When does data flow thru QNAPs servers

[moxley]

What actually gets sent through QNAPs servers when using the https://qlink.to/device address (which then connects to the IP address) ?

What about when using the Qfile app on a phone?

The reason I am asking is because one of the main uses for my unit is as a massive media server. I stream music to my phone via plex or Qmusic to listen in my car etc. Does all of the data go through QNAPs servers or is it only the initial name resolution?

[dolbyman]

only cloudlink goes via QNAP servers (nat traversal), the regular qnapcloud DDNS server exposes your NAS directly to the web, with all the dangers involved (hacks,cryptolocks,etc)

[Moogle Stiltzkin]

disable cloudlink and myqnapcloud in qts.

if you have myqnapcloud qnap linked, you can deregister/delink.

also don't port forward your qnap.

[moxley]

Thanks for the responses....

I've worked in IT professionally since 1995 and manage IT operations for a secure site for an aerospace company, so I'm fairly well versed in all of the various threat vectors; with that said, one of the main points of having it is to be able to access it remotely....

What I dont want is my data making extra hops through QNAPs servers if it is going to add latency etc.

I have to tell you though, I have had one of my QNAPs exposed to the web for a couple of years with no issues. I keep it a close eye on the logs on that and my Mikrotik - keep the QNAP updated, use best practices when it comes to passwords. The biggest issue I had was people trying to SSH into it, so I only enable SSH if I'm going to be connecting with Putty for some reason. It's not how I want to keep things though...

I have some domains, I suppose I could always get a static IP and point one of my domain names at it..

What do you guys do to secure yours yet allow access to the mobile apps?

Do you know if 2FA ruins the ability to log in on mobile apps?

[OneCD]

What do you guys do to secure yours yet allow access to the mobile apps? .

Create a VPN server-instance on your router (if supported), and only connect to your LAN via VPN when you're external to it.

[moxley]

[/quote]
Create a VPN server-instance on your router (if supported), and only connect to your LAN via VPN when you're external to it.
[/quote]

I can certainly do that, and for anything sensitive I would.

I am primarily using this to stream live music (I have a 10TB library of live recordings ive been collecting for 30 years) to my phone to listen in the car. Id have to conenct to the VPN and then use the app. Im not sure how that would affect the quality of the streaming. I guess I can experiment, but my feeling is that it likely would create latency issues and drop outs.

[dolbyman]

If you have this NAS out in the open for years ....without issues .. you got lucky

https://www.bleepingcomputer.com/forums ... ort-topic/
https://www.bleepingcomputer.com/news/s ... h-malware/

QNAP is trailing behind in security .. they even only acknowledge issues like that after they have been surfacing in all sorts of media (so very far from proactive)

2-factor authentication only helps if the whole system is not compromised by exploits

so go with OneCD's advice and connect via VPN only preferably on a dedicated hardware device like router or firewall.

[OneCD]

I guess I can experiment, but my feeling is that it likely would create latency issues and drop outs.

I agree, it's a terrible idea.

So, load-up your phone before you leave your LAN.

[OneCD]

If you have this NAS out in the open for years ....without issues .. you got lucky

BTW: @dm - can you remember if anyone running QTS 4.2.6 has been affected by hacks?

I think it's only been those on 4.3.0 or later. Maybe those older QTS versions were safer? I've been keeping my eyes-open for a 4.2.6 hack, but haven't seen one yet.

[dolbyman]

did not keep an eye on FW affected ... could very well be that pre 64 bit (< 4.2.6) are "safe".. maybe incompatible modules trying to get side loaded)

[OneCD]

did not keep an eye on FW affected ... could very well be that pre 64 bit (< 4.2.6) are "safe".. maybe incompatible modules trying to get side loaded)

Agree. And QTS was a lot simpler.

You know, one day some unknown NAS manufacturer will hit on the idea of making a NAS that just operates as a NAS (file server). They'll forego all the stupid BS applications, and will offer only a handful of models for purchase - each one a well-tested, rock-solid unit. They will develop a reputation for their stable and reliable NAS, and will sell millions of them. Wouldn't that be something? A product so-good, it wouldn't even need support forums.

[dolbyman]

that would be amazing ..lol