Four protocols on one NAS, four very different personalities. This page is the map: what each protocol is genuinely good at, where each one becomes a risk, and a 30-second test for choosing.
SMTP has a saying problem, and file protocols have the same one: too many doors, no idea which to use. Here is the honest map for a Synology NAS running SMB, FTP, SFTP and TFTP. The protocol is not a fashion choice — it is a job choice. Match the job first and the settings almost decide themselves.
SMB is what Windows, and by now macOS and Linux too, use to open shared folders as if they were local drives. It supports live editing — two people, one Excel file, proper locking — and it works with drive letters and shortcuts. Its price: it is chatty and designed for trusted networks. Use it inside the office or home LAN, over a VPN when remote, and never forward port 445 to the internet.
SFTP runs over SSH on a single port, 22, and encrypts everything — password, file names and file contents. Tools like WinSCP and FileZilla speak it, scripts love it, and it passes through firewalls cleanly because it needs exactly one port. For sending files to another office, a client, or your own laptop from a hotel, this is the default answer. On Synology you get it by enabling the SSH service.
Plain FTP is from 1985 and it shows: no encryption, a separate data connection that firewalls hate, and credentials in clear text. Its only honest reasons to exist are devices and software too old for anything else. FTPS is FTP wrapped in TLS — same family, now encrypted — and is the right upgrade when the other side supports it. If a new system offers you SFTP and FTPS, prefer SFTP: one port, simpler, fewer surprises.
TFTP does not even ask who you are. That is not a flaw for its real jobs: a PC booting from the network or a switch pulling a firmware file just needs bytes, fast, inside a controlled room. Keep its root folder dedicated and boring — boot images and firmware only — and never put a document you care about in it. If a human with a password is involved, TFTP is the wrong door.
Ask three questions. Is the other side on my own LAN and opening folders like drives? SMB. Is anything crossing the internet, or is a script or outside person involved? SFTP (FTPS second). Is a machine fetching a boot or firmware file with nobody logging in? TFTP, on a short leash. And the tie-breaker that never fails: when two protocols both work, choose the one that encrypts.
SMB, FTP, SFTP and TFTP enabled one by one in DSM, with users and quotas — the full video walkthrough.
▶️ Watch Full VideoNo. SFTP is a different protocol that runs over SSH on port 22 and encrypts everything. FTPS is classic FTP with TLS encryption added. Both are encrypted, but they are not interchangeable — a client must match the server's choice.
Please do not. SMB is built for trusted local networks and is a favourite target when exposed online. For internet access use SFTP, or connect through a VPN and then use SMB inside that tunnel.
Because some jobs have no human and no keyboard — a computer booting from the network, a switch loading firmware. Inside a controlled network segment that is acceptable. For anything involving people or private files, use a protocol with accounts.