Manual

Recipe: a NAS reachable at home and nowhere else

Your files from the sofa, nothing from the internet.

The goal: your NAS always has the same address, the devices that need it can reach it, and nothing of it is open to the outside. A NAS is the most attractive machine in a home network: everything is on it and it is always on.

What you need

  • The MAC address of the NAS network port. It is in the NAS itself, or you can read it later with /ip dhcp-server lease print.
  • A decision: one flat network, or VLANs. Both work, the steps differ.

Step 1: decide where it belongs

A NAS belongs in the network of the people who use it: your ordinary LAN, or your work VLAN. Not in the guest or IoT network, because those are isolated and then you cannot reach it either. A VLAN just for the NAS is possible, but it only adds work if nothing else lives there.

Step 2: a fixed address

On one network without VLANs this happens in LAN & DHCP:

  1. Add a row under Fixed addresses (static leases) with the MAC address, the IP address and a name.
  2. Pick an address below the pool. The DHCP range starts at .10 by default, so .2 through .9 are free for fixed devices.

If the NAS sits in a VLAN, the honest answer is that the VLAN table has no field for fixed addresses. The tool does create a DHCP server per VLAN, but reservations only exist in LAN & DHCP and apply to the untagged network. Two ways around it:

  • Set a fixed address on the NAS itself, outside the DHCP range. The pool runs from .10 upwards, so choose something lower.
  • Or add the reservation on the router after pasting the script. A VLAN's DHCP server is named dhcp- plus the VLAN name, so for example: /ip dhcp-server lease add mac-address=AA:BB:CC:DD:EE:FF address=192.168.10.5 server=dhcp-vlan10-lan.

Do not switch on ARP entries only for DHCP leases in LAN & DHCP if you let the NAS set its own address. Devices without a lease stop communicating, and that would be exactly your NAS.

Step 3: a name instead of a number

Under DNS, add a row to Static DNS records: name nas.lan.example.nl, type A, address from step 2. Fill in the same domain under Domain name so your devices get that suffix from DHCP. The record is the exact name you type; the router does not append a domain of its own.

Step 4: access from other VLANs

Without VLANs you are done here. With VLANs, Firewall & NAT decides who may reach it:

  1. Set Traffic between VLANs to Only what is ticked in the matrix.
  2. Tick the cell that lets the VLAN with your workstations start connections towards the VLAN holding the NAS. The opposite direction is not needed: replies always come back.

The matrix works per network, not per port. To let one VLAN back up but not open the web interface, use Custom filter rules: chain forward, action accept, protocol tcp, Dst. port the port you allow, Dst. address the NAS and In-interface the VLAN it comes from. Custom rules are written before the matrix rules, so this exception wins over the block below it.

Step 5: backups over a VPN, not an open port

A backup to a second location needs nothing opened. In the VPN section, add a peer of kind Site-to-site to the WireGuard interface:

  1. Fill in the Peer public key, the Endpoint if that side has a fixed address, and the other location's subnet under Networks behind the peer.
  2. The tool adds a route to that subnet through the tunnel, so the backup job uses the address on the other side as it would a local one.

If you want to reach the NAS yourself from outside, use a road-warrior peer and the client configuration the tool puts next to the script.

Testing it

  1. Reboot the NAS and check with /ip dhcp-server lease print that it gets the address you meant and that the lease shows as static.
  2. Ping the name from step 3 from a laptop. If the name fails but the address works, the DNS record or the domain name is wrong.
  3. Try the NAS from a VLAN you did not tick. That should fail. Use /ip firewall filter print stats to see which rule stops it.
  4. Check from outside, for instance over your phone's mobile connection with the VPN off, that nothing of the NAS answers.

What to watch out for

  • No port forward to SMB. The tool warns when you forward 445, 3389, 23 or 21, and it is right. Those ports belong behind a VPN.
  • The vendor's cloud feature goes around your firewall. Services like QuickConnect make an outgoing connection, and outgoing traffic is not blocked. If you do not want it, switch the feature off on the NAS, or switch Internet off for the VLAN it lives in and accept that updates stop too.
  • Hairpin NAT. If you do have a forward, Hairpin NAT is on by default so the public address also works from inside. Convenient, but it means a badly configured app on the inside takes the same route.
  • Moving off the ISP router? If your old network was 192.168.1.0/24 and the new one is 192.168.88.0/24, the NAS address changes. Update the backup targets on your computers, or keep your old range.

Related: LAN & DHCP, DNS and VPN to your home.

Want to try it right away? Open the configurator