Tutorial: Protecting Your NAS with Firewalla

Your NAS holds a lot of important files, and that makes it a favorite target for ransomware. Most attacks get in through an open port or another infected device on your network.

In the tutorial, using Firewalla, we'll lock the NAS down so only your devices can reach it, stop it from talking to places it shouldn't, and set up VPN so you can still get to it from outside.

• This tutorial also works for other devices on your network. 

What you'll need

• A Firewalla box (Gold series for DAP in Step 2)
• A Firewalla Switch and a Firewalla AP7
• The NAS wired directly to a Firewalla Switch port, NOT through a third-party switch.

Software Features

• Device Isolation (LAN Protection)
• Device Active Protect (DAP) (WAN Protection)
• WireGuard VPN (for remote access)

Here is how the example test network is wired.  NAS is wired to a firewalla switch (for device isolation) and other devices are managed by the AP7.  Only trusted devices and VPN users can reach the NAS when you are out.

In this guide

• Part 1: Control which LAN devices can reach the NAS
  • Step 1: Isolate the NAS and allow only trusted devices
• Part 2: Control the NAS's internet access
  • Step 2: Control NAS to Internet, turn on Device Active Protect (DAP)
  • Step 3: Control remote access, turn off UPnP and skip port forwarding
  • Step 4: Use WireGuard VPN for remote access
• Verify that your NAS is protected

Part 1: Control which LAN devices can reach the NAS

Most NAS traffic stays inside your home network, like file sharing, backups, and media streaming. That's why the first step is choosing which devices can reach the NAS, so an infected laptop or smart device can't get to your files.

Step 1: Isolate the NAS and allow only trusted devices

1. Plug the NAS into a Firewalla Switch port.
2. In the Firewalla app, tap Devices and tap open your NAS named MyNAS.
3. Turn on Device Isolation. This blocks every local device from reaching the NAS.
4. Under Allowed Devices, add only the devices, groups, or users that need the NAS, such as your "User" group.

Alternative: put the NAS on its own VLAN

For most home networks, Device Isolation is all you need. If you already use VLANs or want rules that apply to a whole network, you can put the NAS on its own VLAN instead, or use both together.

1. Create a VLAN (for example, "Storage LAN") in Network > Network Manager.
2. Go to Network > Topology, tap the Firewalla Switch, tap the NAS port, and set it as an Access Port on the Storage LAN.
3. Add rules to block traffic from and to all local networks, then allow only the devices that need the NAS, including your VPN devices. Learn more

Part 2: Control the NAS's internet access

Next, control what the NAS connects to online, and keep the internet from connecting to it directly.

Step 2: Control NAS to Internet, turn on Device Active Protect (DAP)

DAP learns which internet destinations the NAS normally uses, then blocks everything else. Malware on the NAS can't phone home or upload your files.

1. Turn on Device Active Protect in the Firewalla app. Learn more
2. Tap on mode and use Strict Mode.
3. Let the NAS run normally. DAP learns its traffic for up to 7 days, then starts blocking new destinations automatically.

DAP requires a Firewalla Gold series box. 

If you are not using a gold box, you can still manually mange rules 

1. Create a rule to block all internet access of your NAS
2. Create Allow rules for the domains the NAS needs (for example, synology.com) Manage Rules
3. This will emulate DAP; you will have to manually manage what's being allowed.

Step 3: Control remote access, turn off UPnP and skip port forwarding

Many NAS devices can open ports on your router on their own using UPnP. That exposes the NAS login page to the internet.

1. Go to Network Manager > NAT Settings > Port Forwarding, then turn off UPnP for the network the NAS is on. Network Manager (3.4.5. Port Forwarding)
2. In the NAS settings, turn off UPnP/router auto-configuration.
3. Don't create port forwards to the NAS.

Step 4: Use WireGuard VPN for remote access

1. Tap VPN Server, choose WireGuard, and turn it on. Your box needs a public IP for this to work. For full setup details, see WireGuard VPN Server Configuration.
2. Tap Add a Client to create one profile per phone or laptop, then scan its QR code in the WireGuard app.
3. Add each VPN device to the NAS's Allowed Devices (Step 1). If you use a VLAN, include them in your allow rules instead.

Verify that your NAS is protected

• Test access: open the NAS login page (for example, http://<NAS IP>:5000 on Synology) from two devices. From a device that's not in the NAS's Allowed Devices, it should fail. From an allowed device, it should work. Don't rely on ping: many NAS units don't reply to it. How to validate Firewalla features
• Watch for alarms: Open Port and Abnormal Upload alarms are your early warnings. What to do when you get one
• Don't forget, normal Firewalla services like the Active Protect, will be there, protecting with traffic inspection. 

Related articles

• VqLAN: Firewalla Microsegmentation
• Groups, Segmentation, and Microsegmentation
• Device Active Protect
• Firewalla Switch setup
• WireGuard VPN Server Configuration