How do I securely access my NAS from the Internet using QVPN?
Applicable Products
- QTS / QuTS hero NAS (with QVPN service)
- QuHora series
- QMiro series
Scenario
You want to securely access your NAS over the Internet by requiring all connections to use a VPN tunnel. You plan to use the QVPN service on your NAS, but your NAS may not support QVPN. You are also considering using a QNAP router (QHora or QMiro) as a VPN server.
Solution
1. Using QVPN service on a supported NAS
- Enable the QVPN service on your NAS.
- Configure a VPN server (such as QBelt, OpenVPN, L2TP, or WireGuard) in QVPN.
- Manually open only the specific VPN service port(s) on your router that correspond to the VPN protocol you are using. See the table below for commonly used port numbers.
- Do not open other NAS service ports to the Internet. This ensures all access is tunneled through the VPN.
| VPN Protocol | Default Port(s) | Protocol Type |
|---|---|---|
| L2TP/IPSec | 500, 4500, 1701 | UDP |
| OpenVPN | 1194 | UDP |
| WireGuard | 51820 | UDP |
| QBelt | 443 | UDP |
Note: The actual port numbers may be customized in your device settings. Always confirm the configured port in your QVPN management interface.
Security Reminder: For best security, avoid enabling UPnP (Universal Plug and Play) on your router. Instead, use manual port forwarding to control which ports are open to the Internet. Enabling UPnP can unintentionally expose additional services to the Internet, increasing security risks.
Tip: If your device cannot locate the router, use the rescan or diagnostics features.
2. If your NAS does not support QVPN service
- You can use a QNAP router (QHora or QMiro series) as a VPN server.
- Configure the VPN server (such as QBelt) on the router using the QuRouter management interface.
- Manually open only the VPN service port(s) on the router for the chosen VPN protocol. Refer to the table above for default ports, and verify the settings in your device interface.
- Connect to the VPN server from your client device, and then access your NAS through the secure VPN tunnel.
- Do not expose NAS service ports directly to the Internet.
Limitations
- If your NAS is too old to support QVPN, you must use an external VPN server, such as a QNAP router, to provide secure access.
- Port numbers may be changed from their defaults. Always verify the actual port configuration in your device interface.
