Synology DDNS and Port Forwarding

QuickConnect is fine for the occasional file from a phone, but it relays through Synology's servers and I got tired of how slow it is for anything bigger. To reach the NAS directly you need a hostname that follows your changing home IP and a few ports opened on the router. DSM 6 handles both from Control Panel → External Access.

Here's my setup, with the exposed surface kept as small as I can manage. Before you start, give the NAS a fixed LAN address (Control Panel → Network → Network Interface → Edit, or a DHCP reservation on the router) and have a Synology account ready for the free synology.me DDNS.

Register a DDNS hostname

Go to Control Panel → External Access → DDNS and click Add. The Service provider dropdown includes Synology, No-IP, DynDNS, Google Domains, a number of regional providers, and a Customize option for anything else.

For Synology's own service:

• Service provider: Synology
• Hostname: myname.synology.me
• Log in with your Synology Account when prompted
• External address (IPv4): Auto

Click "Test Connection"; the status should show Normal. DSM then updates the record whenever the WAN address changes, checking about every few minutes.

If your provider is not listed, pick Customize and enter the update URL with placeholders, for example:

https://dyn.example.com/update?hostname=__HOSTNAME__&myip=__MYIP__&user=__USERNAME__&pass=__PASSWORD__

Check that you actually have a public IP

Before opening any port, confirm the router's WAN address is public. Log in to the router and compare its WAN IP with what curl ifconfig.co returns from a machine on the LAN. If the WAN IP is in 10.0.0.0/8, 100.64.0.0/10 or 192.168.0.0/16, your ISP puts you behind carrier-grade NAT and port forwarding will not work; you are limited to QuickConnect or a VPN out to a VPS.

Forward the ports

There are two ways. The convenient one is Control Panel → External Access → Router Configuration. Click "Set up router"; DSM discovers the router via UPnP and lets you tick the services to forward. The list is built from installed packages: DSM HTTPS (5001), File Station, Photo Station, and so on. Click Save and DSM pushes the mappings to the router.

I prefer doing it by hand in the router, because then I know exactly what's open. Forward only what's needed, to non-default external ports:

Never forward 5000 (DSM over HTTP) or 22, and think twice about 445 (SMB), which should never face the internet.

If you used the DSM wizard, you can see and remove mappings later from the same page. If you did it by hand, disable UPnP on the router so applications on the LAN cannot open holes on their own.

Certificate for the hostname

With a public hostname and port 80 forwarded temporarily, DSM 6 can request a Let's Encrypt certificate: Control Panel → Security → Certificate → Add → "Get a certificate from Let's Encrypt". Enter myname.synology.me and an email. Let's Encrypt validates over port 80, so forward 80 → 80 for the duration and remove it afterwards; renewals need it too, so a cleaner option is to leave 80 forwarded and make sure DSM's HTTP redirect is on (Control Panel → Network → DSM Settings → "Automatically redirect HTTP connections to HTTPS").

Testing from outside

Use a phone on mobile data, not the home Wi-Fi. I forgot this once and spent an hour "confirming" a setup that only worked because of NAT loopback.

nslookup myname.synology.me

The answer should match the router's WAN IP. Then open https://myname.synology.me:44301 and expect the DSM login with a valid certificate. From a Linux box outside the network:

nmap -Pn -p 44301,5000,5001,22 myname.synology.me

Only 44301 should show as open.

Gotchas

• DDNS status shows "Connection failed" or "Failed to update": the NAS cannot reach the provider, usually a DNS or firewall issue. Check Control Panel → Network → General has working DNS servers and that the DSM firewall allows outbound traffic (it does by default).
• Router Configuration says "No router detected": UPnP is off on the router or the router is not on the same subnet. Configure forwarding manually.
• Hostname resolves but the connection times out: the forward is wrong, or DSM's firewall blocks the port. Check Control Panel → Security → Firewall for a rule allowing 5001 from all, or add one for the specific port.
• Works from outside but not from inside using the hostname: the router does not support NAT loopback. Add the hostname to the local DNS or use the LAN IP internally.

Pair the open port with Auto Block (Control Panel → Security → Account) and, if possible, the firewall's country restriction. One HTTPS port on a high number is a trade-off I can live with. Anything more, I'd put behind a VPN.