You can access your Synology NAS remotely by configuring a Dynamic DNS (DDNS) service on the NAS, then setting up HAproxy on pFsense to terminate SSL and forward traffic to internal services. This architecture ensures secure, encrypted connections from the internet while keeping your local network isolated and protected behind the firewall.
Configuring DDNS on Synology NAS
The first step is to ensure your Synology NAS has a consistent public address. Since most residential internet connections use dynamic IP addresses that change periodically, you need a Dynamic DNS service. Synology supports several providers out of the box, including DynDNS, No-IP, and various others. To configure this, navigate to Control Panel > External Access > DDNS. Click Add and select your provider. Enter the hostname you wish to use, along with your username and password for the DDNS provider. Once saved, the NAS will automatically update its public IP address whenever it changes. Verify the status shows "Connected" before proceeding.
Setting Up HAproxy in pFsense
pFsense includes an embedded version of HAproxy that acts as a reverse proxy. This allows you to host multiple websites or services on different subdomains using a single public IP address and port 443. Navigate to Services > HAProxy > Settings. Ensure the service is enabled and check the box to enable the embedded DNS resolver if needed. Under the Frontend section, create a new frontend named something like HTTPS_FRONTEND. Set the bind address to *:443 and enable SSL. You must upload or reference your SSL certificate here; using a self-signed certificate is not recommended for production due to browser warnings. Instead, use Let's Encrypt certificates generated within pFsense under Services > Let's Encrypt.
Defining Backends
A backend defines where the traffic should go once it arrives at pFsense. Create a new backend named SYNOLOGY_BACKEND. Add a server entry pointing to the internal IP address of your Synology NAS (e.g., 192.168.1.50) on port 5000 for HTTPs admin access or 5001 for HTTPS. It is crucial to match the port used by the specific service you are exposing. For Synology Drive or DSM, you typically expose port 5001 (HTTPS). Enable health checks if available to ensure pFsense only routes traffic to healthy servers.
Creating ACLs and Routing Rules
Access Control Lists (ACLs) determine which requests are sent to which backends based on headers like the Host name. In the HAproxy configuration, go to ACLs and create a new rule. Name it IS_SYNOLOGY. The condition should be hdr(host) -i synology.yourdomain.com (replace with your actual DDNS hostname). Then, assign this ACL to a routing rule that directs traffic to the SYNOLOGY_BACKEND you created earlier. If you have other services, such as a Plex media server, you would create additional ACLs for plex.yourdomain.com and route them to their respective backends. This allows you to access all services via distinct subdomains without opening multiple ports on your firewall.
Firewall Rules and Port Forwarding
Even with HAproxy configured, pFsense needs permission to accept incoming traffic. Navigate to Firewall > Rules > WAN. Create a new rule allowing TCP traffic on port 443 from any source to the pFsense WAN interface. Assign this rule to the LAN or WAN interface depending on your setup, ensuring it points to the correct alias or host. Additionally, ensure that no other port forwarding rules exist for ports 80 or 443 that might conflict with HAproxy. If you previously set up port forwarding directly to the Synology NAS for these ports, disable them now. HAproxy handles the termination of the connection, so the NAS only sees traffic coming from the pFsense internal IP, not directly from the internet.
Testing the Connection
Once configured, test the setup by navigating to your DDNS URL (e.g., https://synology.yourdomain.com) in a web browser. You should see the Synology login page. Check the browser address bar to ensure the certificate is valid and trusted. If you encounter issues, verify the HAproxy logs under Status > System Logs > HAproxy for any errors related to backend connectivity or SSL handshake failures. Also, confirm that the Synology NAS firewall allows connections from the pFsense internal IP range.
Frequently Asked Questions
Can I use HTTP instead of HTTPS for internal access?
While technically possible, it is strongly discouraged because data transmitted over HTTP is unencrypted and vulnerable to interception. Always use HTTPS via HAproxy to ensure encryption between the client and pFsense, even if the internal connection to the NAS is also encrypted. This provides end-to-end security for sensitive data like passwords and files.
What happens if my ISP blocks port 443?
If your Internet Service Provider blocks standard HTTPS ports, you may need to configure HAproxy to listen on an alternative high-numbered port (e.g., 8443). You would then map this external port to 443 internally within the HAproxy frontend settings. However, this requires users to specify the port number in their URLs, which reduces convenience and may be blocked by corporate firewalls.
How do I handle certificate renewal with Let's Encrypt?
pFsense handles certificate renewal automatically when integrated with the Let's Encrypt service. Ensure the Auto-renew option is checked in the Let's Encrypt settings. HAproxy will detect the updated certificate files and reload its configuration without manual intervention, ensuring continuous availability and avoiding browser security warnings.
Is it safe to expose Synology DSM directly through HAproxy?
Exposing DSM is safe provided you follow security best practices, such as enabling two-factor authentication and restricting access to known IP ranges via ACLs in HAproxy. Never expose the default administrative ports without protection. Using HAproxy adds a layer of abstraction that hides the internal network structure, making direct attacks on the NAS more difficult.
Why am I getting a 503 Service Unavailable error?
This error usually indicates that HAproxy cannot reach the backend server. Check if the Synology NAS is powered on and reachable from the pFsense machine via ping. Verify that the backend server IP and port in HAproxy match the actual service running on the NAS. Also, ensure that the Synology NAS firewall is not blocking incoming connections from the pFsense internal IP address.