I've followed the video but it doesn't seem to work, everything is exactly as shown in the video. The only different is on the router configuration the local port 80 and 443 are different for the router port is that why?
For my videos I have made the networking side of things as vanilla as possible. So while Im not sure I completely understand your routers configuration, like you I would also suspect the local port 80 and 443 being different for the router port. However, a couple of other things to consider include:
If you have a router connected to a router, that would create something called double NAT. Double NAT could be one explanation as to why you are having problems connecting to your NAS. - kb.netgear.com/30186/What-is-Double-NAT
Its also worth checking the firewall on your router. I noticed, that if I manually configure my Synology RT2200ac router rather than trying to use UPnP. I had to manually open ports on its firewall as well as set my port forwards. You might find, that on your router you have to also open ports on your firewall.
If your model of router can be managed remotely, you might find that your router has reserved ports 80 and 442 for its own use. As this might be the cause of the problem, it could be worth looking into switching off the routers remote management feature. Although I would expect port forwarding to override that setting.
If you have configured the firewall on your NAS, double check that your NAS is not blocking traffic to port 80 and 442.
Its worth double checking the Port Forwarding rules have been set on your router. You are looking to make sure that the forwarding rules for port 80 and 443 are pointing to the local static IP address of your NAS.
Finally it could be worth trying to manually create port forwarding rules on your router rather than trying to use UPnP.
Sorry I can't be more specific with a solution, but I hope that one of these suggestions help.
@@mydoodads For some reason its decided to work! However I'm now having issues with the certificate. I've done everything it says in the video but when I go to the address example.synology.me it says the connection is not private or it won't connect to it, is there any reason for this?
@@joshforth8493 I have tried to replicate your problem, and was able to recreate the issue you found. However, after rebooting my NAS the problem went away and I was no longer able to replicate the problem. So a reboot might be worth a try.
i'm having isssues with setting my ds918+ to have external acess. it says 2 or more router were found. Even when it detects upnp, the rules show "failed." Any video on that tha t shows the steps to fix this issue. Please share.
I am having the same issue despite only having one Router. Except my issue is that my rules come up with OK, yet three of them are assigned new Router Ports. Sadly, despite displaying as OK, My NAS does not respond and is not connected to the internet.
Even trying again and trying to do it manually does not work as the Plusnet hub one is not on the Synology options of Routers to choose from. :(
Hi, this is a great vid but I could not go through as described, I did everything as you directed until 7:55, but the NAS informed me that port 80 & 443 are being used and should be reconfigured (something like this). I allowed to do so, upon test everything OK as on your screen at 758, but trying to connect with my phone via 4G nothing happens. I have an ASUS RT-AC68U router, which was found OK for this operation... PLEASE HELP HOW TO CARRY ON!!!! Tnx in advance :-)
Is your AC64U router connected to a router provided by your ISP?
@@mydoodads Good question. If ISP stands for internet service provider I have a nice box supplied by them and my WiFi router is connected to that unit.
@@mydoodads by cable.
Then I think your problem is something called Double NAT. This is when a router is behind a second router. As both routers are acting like firewalls, when you try and connect to you NAS externally. the ISP Router is blocking the link.
@@mydoodads Is there any way to overcome this problem? I have no access to the ISP's router (TV & phone also come through this unit)
I went through until 13:30 (naming the host) but cannot join...
very nice videos , l might say that l have follow up all of your video, but regarding this one , main is not redirectin to https/443 ?!
As mentioned in other comments. When testing from a phone, you might need to type the full SSL domain name into your browser ie domain.name.
This is because it seems that (certainly in Safari on iPhone) the browser defaults to opening web pages using http rather than https.
Another issue that's worth mentioning, is that certain makes and models of routers. Use port 443 for remote access. So depending on the router you are using you might need to turn off remote access to your router so that your NAS can use port 443.
@@mydoodads Thanks for fast response, l am trying from PC browsers, and l have 2 NAS servers in a different location and both of them are not forwarding to HTTPS, remote was turned off from the beginning
Try checking that in Control Panel - Network - DSM Settings. The option "Automatically redirect HTTP connection to HTTPS for DSM desktop is enabled.
I would also suggest that you double check the firewall rules on your NAS and the port forwarding rule for port 443 on your router.
As you need to troubleshoot where the connection problem is on your network. I would recommend that you use a network scanning tool. This will allow you to test if port 443 on your NAS is open.
To test the firewall on your router (outside coming in) try using the website shields up - www.grc.com/x/ne.dll?bh0bkyd2
To test the firewall on your NAS (internal to your home network) try using the app WiFiman. WiFiman will runs on iOS or Android, and has in the Discovery section a port scanner.
@@mydoodads yes 443 on both site is open, l manage to make port-fw also 5001 to directly open only nas.domain.com, but the issue is here that always l have to write full path url: https:/nas.domain.com, in case l writte just nas.domain.com hangs on and it not redirect to https
@@MrDjegsi I think that the redirect problem can be fix by configuring Nginx on your NAS.
However, currently this is not something I have had a chance to tinker with yet.
So I think that by editing the config file for Nginx on your NAS, with the following code. Should force a redirect to your SSL connections.
serversforhackers.com/c/redirect-http-to-https-nginx
Hope this points you in the right direction.
im stuck, i dont know how to move forward .im stuck, i hava a progblem with network enviroment, it said i need to set my modem to a brige mode bur i dont know how :( and now i cant share any folde :| i have a ds918+
It sounds like your network environment consists of two routers connected together. For example you might have a router provided by your Internet Service Provider, but because this router did not provided very good WiFi to your home, you connected a second wireless router. While this works for basic internet access, it creates something called double NAT.
Basically, as each router on your network has its own firewall. Your NAS is not able to get through both firewalls in order to access the internet. Also as you have two networks isolated from each other, depending on which network you connected your NAS to, will dictate if your computer can connect to your network shares.
In order words, if your NAS is on one network, and your computer is on the other. Your computer will not be able to access your network shares.
When your NAS says that you need to set your modem to bridge mode, basically you are looking to place one of the routers into bridge mode. This is so that the routers in your network create and behave as a single network and not two isolated networks.
So I would recommend, talking to your ISP and have them help you get their hardware set to bridge mode (sometimes called modem mode). You may also need to have them help you properly setup your second router for wifi.
Hope this helps point you in the right direction.
@@mydoodads thank you !
Hey there! This is an amazing tutorial series, thank you for that! Two questions: Is there also a security benefit of not using "quick connect" by Synology or just the better upgradeability? And, in one of your answers below you talked about 44 videos in this series - you meant 34, or did I miss something? Thx!
Hi J
Hi J
Thanks for watching the videos. Your support is greatly appreciated.
However, you are right in that I made a mistake and it should be 34 videos not 44. In my defence, there are a bunch of Synology quick tip videos which supplement this main how to series?
To answer your other question, I had two reasons for deciding not to make a video on setting up and using Quick Connect on a Synology NAS. Firstly, as Quick Connect tries to simplify the process for connecting a NAS to the internet. It hides the complexity involved in the process, ie configuring firewalls, Port forwarding, setting up domain name etc.
So if something goes wrong with Quick Connect, because you do not have any understanding of the services that Quick Connect has configured for you. How will you be able to troubleshoot a connection problem if one occurs?
The second reason I decided not to make a video on Quick Connect, does relates specifically to security. While I am not a security expert, I do have a few concerns about Quick Connect. My first is the use of a hostname for your NAS that uses a Synology domain name. So for example, by using mydoodads.synology.me, a hacker instantly knows that there is a very high probability that the device behind the domain name is a Synology NAS. So I have instantly made their lives a little easier.
I also have concerns about what information Synology’s Quick Connect collects and how secure Synology’s own servers are. I would have thought that to hack Synology’s Quick Connection servers would produce a mine of useful information to any hacker. Especially, if DSM has a zero day exploit.
As I personally do not use Quick Connect, but instead use a static broadband IP address, with my own unique domain name. I felt it would be hypocritical to suggest that everyone uses Quick Connect. So instead I made a video on External Access so you can see the steps involved in making a NAS accessible via the internet. The nice thing about using External Access its that you can change settings as you build your knowledge and become more confident with your NAS.
However, the risk in using Quick Connect are very low, and I tend to be overly cautious when talking to others about security. So to provide some balance, Quick Connect does have its uses. For example in the comments I did recommend to someone that they use Quick Connect. This was because while they did try to setup External Access, their ISP and router would not work with DDNS. So, as a work around we used Quick Connect.
Hope this answers your query.
Can i creat guest user for logging in ?
Yes if you want to. It would just be a standard user account with limited access privileges. Edited - I would recommend not calling the account guest, enabling two factor authentication and disabling the account when it’s not being used by someone.
ive been trying to figure this out for years but unfortunately it doesn't work. i guess fritzbox routers are not made to make this work. followed every step no errors. also manually added the ports in my router. type in myname.synology.me and it doesn't load :( i'm giving up at this point.
While I don't recommend using Quick Connect, and I feel it would be better if you could use External Access. As you are having problems, and the issues could be related to the router/modem being provided by your internet service provider. Before you give up completely give Quick Connect a try.
Hello! Thank you for the precious information & indications regarding setting a NAS. I have the 1-bay model, DS120j NAS.
Despite following literally all the steps described in the videos, it gives me an error:
"This site can`t be reached!
octavianh.synology.me refused to connect.
Try:
Checking the connection;
Checking the proxy and the firewall;
ERR_CONNECTION_REFUSED".
At details it shows me this:
Check your Internet connection
Check any cables and reboot any routers, modems, or other network devices you may be using.
Allow Chrome to access the network in your firewall or antivirus settings.
If it is already listed as a program allowed to access the network, try removing it from the list and adding it again.
If you use a proxy server…
Check your proxy settings or contact your network administrator to make sure the proxy server is working. If you don't believe you should be using a proxy server: Go to the Chrome menu > Settings > Show advanced settings… > Change proxy settings… > LAN Settings and deselect "Use a proxy server for your LAN".
Could you please tell me what should I do?
Thank you!
I think that you might have a problem with the port forwarding from your router to your NAS. I know that certain models of routers, do require that both the ports on the routers firewall and port forwarding rules need to be enabled, in order for you to access your NAS via the internet.
Great video. Can you do a video on connecting to the NAS via VPN as well as using VPN on the NAS to allow Download Station to run without interrupting other services.
Currently, I'm working on a video for installing and configuring VPN Server on a Synology NAS. So please look out for the video in the near future.
When I try to access it from my phone browser, it gives me an error saying page not found. If i try the public IP with port :5000 it takes me to the login page. What could i be doing wrong?
I don’t think you have done anything wrong.
In order for you to be able to access services on your NAS, each service will require its own port number. For example in order to access the DSM you would use port 5000 or 5001. Port 5001 being the port used for an SSL connection.
So when you type the host name of your NAS into your phone browser, by default that browser will try and access content on port 80 or port 443. However, if Web Station has not been installed on your NAS (as in the NAS in the video) because your NAS is unable to redirect you to a Web Server, you will be automatically directed to the DSM login page.
If you do have Web Station installed on your NAS, it will automatically point any web traffic to the contents of your Web Server. If you open File Station and take a look at the folder structure. You should see a folder called Web. This is were your NAS is redirecting visitors.
Check to see if you have an index.html file at the top of the file structure in the Web folder. If you don’t, try creating a simple html page (called index.html, and then see if you can load that page from your phones browser.
Its also worth checking your Firewall to see if traffic for ports 80 and port 443 have been blocked.
Hope this helps.
@@mydoodads Hello. Just trying to follow this thread as I seem to have the same problem.
Having read your reply I have checked a few things but I am still unable to access from from mobile device.
Noting that I don't have Web station installed, so would expect to be directed to DSM Login page. Also My port 80 on my Firewall is ticked and so is 443, but I don't see port 442 anywhere.
I've also ensured that ports 80 & 443 are at the top of the firewall rules, so where else could I be going wrong?
thanks
@@martinpayne5251Sorry I was being a muppet and mistyped 442, it should be 443. My apologies and I have edited my previous comment.
As I used an iPhone in the video to test the connection. I have subsequently noticed that iOS has a quirk that will prevent it from loading your NAS front-page if you just try and type name.synolog.me
Instead, I found that you need to type name.synology.me:5001 or name.synology.me:5000
If/once you successfully connect using that method, subsequent attempts to connect only require that you type name.synology.me, iOS seems to figure out the rest.
Hopefully, this is also were your problem lays.
@@mydoodads Thanks very much - I can now have remote access, thanks.
Is this method safer than Quick Connect?
Quick Connect works by establishing a secure connect to a Synology server that then connects your NAS to the internet. As data will be passing through Synology’s servers it’s possible that Synology might be collecting our data. However, I would think this unlikely as Synology need us as consumers to trust their products. Instead the main security concern I have, would be what happens if Synology’s servers are hacked? So I choose to use Direct Access as it gives me the illusion of control over my NAS.
This is not to say Quick Connect does not have its uses. If you are new to servers, Quick Connect is very easy to setup and requires less understand of networking. So I personally recommend that people try setting up Direct Access first, but if they can’t get it to work they should try defaulting to Quick Connect.
Hope that helps answer your query.
@@mydoodads Thank you for your response! I tried setting up direct connect using your tutorial and it worked. Now I have https and will attempt to setup PIA VPN. Not quite sure yet if once I setup VPN on my NAS any user will be automatically using that VPN or will they need some client on their end. I just use a client on my PC and don't know much about setting it up on a NAS.
A pleasure. It might be worth checking out my videos on setting up VPN server. There are also video on how to configure VPN clients in Windows 10, macOS, iOS and Android.
Brilliant series of videos, thank you! Makes our lives a lot easier as Synology do not provide useful manuals. Quick question for anyone out there ... my Asus router with UPnP enabled does get rules from the Synology NAS, but gives me local port 80 and router port e.g. 46410 say and I cannot force port mapping. Any ideas why or a work around? Is there a way to wipe the ports forward rules in the router (yes I dd factory reset but to no avail.) thanks all
Same issue here with talktalk Huawei router!
What does it mean if I enter the myname.synology.me address and I get a 403 error?
A 403 error signifies that a request is forbidden. So your NAS has understood the request, but it's not authorised to complete the request.
@@mydoodads thank you, do you have a video tutorial explaining how to allow Synology to authorize such requests?
@@Mr.PetePrice Unfortunately, I don't have a video on your specific problem. However, to try and point you in the right direction. My initial suspicion would be to double check your firewall ports. This could be the firewall on your NAS (if enabled) or the firewall on your router, or a combination of both firewalls.
Also try using Shields up, which can be found on the www.grc.com website to help you identify which ports on your routers firewall are open.
By using this Synology article and by using Shields up you can double check which ports are open and which ports you need to have open in order to get different services working - www.synology.com/da-dk/knowledgebase/DSM/tutorial/Network/What_network_ports_are_used_by_Synology_services
Its also worth noting that while your NAS might report that its compatible with your router. It may not fully be able to configure the routers firewall. So you might need to manually configure port forwarding rules on your router.
Just for your reference this is the UA-cam playlist for all my How to setup a Synology NAS - ua-cam.com/video/Yua6dGpg4qo/v-deo.html
However, I think the playlist from my website is easier to work with - my-doodads.com/series/how-to-setup-and-configure-a-synology-nas/
Hope this helps you find and fix your problem.
Everything works fine for me until I get to the step where he disables ports 5000 and 80 to force connections to use SSL. After I do that, I can no longer connect from my phone using the DDNS name. Anyone have any idea why?
Also, every time I connect with my laptop it tells me my connection is not private. I don't have the same issue from my phone.
I found that (particularly on a smart phone) I would have to type the link ie mydomain.com into my browser in order to connect securely. The browser would then automatically default to using after that point.
The other problem relates to the Let’s Encrypt SSL certificate, being used to certify your public IP address. As the SSL certificate is using the public IP address identified by your DDNS service. When you try and access your NAS locally, the certificate does not match the local IP address (ie 192.168.1.x). This in turn prevents you from getting the padlock symbol, while also giving you the “Connection is not Private” message in your browser.
You could simply force your browser to accept that you are not using a fully authenticated SSL connection when connecting via your LAN (Local Area Network). This is the easiest fix, and should be fine as long as your home network has not been compromised.
However, the actual fix is more complicated in that it requires that you basically undo all of your current settings and then recreate them using different services. What you are basically looking to do is use an internal and external DNS service. However, as this is not something that I have covered please take a look at this video made by WIllie Howe - ua-cam.com/video/daIelVuKlYQ/v-deo.html
Hope this helps
@@mydoodads Thank you, manually typing in in front of the domain name worked! One other question I have is that in your video, you disable the http port forwarding rules. However, I noticed there was an option to automatically forward http to https. Is there a difference in terms of security in either 1) disabling the http port forwarding, and 2) leaving http port forwarding enabled but selecting the option to forward http to https?
@@mdaily733 I don't think there is a right or wrong answer to that question.
The reason why in the video I disabled the http port via the firewall in the video. Was that I thought it would help people to better understand their firewalls, and help build confidence in navigating the settings when configuring their Synology NAS.
In terms of security, it often does not do any harm to use a belt and braces approach. So, by blocking http traffic in your firewall, you will know for sure that no http links can be made to your NAS.
Also while I might be looking in the wrong place. I think you are referring to a setting on my NAS called "Automatically redirect http connection to https for DSM desktop" .
This is a setting which can be found in the DSM - Control Panel - Network - General
I think this setting use to be called "Automatically redirect HTTP connections to HTTPS (Web Station and Photo Station excluded)"
So its meaning may have changed over time, or different models of NAS display slightly different setting options.
Either way, I can't see it doing any harm to both enable the HTTP to HTTPS redirect, setting and also change your firewall.
I tried this but all I'm getting on my phone browser is "connection timed out"
I get a notification on my nas "Failed to register ip address 109.78.**.** to hostname to TonyNAS.synology.me (This hostname is already used)
I'm confused ?
When you were testing, were you able from your phone, to connect to your NAS using only the IP address that was assigned to your broadband connection?
If you did, then that test confirms that your NAS was able to configure the firewall on your router using UPnP. However, if it did not then there was a problem reconfiguring the firewall on your router. So you might have to manually create port forwards on your router rather than rely on UPnP.
A potential issue, may be if you have "upgraded" the WiFi in your home. As many ISP's can be difficult about using third party routers. If you simply disable WiFi on the router provided by your IPS and then connected a second Wireless router. You will have created something called a double NAT. So while your second router may pass the UPnP test. That router is unable to get past the firewall on the router provided by your ISP. Unfortunately, in order to get around this issue you will have to work out how to resolve you double NAT problem.
If you can access your NAS by using your broadband connection's IP address, then the problem relates to DDNS. One of the issues with using any "free" DDNS service, it that you are dependent on that service providing a good level of service. So it's possible, something is wrong with Synology's DDNS service. So it might be worth trying a different DDNS service provider.
As, updating DNS servers may not be instantaneous, and it's not unheard of for an update to DNS to take up to 72 hours. If you are inheriting a hostname from someone who no longer uses that host name. You might have to wait for the multiple DNS servers on the internet to update, before you host name is able to connect back to your NAS.
Hope this helps.
@@mydoodads Thank you for your very detailed reply. However I will be the first to say that beyond this point I am totally out of my depth & wouldn't know how to go forward with this. I will look at the video & your reply again & see if I can understand how to proceed further. I have followed all your videos on the Synology NAS & up to now was able to carry out the instructions they contained without any problem.
I will say that the modem provided by my ISP isn't of a great standard & quite a few people have repeatedly complained about their quality.
My ISP will not give the required details in order to allow its subscribers to use a third party modem / router. They simply say they will nor provide any support for third party routers.
@@tonydaly2642 Hi Tony, can I suggest you try QuickConnect first. Synology claim that it can punch through firewalls so it might offer you a simple solution.
@@mydoodads I've tried QuickConnect & it worked fine.
I was able to log into my Synology NAS & view all settings etc.
Using the various DS programs I was able to play movies, listen to music, view photo's etc.
Thanks for the suggestion & all your help.
Tony.
A pleasure. Enjoy your NAS ;)
.. and the NAS is DS918+
My Virgin Media Hub 3.0 is not compatible what can I do
As you UPnP on your NAS will not automatically allow you to configure your Virgin Media Hub. You will need to manually enable port forwarding yourself. So you will need to do the following:
1. Note down the Port numbers to the services on your NAS that you want to have access to remotely. I would recommend that until you get familiar with what you are doing. Try enabling only one service at a time. I would suggest starting with something like DSM (ports 5000 and 5001).
www.synology.com/en-us/knowledgebase/DSM/tutorial/Network/What_network_ports_are_used_by_Synology_services
2. Access the settings on your Virgin Media Hub, and make sure that from within DHCP you have assigned a static IP address to your NAS.
3. Try and setup DDNS on your NAS (if you have not already enabled it)
4. Return to your Media Hub and create the port forwards to your NAS for Audio Station. As I am not familiar with Virgin Media Hub 3, these notes on port forwarding might help you - www.cfos.de/en-gb/cfos-personal-net/port-forwarding/virgin-media-hub-30.htm
5. Test that you can remotely access the DSM
6. Rinse and repeat for any services you want remote access to.
Hope this points you in the right direction.
@@mydoodads I have followed all your lessons on UA-cam Belinda now on lesson 34 for it tells me I need to set my router to bridge mode but my router don't have Bridge mode and to check that my public domain name is checked Does that mean I need to buy a new router
Strangely enough, when I open the DDNS I created with ...diskstation.me, it opens my QNAP NAS page rather than my Synology NAS?!
What happens if you type yourname.diskstation.me:5001?
For example does it open your DSM rather than your QNAP NAS page?
If it does then the issue might be related to your routers firewall and port forwarding rules.
While Im not as familiar with QNAP NAS devices, I think they will open QTS via port 8080. Just for your info DSM opens on ports 5000 and 5001.
It's worth noting that Port 80 and port 8080 are both default web services ports.
either
@@mydoodads Man, you really know your stuff! You did it again!! :-)
It was in fact opening with port 8080! However, I don't understand why it resolves to port 8080 instead of 5000 when I simply type myname.diskstation.me ?
Not a big issue but odd. Anyway, I now know how to get to each NAS with only changing the port number instead of a dedicated DDNS for each....that's the upside of this annoyance ;-)
I have a question. With the help of your videos, I was able to set up external access securely. Here is the problem... the site works well using mysite.synology.me (and I get the padlock).... I have blocked 5000 non secured connections... but the site is accessible with myIPaddress:5001 and that's not secured. How can I stop the connection with the IP address? Thanks!
Is that your local network IP address or your public internet IP address?
@@mydoodads my public internet IP address.. thanks
@@akheraj81 I think in the first instance try checking that a setting on your NAS called "Automatic redirect HTTP connections to HTTPS (Web Station and Photo Station excluded" has been enabled.
You will find this setting in Control Panel - Network - DSM Settings
@@mydoodads Thank you. It was not checked, so I checked it. But that didn't solve the problem. I can still access it by external IP address, so when I go to :5001, it works but doesn't have the padlock so it's not secured. The certificate I believe is for mydomainname.synology.me
I have the same issue. I can access my NAS using the *.synology.me:5001 on my phone, but not on my PC. On PC i can access it only using the internal IP and this IP is not secured
@mydoodads
when I enter my ip into my browser, I get this message;
"Web Station has been enabled. To finish setting up your website, please see the "Web Service" section of DSM Help"
And if I try using my synology.me DDNS, I get THIS message;
This site can't be reached
XXXXXXX.synology.me took too long to respond
Try:
Checking the connection
ERR_CONNECTION_TIMED_OUT
--------------------------------------------------------------------------
So what does that mean doodads ?
WebStation is automatically enabled when you install the Photo Station package. As WebStation is a web page server, it automatically becomes the default service that your NAS points to. So when you enter the IP address of your NAS into your browser, you are automatically shown whatever file has been placed in WebStation.
However by default, as currently you have no web pages in WebStation you get the message you see. So if you create a simple HTML file on your computer and name it index.htm. By placing that file in the Web folder of your NAS (you will find a share called Web if you open File Station).
Now when you enter your IP address in your browser, you will see your html file.
As your IP address now defaults to WebStation. In order to access other services you will need to use either its alias or its port number. So for example to access the DSM you would use 192.168.1.2:5000 Then for something like Video Station you would use 192.168.1.2/video
On my personal NAS I was able to stop WebStation from hosting web pages. I think it was simply to uninstall WebStation, so I’ll add this to my list of tip videos to make in the future.
As to your second question, on your home network do you have a branded wireless router which you have connected to the WiFi router that was provided by your Internet Service Provider?
@@mydoodads --
Ok, I'll give that tip you mentioned a try. I'll let you know how it works. I THINK I understand what you're saying, but I'll give it a shot !
No, I'm not using my ISP's router/modem. I'm using it in "bridged mode", and I have an ASUS RT AC-5300, a top drawer tri-band router that runs on DD-WRT, so it's a very flexible piece of kit.. . . not cheap either. This is what I use to run my network.
@@mydoodads -- Well I gave it a try. .. . and for a short time it seemed to work. . . . then same error message and stalled web page. Allow me to explain;
-- I created a simple html doc and placed it in my "PUBLIC" folder [the folder I want to designate as where I will drop files etc for friends I want to grant access to look at and download.
-- I tested it with my iphone with wifi turned off to put my device "outside" my network, as you did in this video.
-- I tested it and it worked ! ! ! ! I used the username and password I gave to my friend and it worked just fine.
-- I notified him that it was up and go at it [btw, I live in Canada, and he is in Ireland. . . but that shouldn't matter right ? ]
-- He tried it and got essentially a stalling web page that failed to load and gave him a message like "Hmmmm cannot reach this webpage. .. blah blah check that the address is correct, check your internet is working, , , same standard crap.
-- I went in and tried it again with my device "outside my network, and sure enough I could not get in either.
-- I decided to re-UPDATE my ddns address, it did it's thing and I got the green letters saying normal. And i re-did the "configure router" settings as well. Then I hit test and got ok's for the connections I wanted.
-- Tried it again and now the test connections tab is stalling.
I am at a loss as to what to do mydoodads.
All connections keep showing failed under External Access - Router Configuration. I've gone back to part 33 and meticulously checked everything all the way through to this failure. I have a Netgear Nighthawk ax12 router and everything else has worked perfectly up to this point. any suggestions?
Hi Fred,
I did try to be as generic as I could when making the video. As I do realise that there are so many different models and makes of router on the market.
I suspect that the Nighhawk ax12 router may not be supported by your Synology NAS. I did a quick check and I can't see your router listed in Synology's compatibility document - www.synology.com/en-uk/compatibility?search_by=category&category=routers&p=7
If that is the case, then you are going to need to manually setup port forwarding rules from your router to your NAS.
If you did not assign your NAS with a static IP address, I would recommend that you do that first. Please see part 4 in the series.
Can I also suggest that you keep things simple and start by just creating a port forward rule for Management UI - TCP 5000 and 5001. Then test to see if it works.
If you are successful, then create port forwards to the other services you want remote access to on your NAS.
I took a quick look at the user manual for your router. It should be fairly straight forward to manually create any port forwarding rules that you need.
There is even a section in the manual called "Manage port forwarding to a local server" page 152
Netgear manual - www.downloads.netgear.com/files/GDC/RAX120/RAX120_UM_EN.pdf
Sorry, I cant be more help.
@@mydoodads Thank you, I will try that.
@@fredwright3790 Jesus he took like 30 min to write his answer and you have nothing more to say that "Thank you, I will try that." without even letting him know if it worked. What a lack of education.