Issues connecting NAS to VPN on Asus router and accessing via internet

[mitsubishi_908]

Hi,

I'm looking to get advice on how to set up my NAS (TS-253D) to be behind a VPN running on my Asus RT-AX88U router with Merlin firmware 388.1 and have the NAS still accesible through the internet. I am able to set up the VPN and have the IP of my NAS switch to the VPN IP when the VPN connection is active. However, I cannot access the NAS from the internet via my ddns (https://example.myqnapcloud.com). I would really appreciate your help!

Thanks!

[dolbyman]

you will access the NAS via it's internal IP (while connected to the VPN)

e.g.

http://NASIP:8080

if you can reach it via the QNAPcloud DDNS then it is exposed and in extreme danger

[mitsubishi_908]

Hi, thanks for the quick response. The issue is that I actually want to have access to my NAS remotely and so when I type in the IP address when I'm not on my LAN it doesn't work. Are there specific things I need to do to access it remotely when the NAS is connected to the VPN?

Thanks!

Sent from my SM-S901W using Tapatalk

[dolbyman]

It will wok as soon as the VPN connection is established

But as said, if it still works to access via the DDNS name, stop whatever you are doing and remove port forwards and disable upnp(on router). Then troubleshot your VPN connection.

See all these tears from other users that have exposed their NAS
viewtopic.php?f=45&t=164797
viewtopic.php?f=45&t=160849

[mitsubishi_908]

I did as you said but I still cannot access the NAS remotely. I've doubled checked to make sure the NAS was connected via the VPN and that I was seeing the VPN IP but I cannot access it. See picture below.

Sent from my SM-S901W using Tapatalk

[dolbyman]

make sure you disable access control and remove the firewall on the NAS

then test if you can ping the NAS from your WAN machine (via the VPN)

P.S. no need to censor private IP's, millions have the same

[mitsubishi_908]

Sorry, not sure where to go to disable access control?

Sent from my SM-S901W using Tapatalk

[dolbyman]

see here
https://docs.qnap.com/operating-system/ ... 8E110.html
https://docs.qnap.com/operating-system/ ... 86EFA.html

[mitsubishi_908]

Ok thanks, so I disabled all of those things and I tried pinging the NAS remotely but with no success.. Just wanted to clarify that the router VPN is setup as VPN Client and not VPN server. If that helps..

Sent from my SM-S901W using Tapatalk

[OneCD]

Just wanted to clarify that the router VPN is setup as VPN Client and not VPN server.

That's the problem, right-there. Connecting your router to an anonymising VPN provider as a client is not what's needed here.

You need to run a VPN server instance on your router. Then configure any device external to your network (such as your mobile phone) as a VPN client that connects to your router VPN server.

[dolbyman]

Unless router and your WAN client are part of a VPS VPN (OpenVPN offers these on AWS) where both connect to a common VPN as clients.

But if it is one of those paid services, no that is not what you need here (as OneCD said)

[mitsubishi_908]

ok, so if i understand correctly i need to set up the NAS as a VPN Server so that clients can connect to it only if they are connected through the VPN. In other words it wouldn't be accesible through the internet if someone tries to access it without being on the VPN?? I would also need to remove the "VPN Client" that's currently confirgured on the router? Sorry, I am new at this and just want to make sure my NAS is the least exposed as possible. Thanks for all your help dolbyman and OneCD!

[dolbyman]

No, you setup your router as the VPN server, NOT the NAS. And then connect your clients to the VPN server on the router.

Depending on how old your router is: Asus Merlin has now updated to include WireGuard in the GUI (I haven't tried that yet)

AX86U-Wireguard.JPG

[mitsubishi_908]

I realize this may be asking a bit much but anyway you could help me set this up in the Asus Merlin firmware? or is there a guide out there for this? I just tried a few different settings and it keeps telling me "OpenVPN server daemon failed to start." I downloaded the configuration file and certificate from the NAS QVPN and tried to enter that into the router but it doesn't seem to work.

[mitsubishi_908]

wireguard is available on my router. i can do that if it's easier. It does seem better from what i've heard.