Quick Connect or EZ Internet

[Dispatcher7]

After having my NAS for over two years I guess it is time to start some remote access. What is the difference between using Quick Connect and EZ Internet? Does one do something the other does not? I will be looking to access my files, photos, media and cameras.

Thank you.

 

[Telos]

Completely different. Check the Knowledge Base for details.

FWIW, never use EZ Internet.

 

[Rusty]

After having my NAS for over two years I guess it is time to start some remote access. What is the difference between using Quick Connect and EZ Internet? Does one do something the other does not? I will be looking to access my files, photos, media and cameras.

Thank you.

What you want is to compare QuickConnect with DDNS access or in the end VPN access. Depending on your needs/expertise some will be better some will be more complex, but in any case, ask away.

QC - relays over Synology and requires no port forward to get to your nas apart from configuring a QC name.

DDNS - direct access to your nas using Synology or 3rd party DDNS service that will point to your NAS (public IP). You will need to maintain a port forward list on your router for any app that runs on a custom port or push everything via Reverse Proxy (also an option on your NAS) via a single port

VPN - private tunnel back to your LAN that will allow you access to your services as you were inside your LAN even from a remote location. Will require router configuration, VPN configuration, and depending on the protocol and your devices that you will connect from, a VPN client (free or commercial) as well as the ability to import the VPN configuration into those clients.

 

[Dispatcher7]

What you want is to compare QuickConnect with DDNS access or in the end VPN access. Depending on your needs/expertise some will be better some will be more complex, but in any case, ask away.

QC - relays over Synology and requires no port forward to get to your nas apart from configuring a QC name.

DDNS - direct access to your nas using Synology or 3rd party DDNS service that will point to your NAS (public IP). You will need to maintain a port forward list on your router for any app that runs on a custom port or push everything via Reverse Proxy (also an option on your NAS) via a single port

VPN - private tunnel back to your LAN that will allow you access to your services as you were inside your LAN even from a remote location. Will require router configuration, VPN configuration, and depending on the protocol and your devices that you will connect from, a VPN client (free or commercial) as well as the ability to import the VPN configuration into those clients.

This will be used for personal use, 2 iPhones and a MacBook Pro. I had already set up QC when I first installed the one camera we have and I can connect to it from my iPhone. I did receive notice a few times when using DS Cam that I should set up port forwarding. After reviewing instructions on the Synology site I checked the QC settings and see that the automatic port forwarding option was already checked. Any way for me to know what DS Cam is using when I connect now?

I'm looking for the best connection to the NAS when not on the LAN, with security a priority. I hope to get away from using things like DropBox, Google Photo, iCloud, and iPhoto, as the NAS can do these things for me.

When you say QC relays over Synology does that mean everything I do relays or just the initial connection?

I'm pretty sure I could learn and set up the DDNS, with your guidance, if you think that will be a better solution for me. I do have an ASUS router.

Thank you.

Mark

 

[Dispatcher7]

What you want is to compare QuickConnect with DDNS access or in the end VPN access. Depending on your needs/expertise some will be better some will be more complex, but in any case, ask away.

QC - relays over Synology and requires no port forward to get to your nas apart from configuring a QC name.

DDNS - direct access to your nas using Synology or 3rd party DDNS service that will point to your NAS (public IP). You will need to maintain a port forward list on your router for any app that runs on a custom port or push everything via Reverse Proxy (also an option on your NAS) via a single port

VPN - private tunnel back to your LAN that will allow you access to your services as you were inside your LAN even from a remote location. Will require router configuration, VPN configuration, and depending on the protocol and your devices that you will connect from, a VPN client (free or commercial) as well as the ability to import the VPN configuration into those clients.

Hey Rusty,
After my reply to your post I found four new post from NAS Newbie with very detailed instructions on port forwarding and reverse port forwarding He referenced you in some of those post and included links to some of your tutorials. I believe this weekend I will be following those steps and seeing what I can accomplish.

Thanks!!!

Mark

 

[Telos]

When you say QC relays over Synology does that mean everything I do relays

Yes. And so there are bandwidth issues as well as "man-in-the-middle" concerns.

 

[Dispatcher7]

Yes. And so there are bandwidth issues as well as "man-in-the-middle" concerns.

Thanks, that is what I thought and was concerned with. So is the DDNS and RPF a better way to go?

 

[fredbert]

https://global.download.synology.com/download/Document/Software/WhitePaper/Firmware/DSM/All/enu/Synology_QuickConnect_White_Paper.pdf

Explains how QC works and when it selects to use the QC Relay service (if you've enabled DSM to use it), but it should opt to go direct if it can.

Personally, DDNS, port-forwarding, and reverse proxy (if you want) would be my choice and have no reliance on QC.

 

[Telos]

So is the DDNS and RPF a better way to go?

For apps, DDNS combined with reverse proxy and a wildcard certificate, works for me. For DSM access I use only VPN.

 

[Dispatcher7]

OK, So here is what I did:

1. Using Control Panel > Application Portal I set up custom HTTP and HTTPS Ports for several applications (Audio Station, Surveillance Station, Synology Drive, Moments, etc.).
2. Using Control Panel > External Access > DDNS I set up DDNS using Synology as a service provider.
3. Using Control Panel > External Access > Router Configuration I detected and set up my router.
4. Using Control Panel > External Access > Router Configuration I set up Port Forwarding Rules using the Built IN Application method for Moments, File Station, Surveillance Station, Audio Station, and Synology Drive.

Now when I open DS Cam I entered SurveilanceStation.MyDDNS.myDS.me Entered a valid User Name and Password. Was prompted for and entered a 6 digit code (I have two step authentication set up). First time around I was connected to my camera. In a short time I got a message about a license and was disconnected. Now any connection attempts using this method fail telling me to check my network connection and IP address, and recommends using Quick Connect.

I'm attempting to move away from Quick Connect to remove the middle man and relay. I only have one camera on my system at this time, so I don't think it is a Surveillance Station license issue.

Am I missing something or doing something wrong?

Thanks for any and all advice.

 

[Telos]

Am I missing something or doing something wrong?

IDK, but you should go into your router settings to be sure the forwarded ports are set correctly. I would never do steps 3 & 4, as it relies on UPnP, a significant security risk (UPnP should be disabled in your router). Further, Synology port forwarding is excessive as it assumes that every variation is possible, and sets up unnecessary port forwards (another security risk).

 

[Dispatcher7]

Telos, in step 4 I selected the specific applications to port forward, not all of the Synology options. Is that still a risk? If so, how do I undo what I did and can you give me some basics of what I need to do with the router?

Thanks.

 

[fredbert]

1.
I concur with @Telos. You should manage your firewall/router policy yourself and not allow any and all LAN devices to use UPnP to make up your security policy based on their preferences. What happens if you have an insecure device that opens up lots of stuff and is compromised? No need to answer that.

2.
If you tried the LiveCam app then each device/login* will take a SS camera licence too, and you get two free.

*not exactly sure but I know using the LiveCam app takes a licence when I tried from my iPhone once, until I released it. Not sure about when using DS cam.

 

[Dispatcher7]

1.
I concur with @Telos. You should manage your firewall/router policy yourself and not allow any and all LAN devices to use UPnP to make up your security policy based on their preferences. What happens if you have an insecure device that opens up lots of stuff and is compromised? No need to answer that.

2.
If you tried the LiveCam app then each device/login* will take a SS camera licence too, and you get two free.

*not exactly sure but I know using the LiveCam app takes a licence when I tried from my iPhone once, until I released it. Not sure about when using DS cam.

Thanks. I will try to figure out how to undo what I did on the router from within Synology.

I thought the RPF Rules in Synology would direct everything coming in on one prot to the correct application ports. Is that correct? If so, what exactly do I need to forward on the router? If all of my outside connections are coming in on the default port 443.

 

[Telos]

If all of my outside connections are coming in on the default port 443.

Just 443. If that is all the external traffic (no incoming VPN?).

 

[Dispatcher7]

Just 443. If that is all the external traffic (no incoming VPN?).

no incoming VPN? LOL, Baby steps please. I expect in the future I will want VPN for using the NAS inlace of services like Drop Box. Currently I have a small amount of files on Drop Box, and in the future I would like to do away with that service and simply have them available on the NAS. Available to just me and my devices, and assume VPN would be the best connection for that.

But currently I'm trying to learn and set up the basics. I thought connecting to the NAS using DDNS and RPF was the way to go. Eliminate the middle man built into quick connect. So my first attempt is getting the DS Cam app on my phone to access the camera on Surveillance Station on the NAS. I find it funny that when I first started using DS Cam with Quick Connect it told me Port Forwarding was a better connection. Now I attempt to go that route and it tells me to use QC.

Anyway one thing I forgot in one of my replies is that I only have one camera, but have used DS Cam on my phone and Live View on my laptop. So maybe that is the license issue error I'm getting now?

I can't tell you how much I appreciate your help and patience with me. I am trying to read as many tutorials and searching solutions and information to try to figure this out. The help I have found on here is by far the best.

Thanks !!!

 

[Rusty]

So maybe that is the license issue error I'm getting now?

Accessing the same camera from multiple clients shouldn't be a problem. Only the number of registered cameras on the NAS is something that's affected by the number of licenses.

 

[Dispatcher7]

Accessing the same camera from multiple clients shouldn't be a problem. Only the number of registered cameras on the NAS is something that's affected by the number of licenses.

Rusty,
Is there a way to see the license in use and what is using that license? As I only have one camera I am using the "free" license that comes with Surveillance Station. I see how to add, delete or migrate licenses, but that area is blank, showing no license at all. I will be adding additional cameras in the near future so I will be adding a license.

Thanks!

 

[Rusty]

You will not see what exact camera is using the license because that will not matter. The main thing is that once you add new cameras that you have free licenses in your pool. As soon as you remove one camera it will return its license to the pool.

So in other words, licenses are mapped to the host (NAS) and only given to the camera until it is using SS, after you remove it, the host will be able to allocate that address to another camera.

 

[Dispatcher7]

UPDATE
I think I may have figured it out. With all of your help of course.

I went into the router configuration and did not see any port forwarding rules. Remember I set up rules in the NAS and told it to send them to the router. While in the router I set up one rule to forward 5001 to the NAS internal IP address. I suppose I should also set that as a static IP Address in the router. Next I opened DS Cam and entered the surveillancestation.myname.myds.me and it did not work. Entering myname.myds.me works. Oh, I have HTTPS selected. The DS File app on my phone is also working now.

Before I get too excited, did I open up anything I maybe shouldn't have? Any other layers of protection I should add to the NAS and/or router?

Once I have this working on my phone, laptop and wife's phone I will start with photos and media.