DB-유

Synology QuickConnect vs DDNS: Which to Use

· synology, networking, remote-access

The most common complaint I hear about remote access to a NAS is "it's so slow", and nine times out of ten it's QuickConnect in relay mode. QuickConnect relays through Synology's servers and needs no router setup; DDNS gives your changing home IP a stable hostname and leaves the port forwarding to you. The wrong pick is either painfully slow or needlessly exposed.

Here's how they differ, and how I set up each on DSM 6.1.

QuickConnect in short

You register the NAS under a QuickConnect ID (for example myhomenas) and clients open https://quickconnect.to/myhomenas or type the ID into DS file, DS photo and the other mobile apps. Synology's servers look up your NAS, and one of three things happens:

  1. If you are on the same LAN, the client is redirected straight to the local IP.
  2. If your router supports UPnP or you forwarded the ports, the client is redirected to your public IP (a "hole punching" direct connection).
  3. Otherwise traffic is relayed through Synology's servers.

Case 3 is the real cost. Relay speeds are throttled and a large file transfer through relay is slow enough to be unusable; it is meant for browsing photos and fetching a document, not for syncing a laptop.

DDNS in short

Your router gets a new public IP from the ISP now and then. A DDNS client on the NAS keeps a hostname like myhomenas.synology.me pointed at the current IP. Then you forward the ports you need on the router, and clients connect directly. There is no middleman, full speed, but every forwarded port is a service exposed to the entire Internet.

Setting up QuickConnect

Control Panel → QuickConnect → tick Enable QuickConnect. Log in with your Synology Account (create one if you have not) and choose an ID. Under Advanced, untick the services you do not need remotely; I typically leave only DS file and Photo Station on and disable DSM itself, because I do not want the management interface reachable via relay.

# Control Panel -> QuickConnect -> Advanced
DSM               : off
File Station      : off
DS file           : on
Photo Station     : on
Cloud Station     : off

Setting up DDNS

Control Panel → External Access → DDNS → Add. The Synology provider (*.synology.me, *.diskstation.me, etc.) is free and needs only your Synology Account. Pick a hostname, tick "Get a certificate from Let's Encrypt and set it as default" and the NAS will request a real certificate for that name.

If you already own a domain, use your registrar's DDNS API instead, or point a CNAME at the Synology hostname:

nas.example.com.   CNAME   myhomenas.synology.me.

Under Control Panel → Security → Certificate you can later add the Let's Encrypt certificate for nas.example.com too.

Forward only what you need

I never use the Router Configuration wizard. Its default set opens a dozen ports and I don't want to audit that list. Forward on the router by hand:

# Router port forwards
TCP 5001  -> 192.168.1.10:5001   # DSM over HTTPS (only if really needed)
TCP 443   -> 192.168.1.10:443    # Web Station / reverse proxy

Leave 5000 (plain HTTP), 22, 139/445 and 548 closed. If you need SMB from outside, use a VPN instead (the VPN Server package supports OpenVPN).

Then in Control Panel → Security → Firewall create a profile that allows the forwarded ports from all sources but restricts DSM management to your country or to your LAN using the geo rule. Enable Control Panel → Security → Account → Auto Block as well.

HTTPS and default ports

Control Panel → Network → DSM Settings: tick "Automatically redirect HTTP connections to HTTPS" and enable HSTS. Changing 5000/5001 to something else does not add security, but it does cut the noise in your logs from scanners that only try the defaults.

Testing from outside

From a phone on mobile data (not your Wi-Fi):

nslookup myhomenas.synology.me
curl -I https://myhomenas.synology.me:5001/

The IP should match what curl ifconfig.co shows from inside your LAN, and the HTTPS header should come back without a certificate warning. For QuickConnect, open https://quickconnect.to/myhomenas and check Control Panel → QuickConnect; the status line reports whether the current connection is relay or direct.

Notes

  • QuickConnect status shows "The Internet connection is unavailable" although the NAS can browse: outbound TCP 443 to *.quickconnect.to is blocked by your firewall or content filter.
  • DDNS shows "Unable to update the DDNS record": the router already registered the same Synology hostname, or the Synology Account password changed. Remove and re-add the entry.
  • Let's Encrypt fails with "Failed to connect to Let's Encrypt. Please make sure the domain name is valid": port 80 must be forwarded to the NAS during issuance, because the challenge is HTTP-based. You can close it again afterwards, but renewal every 90 days needs it open again.
  • Clients on the LAN see a certificate warning while using DDNS: you are connecting by IP. Use the hostname and enable NAT loopback on the router, or add a local DNS override.

My rule of thumb: QuickConnect for family who only use the mobile apps, DDNS plus a Let's Encrypt certificate and a strict firewall for anything that needs real throughput. On my own units both are on, but DSM itself is only reachable through the VPN.