How to Secure a NAS From Ransomware and Internet Exposure (2026) Pro Guide

I remember reading a thread on r/synology where a user logged into their NAS one morning and found every file renamed with a .encrypted extension. No warning. No ransom note for three more days. They lost 12 years of family photos because they had left Quick Connect enabled with a weak admin password and no snapshots configured. That story stuck with me, and it is exactly why I am writing this guide on how to secure a NAS from ransomware and internet exposure.

A NAS is not just another hard drive sitting on your desk. It is a small server plugged into your network 24/7, often facing the internet, holding every important file you own. That combination makes it a goldmine for ransomware operators. Forum users on r/DataHoarder have reported their NAS devices being scanned and attacked within hours of being exposed to the internet, with one user finding over 10,000 failed login attempts in a single weekend.

The good news is that securing your NAS does not require enterprise-level budgets or a cybersecurity degree. It requires a handful of configuration changes that close the doors ransomware walks through. If you want broader context beyond this tutorial, our guia completa de seguridad NAS covers general protection strategies in more depth.

In this guide, I will walk you through seven steps to secure your NAS from ransomware and internet exposure. Each step includes specific configuration changes for Synology, QNAP, and other major NAS brands. By the end, your device will be locked down, backed up, and invisible to the attackers scanning for easy targets right now.

Why NAS Devices Are Prime Ransomware Targets?

NAS devices are prime ransomware targets because they combine constant network connectivity with large stores of valuable data in one always-on box. Attackers know that home and small business NAS units are often configured with default settings, exposed services, and weak credentials.

Ransomware typically reaches a NAS through three main paths. The first is exposed services like Quick Connect, port forwarding, or unpatched web interfaces that anyone on the internet can reach. The second is credential stuffing, where attackers use leaked passwords from other breaches to brute-force their way into admin accounts. The third is malware on a connected computer that encrypts mapped network drives silently.

Once ransomware lands on your NAS, it begins encrypting files sector by sector. Some strains delete shadow copies and snapshots before the user even notices. By the time you see the ransom note, your data may already be gone unless you prepared ahead of time.

The most common NAS ransomware families targeting exposed devices include DeadBolt, Qlocker, and eCh0raix. DeadBolt alone hit thousands of QNAP devices in 2026 by exploiting exposed web interfaces. These attacks share a pattern: they target devices reachable from the internet and running outdated firmware.

Step 1: Disconnect Your NAS From Direct Internet Exposure

The single most effective thing you can do to secure your NAS from ransomware is to remove it from direct internet exposure. If your device cannot be reached from outside your local network, the vast majority of automated ransomware campaigns simply cannot touch it.

Start by checking whether your NAS is currently exposed. Log into your router’s admin panel and look for any port forwarding rules pointing to your NAS IP address. Common red flags include forwarded ports 5000, 5001, 8080, or 3389. If you see any of these, remove them immediately unless you have a specific, documented reason for the forwarding.

Next, check your NAS for Quick Connect or similar remote access features. On Synology devices, navigate to Control Panel, then External Access, then Quick Connect. If it is enabled, disable it. Quick Connect creates a tunnel through Synology’s servers that exposes your DSM login page to the internet. Forum users on r/synology overwhelmingly recommend disabling Quick Connect in favor of a self-hosted VPN.

On QNAP devices, disable myQNAPcloud and any CloudLink services under the myQNAPcloud app. These services function similarly to Quick Connect and create internet-reachable endpoints that attackers actively scan for.

After removing these exposure points, verify your NAS is no longer reachable externally. You can use a tool like Shodan or have a friend try to access your NAS public IP from outside your network. If nothing loads, you have closed the biggest hole.

Step 2: Enable Two-Factor Authentication on Every Account

Two-factor authentication (2FA) stops credential-based attacks cold by requiring a second verification step beyond your password. Even if an attacker obtains your admin password through a breach or phishing, they cannot log in without the second factor from your phone.

On Synology DSM, enabling 2FA takes about two minutes. Open Control Panel, navigate to User and Group, select your admin account, and click the Account tab. Under 2-step verification, click Enable and follow the prompts to scan a QR code with an authenticator app like Authy, Google Authenticator, or Microsoft Authenticator. Save your backup codes somewhere safe and offline.

On QNAP QTS, open the Control Panel, go to System, then Security, then 2-step verification. Enable it for all accounts, especially the admin account. QNAP supports both authenticator apps and hardware security keys via FIDO2.

Do not stop at the admin account. Every user account on your NAS should have 2FA enabled. A compromised standard user account can still encrypt files within that user’s shared folders, which is enough to ruin your week. I have seen forum posts from users who locked down admin but left a family member’s account unprotected, and that account became the entry point.

Use an authenticator app rather than SMS for your second factor. SMS codes can be intercepted through SIM-swap attacks. Hardware keys like YubiKey offer the strongest protection and are worth the investment if your NAS stores business or irreplaceable personal data.

Step 3: Configure Your NAS Firewall and Auto-Blocking

A properly configured firewall on your NAS blocks unauthorized connection attempts before they ever reach your login page. Combined with auto-blocking, it creates an automated defense system that shuts down brute-force attacks in real time.

On Synology DSM, open Control Panel and navigate to Security, then Firewall. Create a new firewall rule that allows traffic only from your local subnet (typically 192.168.x.x or 10.0.x.x). Set the default rule to Deny so any connection from outside your local network is automatically rejected. You can add specific IP exceptions if you need remote access from a known static IP.

Next, enable auto-blocking in the same Security panel under the Protection tab. Set the threshold to block an IP after 5 failed login attempts within a 5-minute window. Set the block duration to permanent or at least 24 hours. This immediately neutralizes brute-force scripts.

QNAP users should open the Control Panel, go to System, then Security, then IP Access Protection. Enable auto-block for failed login attempts with the same 5-attempt threshold. Configure login failure policies to lock accounts temporarily after repeated failures.

Consider enabling geo-blocking as well. If you and all your users are located in a single country, block connections from everywhere else. Most ransomware scans originate from botnets distributed globally, so geo-blocking eliminates a large percentage of automated attacks. On Synology, this is under the Firewall rules where you can select allowed countries.

Step 4: Replace Quick Connect and Port Forwarding with VPN

If you need remote access to your NAS, and most people do, the only safe method is a VPN. A VPN creates an encrypted tunnel between your remote device and your local network, making your NAS accessible without exposing it to the public internet.

The cleanest solution is running a VPN server on your router. Most modern routers support WireGuard or OpenVPN. WireGuard is faster, lighter, and easier to configure. Set up a WireGuard server on your router, generate client configurations for each device that needs remote access, and connect through the VPN tunnel whenever you need to reach your NAS from outside.

If your router does not support VPN hosting, you can run a VPN server directly on your NAS. Synology offers a free VPN Server package supporting WireGuard, OpenVPN, and L2TP/IPsec. Install it from the Package Center, configure WireGuard, and set your firewall to allow only the VPN port. This exposes a single, well-audited port rather than your entire DSM interface.

Avoid the temptation to use Tailscale or ZeroTier for convenience without understanding the tradeoffs. These mesh VPN services are excellent and secure, but they route traffic through their infrastructure. If your threat model includes trust in those providers, they are a solid option. For maximum control, self-hosted WireGuard on your router or NAS is the standard recommendation across security forums.

Never use RDP (Remote Desktop Protocol) exposed to the internet to reach a machine connected to your NAS. RDP on port 3389 is one of the most attacked services in existence. If you need remote desktop access, tunnel it through your VPN.

Step 5: Set Up Immutable Snapshots and Backups

Snapshots are your recovery safety net. If ransomware encrypts your live files, a snapshot taken before the attack lets you roll back to clean data in minutes. Immutable snapshots cannot be deleted or modified by any user, including admin, which means ransomware cannot destroy them.

On Synology NAS devices with BTRFS file system, open Snapshot Replication from the Package Center. Select each shared folder you want to protect and create a snapshot schedule. I recommend hourly snapshots during business hours with a 7-day retention, plus daily snapshots retained for 30 days and weekly snapshots retained for 12 weeks. This gives you multiple recovery points spanning from one hour ago to three months back.

If you are running Synology DSM 7.2 or later, enable immutable snapshots. These snapshots are locked for a defined retention period and cannot be deleted even by an admin account. This is the single most important feature for ransomware recovery, and the community on r/synology considers it essential.

QNAP users should enable Snapshot Master or use the built-in snapshot manager on volumes formatted with ZFS or QUkipfs. Configure a schedule similar to the Synology recommendation: hourly short-term, daily medium-term, and weekly long-term retention.

Snapshots alone are not enough. Maintain at least one offline backup that ransomware cannot reach. An external USB drive you connect periodically, back up to, and then disconnect is the simplest offline strategy. For offsite protection, use a cloud backup service with immutability support like Backblaze B2, Wasabi, or Amazon S3 with Object Lock enabled. Test your restore process at least twice a year.

Step 6: Update Firmware and Disable Unnecessary Services

Ransomware operators actively exploit known firmware vulnerabilities. Manufacturers release patches for these holes, but they only protect you if you install them. A NAS running firmware from two years ago is a sitting duck.

On Synology DSM, open Control Panel and go to Update and Restore. Enable automatic updates or at minimum set DSM to notify you when updates are available. Install security patches immediately when they appear. Check the Package Center for updates to installed packages as well, since third-party packages can introduce vulnerabilities.

QNAP users should check QTS for updates under Control Panel, then Firmware Update. QNAP has historically been targeted by more ransomware campaigns than Synology, making firmware updates even more critical. Never ignore a QNAP security advisory.

Next, audit the services running on your NAS and disable everything you do not actively use. Open the list of installed packages or applications and remove anything unnecessary. Common culprits include unused web station services, mail servers, DNS servers, and media plugins. Each running service is a potential attack surface.

Disable SMBv1 immediately if it is still enabled. SMBv1 has known vulnerabilities exploited by ransomware like WannaCry and EternalBlue. On Synology, go to Control Panel, File Services, SMB, Advanced, and set the minimum SMB protocol to SMB3. On QNAP, find the same setting under Control Panel, Network and File Services, Win/Mac/NAS.

Disable Telnet and SSH if you do not use them. If you need SSH, change the default port from 22, disable password authentication, and use key-based authentication only.

Step 7: Use Strong Passwords and Restrict User Permissions

Password strength remains the foundation of NAS security. Every account on your NAS needs a unique, strong password that does not appear in any breach database. Attackers use automated lists of leaked credentials to try thousands of password combinations in minutes.

Generate passwords using a password manager like Bitwarden, 1Password, or KeePass. Aim for at least 16 characters mixing upper and lowercase letters, numbers, and symbols. Never reuse a password across accounts, especially for your NAS admin login.

Apply the principle of least privilege to every user account. Most family members or coworkers only need access to specific shared folders, not the entire volume. Create individual accounts for each person rather than sharing one login, and grant read-write access only to the folders they need. If someone only needs to view files, give them read-only access.

Disable the default admin account or rename it if your NAS allows. On Synology DSM 7, the default admin account is already disabled by design. On older versions and on QNAP, check whether the default admin account is active and either disable it or ensure it has an exceptionally strong password with 2FA enabled.

Review shared folder permissions quarterly. Over time, permissions creep sets in as users are given temporary access that never gets revoked. Run through your shared folder list and remove access from anyone who no longer needs it. This limits the blast radius if any single account is compromised.

FAQs

Conclusion: Your NAS Security Checklist

Securing your NAS from ransomware and internet exposure comes down to seven actions you can complete in a single afternoon. Remove direct internet access, enable 2FA on every account, configure your firewall and auto-blocking, switch to VPN for remote access, set up immutable snapshots with offline backups, update firmware, and lock down user permissions.

Every step matters, but the first two deliver the biggest impact. If you do nothing else today, disable Quick Connect or myQNAPcloud and enable two-factor authentication on your admin account. Those two changes alone will protect you from the vast majority of automated ransomware attacks.

Do not wait until you become another horror story on a forum. Open your NAS control panel right now and start working through this list. Your future self, staring at files you can still open and photos you can still see, will thank you for taking action today.

For more on broader network and device protection, revisit our guia completa de seguridad NAS to deepen your setup beyond this guide on how to secure a NAS from ransomware and internet exposure.