Working on the LAN is the easy half. This page is the honest grading of every way to reach the same server from outside — safest first, and the two doors that must never be opened.
The setup works on the LAN. Now someone asks the dangerous question: can I reach it from home, from a hotel, from a client's office? Yes — but the way you open the door decides whether you built a service or an invitation. This page grades the routes honestly, safest first.
With a VPN, nothing about the file server changes and nothing is exposed: the outside device joins your network virtually, then uses SMB, SFTP or DSM exactly as if it were in the building. Synology can be the VPN server itself, or your router can. This is the right answer for staff who need full access, and the only route under which SMB shares should ever be used remotely.
If the need is only move files, forwarding TCP 22 to the NAS for SFTP is a defensible, simple setup: one port, encrypted, per-user accounts. The conditions are the checklist on this page — real passwords, auto-block on, unneeded users denied the SFTP application permission, and logs enabled so you can see who knocks. Expect strangers to knock anyway; that is what the conditions are for.
FTPS can be forwarded if a partner's system genuinely requires the FTP family — remember the passive range must be forwarded too. Plain FTP across the internet is not a route; it is a leak with a schedule. The password is readable on the path, so the only question is who collects it first. If a tool offers you nothing but plain FTP for internet transfers, the tool is the problem — replace it, do not expose the NAS for it.
TFTP (UDP 69) has no authentication whatsoever — forwarding it hands your TFTP root folder to the entire internet. SMB (TCP 445) is the most scanned and exploited file service on the internet; ransomware crews look for it by name. Neither gets a forwarding rule, ever. Their jobs are LAN jobs.
Exposure is a subscription, not a purchase. Once a week: open Log Center, read the Connection and File Transfer logs for logins you do not recognise, check for accounts nobody remembers creating, and install DSM updates — most NAS compromises are old bugs, not clever attacks. The week you stop doing this is the week the exposure stops being managed.
445, forwarded plain FTP, forwarded TFTP. Any one of the three undoes the good passwords and permissions you set up — the protocol itself gives the game away before your password is even asked.
All four protocols enabled in DSM with users and quotas — then come back here before opening anything to the internet.
▶️ Watch Full VideoQuickConnect is Synology's relay service for reaching DSM and File Station without port forwarding. It avoids exposing ports, which many people prefer, though you are trusting Synology's relay. For direct protocol access like SFTP with your own tools, a VPN or a careful port 22 forward is the route in this guide.
Internet-facing SSH attracts constant automated knocking — that alone is normal. Make sure auto-block is enabled in DSM security settings, every account has a strong unique password, SFTP application permission is denied for users who do not need it, and consider changing the SSH port to reduce the noise.
Yes, and do it properly: create a dedicated account for them, give it access to only that one shared folder, allow only the SFTP application, set a quota, and disable the account the day the job ends. Never share your own login.