Thanks man! I recognize that logo! Hope you are doing well!

What would you suggest as alternative

@@hundredfireify I tried doing it with my computer and it was frustrating not having the apps on my phone that’s tells me computers temps, wake on, storage size, status and etc.

You’re not paying for hardware, you’re paying for software

Thanks man!

The forums tend to be very gate keepery Is a VPN more secure: yes, but that then means you can’t share files from your NAS or get your family to backup their photos

For small organizations VPNs may be sufficient but in many cases they will not protect you from targeted attacks. It is often that companies get their network compromised through VPN because of vulnerabilities or leaked credentials. Also once VPN is breached the attacker often gains access to more than just a NAS, but other than this I am not convinced that QC will provide you with a better security.

@@SpaceRexWill Yes, indeed. You can set up a VPN connection to the firewall server and from there to the NAS, which is very secure. It's also going to exclude those family members unless you give them the configuration files to connect themselves, which largely makes the whole exercise moot.

I absolutely also want a comparison with Tailscale.

Open ports for inbound connections are not required, since the QC will fall back to synology relay service if its not possible to establish direct connection between the client and NAS. If your firewall allows hole punching then QC will try that first to make direct connection possible.

@@zaraza.ow do I allow holepunching? By enabling upnp on my pfsense/router? And after 2x has punched a hole in my router, does it close the hole after a certain time or does ist stay there for later usage?

tailscale is: - opensource - based on wireguard - uses strong encryption - the provider it self dont know what's happening in your tunnel - keys changes everytime you connect/reconnect to another tailscale connected computer - login security is pretty much handled with the most experienced guys out there (google, github etc..) quickconnect: - not open source - damn who knows how their tunnel works - is it even secure to begin with? - are you even sure that theyre not snooping on your traffic while in proxy mode? - your login security is heavily dependent on your NAS if you know how wireguard works in terms of handshake, yeah is damn secured as the tailscale relay it self really dont take with that handshake anymore even if your connected via DERP servers.

if you look for the 'direct' in the URL you know you are direct connected

Probably the most secure thing would be to require a VPN connection to firewall computer and then forward anything coming in through the authenticated VPN to be forwarded to the NAS. But, that's probably not necessary for most users.

That's not a good practice to directly open any port to the internet all the time. Better to have a PiVPN and open just the VPN port and you can access your network through the vpn. That said, QC is better than raw port opening.

Yes, my NAS is exposed with DDNS but with strict firewall rules and 2FA in place I’m not worried about it. I keep the nuclear codes stored offline 🤣

I have a video planned with that coming out april 19th!

Thank you!

or Tailscale

I haven’t been able to find a list of all the let’s encrypt sites. Do you know of one?

On the LAN, unfortunately, it will always tell you that it is insecure. SSL certificates will only work for WAN connections

You have to enable MFA for each account

@@SpaceRexWill thanks where can I find it to enable for mobile?

Tailscale is better

I presume you mean the Synology drive desktop app. I don’t know why it wouldn’t be if you’ve selected to have it connect via HTTPS. Everything is encrypted then. That’s what I do. I only quick connect in to access apps or files that I don’t have connected through drive. But almost everything I do is synced through drive.

Wouldn’t synologyDrive desktop app and NAS package just open more opportunity for breach? Don’t get me wrong, I want to use it, but I’d like to see somebody explore and discuss its security…

@@dcretney I’m not sure what nas package you’re referring to, but Synology drive connects using your connect ID (if that’s what you put into it, and you need for external access) so it’ll connect the same as the quick connect through the web browser. At least that’s my understanding.

Ok, thanks for the reply. I might not be remembering correctly since it was more than a month ago, but I thought I had to install a package on the Nas to enable SynologyDrive. It’s likely I am wrong.

@@davidcretney9921 oh yes, you’re actually correct. I was having a brain fart at the moment. You had to install Synology drive server and drive on the nas. But since you sign in from the app on your computer using your quick connect id as long as you have the option checked in the app to connect with SSL then everything should be encrypted and it’ll connect through to your nas through quick connect just without you physically opening the browser and logging into your nas.

You cannot, you can disable it which is basically the same

If QC uses synology relay instead of a direct connection then the performance will be usually bad. At least this is my personal experience. Alternative is to open your firewall for inbound connections and configure NAT (risky security-wise) to allow direct connection between NAS and client or set up a VPN or a cloudflare tunnel etc. But if you don't know how to do it it's probably better to stay with QC since you don't have to worry too much about more complex configuration as opposed to other methods.

Perhaps set up a firewall rule ? But I think you may end up with a can of worms before you get what you want.

@@DavidM2002 yeah I think you're probably right

Cloudflare allows for geolocation-based filtering etc. if you have domain registered with their service. But this will not work with quickconnect so you'd have to open your FW for incoming traffic. I think their zero trust tunnel or some VPN solution is probably a more secure option. Alternatively you could set up a reverse proxy with geoip filtering for example with a combination like pfsense+haproxy+pfblockerng.

@@jakesecondname2462 I’d check the Synology forums. I would bet someone has written a script or something that could do that. If you know any Linux, or someone that does, I think most things are possible.

yes

The answer is mostly, just not as secure as not having it enabled.

actually new advice says you need at least 32 characters, and including at least some emoji to extend the possible keys by 10x

I usually use a password-manager for that. And all theses passwords worked well. Until I setup OpenVPN from Synology-VPN package. I configured a user only for establishing VPN connections and login kept failing. Unfortunately my DSLmodem/router only speaks IPSec, what I do not wand to use for mobile devices.