This is the design the video actually builds: one card talks to the office, another faces the router and the outside world, each with its own static IP. File sharing stays inside; only chosen services face out. Here is how to set it up without locking yourself out.
A NAS with one port wears two hats at once — file server for the office, and target for every remote login attempt that finds it. The video gives it two ports and splits the hats: a LAN card for the internal network, a second card on the WAN side, each configured manually with a static address. Done right, this split is the cheapest security upgrade a small office can make.
Decide the two networks before touching DSM. One is your internal LAN — the subnet your office PCs live on. The other is the second network the WAN-facing card sits on, towards the router and the outside world.
Write the mapping down: card, subnet, static IP, job. Each interface gets an address only from its own subnet, chosen outside that network's DHCP range so no router ever hands the NAS's address to a phone. Two minutes of paper here prevents the classic fault of two cards arguing inside one network.
Control Panel > Network > Network Interface, select the LAN card, and set its manual IPv4 address from the office subnetControl Panel > Network > GeneralThis is the same static-IP discipline the video applies card by card — manual configuration on every interface, no DHCP surprises later.
The split only means something once the rules enforce it. In Control Panel > Security > Firewall:
Security > Protection, as the video does, so repeated login attacks block themselvesA port with no named job stays shut. That single habit is most of what "security" means on a small NAS.
Test like a user, then test like an attacker. From an office PC, confirm shares open at full speed and every daily tool connects to the LAN address as before.
Then, from the second network — a phone on mobile data reaching the WAN side is the honest test — confirm that DSM's login page and the file shares are not reachable, except through the specific service you chose to publish. Any surprise you find now is a configuration note; the same surprise found later is an incident.
Two ports still end at the same DSM, with the same users and the same passwords. A weak admin password, a shared account, or an unpatched system loses both networks at once, no matter how elegant the split looks on paper.
Treat the split as what it is: a real reduction in exposure, and a tidy structure. Then finish the job with the unglamorous trio — DSM kept updated, strong unique passwords, and 2-step verification on the admin account.
The video shows the card assignment, the static WAN and LAN addresses, and the protection settings — watch it before you rewire your own NAS.
▶️ Watch Full VideoThe one that reaches the internet — in this layout, the WAN-side card. DSM lets you choose the default gateway in Control Panel, under Network and then General. The LAN card keeps a plain address with no gateway of its own.
Yes, through the WAN-facing interface, as long as the router path and the DSM firewall allow the specific service. Test remote access right after the change, not the first time you actually need it from somewhere else.
Your PCs resolve a name to one address. Keep the LAN address as the main one for office use, and treat the WAN-side address as a separate door that you reach by its IP or by its own name.