家庭网络优化搭建咨询：NAS及远程可访问服务部署需求

Hey Marcus, let’s dive into your home network and NAS setup needs—since you’re looking to run a NAS plus DNS/VPN services with external access via FTP/SSH, I’ll break down hardware, software, architecture tweaks, and critical security notes to make this robust.

First, let’s cover the gear you’ll need to support these services smoothly:

• NAS Core Hardware:
  • CPU: Go for a low-power, multi-core chip like the Intel Celeron J4125 (budget-friendly) or AMD Ryzen 5 5600G (if you plan to run more heavy-duty Docker containers alongside NAS tasks). Avoid single-core CPUs—they’ll struggle with concurrent VPN connections or DNS queries.
  • RAM: Minimum 8GB, but 16GB is better if you’re running DNS, VPN, and multiple storage tasks at once. ECC RAM is a bonus for data integrity, especially if you’re storing critical files.
  • Storage: Use NAS-specific hard drives (WD Red Plus, Seagate IronWolf) for better reliability. Pick a RAID configuration based on your needs: RAID 1 for mirroring (data redundancy, good for small storage), RAID 5 for balance of space and redundancy, or RAID 6 if you need extra fault tolerance for large datasets.
  • Network: At least a gigabit Ethernet port—if you have other high-speed devices (like a gaming PC or 4K media player), a 10Gbps port will eliminate bottlenecks. Dual gigabit ports can be used for link aggregation if your router supports it.
• Network Router/Firewall:
  • If your current router doesn’t support port forwarding, DDNS, or custom firewall rules, replace it with a model that runs open-source firmware like OpenWRT or Merlin (Asus routers are popular for this). Alternatively, repurpose an old PC as a soft router to handle routing, firewall, and DDNS—this gives you full control over network rules.

Stick to tools that are easy to manage and integrate well with NAS workflows:

• NAS Operating System:
  • TrueNAS Scale: Open-source, free, and supports Docker containers—perfect for running DNS, VPN, and other services alongside NAS storage. It’s highly customizable and great for tech-savvy users.
  • Synology DSM: User-friendly, with pre-built kits for DNS, VPN, and remote access. Ideal if you want a plug-and-play experience without too much command-line work.
  • OpenMediaVault: Lightweight, Debian-based, and modular—great if you prefer a minimal setup with only the services you need.
• Service Setup:
  • DNS: Deploy Pi-hole (via Docker on your NAS) to handle local DNS resolution and ad blocking. Configure your router to use the NAS’s IP as the primary DNS server, so all local devices (and VPN-connected clients) use it. For more advanced DNS management, use Bind9.
  • VPN: WireGuard is the best choice for speed and simplicity—install it on your NAS or soft router. It uses less resource than OpenVPN and works seamlessly on mobile and desktop. If you need broader device compatibility, go with OpenVPN.
  • FTP/SSH: Use SFTP (SSH File Transfer Protocol) instead of plain FTP—it encrypts data in transit, which is critical for external access. Most NAS systems have built-in SFTP support; just enable it and set a strong password. SSH access should also be enabled for remote management, but restrict it to VPN-connected clients if possible.
• Remote Access:
  • DDNS: If you don’t have a static public IP, use your NAS’s built-in DDNS service (e.g., Synology DDNS) or a free service like No-IP to map a domain name to your dynamic IP.
  • Port Forwarding: On your router, forward only the necessary ports to your NAS: WireGuard (default 51820), SSH/SFTP (22). Avoid forwarding plain FTP (21)—it’s insecure.

Assuming your current setup is Optical Modem → Router → Home Devices, here’s how to optimize it:

• Bridge Your Optical Modem: Most ISPs set modems to router mode, which creates a double NAT (Network Address Translation) that can break VPN and port forwarding. Switch your modem to bridge mode so your main router/soft router handles PPPoE dialing and gets a full public IP.
• Centralize Services on NAS: Keep all services (NAS, DNS, VPN) on a single device connected directly to your main router’s LAN port. This simplifies management and ensures all traffic goes through the router’s firewall.
• Alternative: Soft Router as Gateway: If your existing router is underpowered, add a soft router between the modem and your main router. The soft router handles dialing, firewall, DDNS, and VPN, while your main router acts as a wireless access point (AP) for devices. This is a great way to upgrade without replacing your entire router.
• What to Avoid: Don’t connect your NAS directly to the modem—this bypasses your router’s firewall, exposing your NAS to the internet without protection.

External access means you need to lock down your setup:

• Enable two-factor authentication (2FA) for all services (NAS admin, SSH, VPN) to prevent brute-force attacks.
• Use certificate-based authentication for VPN instead of password-only logins—WireGuard makes this easy to set up.
• Configure your router’s firewall to only allow incoming traffic on the ports you’ve forwarded (e.g., 22, 51820) and block all other ports.
• Regularly update your NAS OS, router firmware, and Docker containers to patch security vulnerabilities.
• Consider using VPN as the only way to access SSH/SFTP externally—instead of port forwarding directly, require external clients to connect via VPN first. This adds an extra layer of security.

内容的提问来源于stack exchange，提问作者Marcus