NAS Files Without a Port Forward: What a Relay Costs

The router belongs to somebody else, the NAS sits behind it, and the file has to be retrievable from outside anyway. A full VPN into that LAN is one answer, but it is not the only one: an application relay provided by the NAS vendor can carry a browser-based file workflow with no inbound port mapping at all. What it cannot do is give the remote computer a general route into the network, so the design has to match the workflow rather than the other way round.

Decide what the user actually needs: a file in a browser, or a mapped drive with native filesystem behaviour.

What the relay path really is

QuickConnect lets a Synology NAS be reached through the vendor's infrastructure when no inbound path is available. Depending on what the network permits, it may negotiate a direct connection, attempt hole punching, or fall back to a relay. That flexibility is useful, and it also means "no port forward" is not the same statement as "always relayed".

The cloud account that registers the service, the QuickConnect ID that locates the NAS, and the NAS account that authorizes file operations are three different things. Losing track of which one you are debugging is the most common way this setup stalls.

Enroll it as the owner, then narrow it

On DSM 7 the controls live under Control Panel, External Access, and setup is performed with an approved Synology Account. Enroll the device through its owner rather than through a shared credential, and review the advanced service choices while you are there. The goal is the approved file workflow, not a demonstration that every management feature can be reached from a hotel network. Every service you enable is another surface that same ID can reach.

Record the QuickConnect ID and the owner account in the asset record. An undocumented relay is difficult to revoke when the person who configured it leaves.

Use the application that is actually supported

Grant a dedicated NAS account the application privilege and the folder permissions the workflow needs, then test with that account and a harmless file. Include a denied path and an account removal in the test, because the interesting failure is usually an over-broad grant rather than a broken one. A service ID is an address, not a password, and it replaces neither check.

Do not paste the QuickConnect ID into an SMB mount. Synology's supported-services list includes File Station and excludes ordinary Windows drive mapping and Finder SMB access, so a browser upload is not a substitute for a mapped filesystem.

Understand the trust boundary you accepted

The relay path is not a blind pipe. Synology's browser portal can terminate the browser connection and open a separate protected connection toward the NAS, which makes the portal a trusted component rather than a simple forwarder. Use the supported HTTPS path and let certificate validation do its job; clicking through a warning because the destination is "just a NAS" moves the risk onto the user. If policy forbids UPnP or automatic router changes, review those features separately under their owner.

A restrictive firewall can still block the outbound side. A relay feature is not permission to bypass a network control.

Test the workflow, then document the dependency

Repeat the required file operation after an approved NAS restart and after a network change, and note which path was used and how it performed. Direct and relayed sessions can differ noticeably, so a workflow that feels fine in the lab may be painful over a relay. Add the transfer to the restore test if the files matter.

Record the provider dependency and the expected behaviour during an outage. If the real requirement is native SMB, the honest options are an approved overlay network or a managed VPN, both of which are network designs with enrollment and firewall requirements of their own.