# Best way Securing A secondary off site NAS Backup **URL:** \ **Category:** Synology\ **Tags:** backup, hyper-backup\ **Created:** [March 18, 2023, 11:59pm UTC](https://forums.spacerex.co/t/best-way-securing-a-secondary-off-site-nas-backup/138 "2023-03-18T23:59:38Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Gsugar](https://forums.spacerex.co/user_avatar/forums.spacerex.co/gsugar/32/300_2.png) [@Gsugar](https://forums.spacerex.co/u/Gsugar)\ **Post date:** [March 18, 2023, 11:59pm UTC](https://forums.spacerex.co/t/best-way-securing-a-secondary-off-site-nas-backup/138/1 "2023-03-18T23:59:38Z")
I am in the process of setting up an off site backup at relatives home. They only have a crappy ISP’s router with minimal safe guards. I watched all the awesome video’s by SpaceRex on off site backups & is Synology secure enough, securing accounts etc. My core question will the NAS’s security features be enough or should I put a better router in front of it or/and even run a VPN between. I have a slightly more secure network at home and see attempted attacks but nothing get through to the NAS it’s self. I have the same ISP so I know the their router is crappy. So should I keep quick connect open at a minimum I would need DDNS to reach the device. Would running the NAS as VPN be client better. George ---
**Author:** ![Will](https://forums.spacerex.co/user_avatar/forums.spacerex.co/will/32/14_2.png) [@Will](https://forums.spacerex.co/u/Will)\ **Post date:** [March 19, 2023, 1:03am UTC](https://forums.spacerex.co/t/best-way-securing-a-secondary-off-site-nas-backup/138/2 "2023-03-19T01:03:15Z")
So the highest level of security is to use a site to site VPN between the two boxes. But unless you have that setup only opening the hyperbackup port is a great place to start. If you encrypt the backup through hyperbackup they could never get access to your data even if somehow their was an exploit ---
**Author:** ![Gsugar](https://forums.spacerex.co/user_avatar/forums.spacerex.co/gsugar/32/300_2.png) [@Gsugar](https://forums.spacerex.co/u/Gsugar)\ **Post date:** [March 19, 2023, 2:01am UTC](https://forums.spacerex.co/t/best-way-securing-a-secondary-off-site-nas-backup/138/3 "2023-03-19T02:01:30Z")
I was tempted to set up a site to site VPN. I’ve got the one end but still need the router on the backup end or set up the NAS to run VPN . But the as it’s an old model may not really have the power to be VPN & NAS . ---
**Author:** ![Will](https://forums.spacerex.co/user_avatar/forums.spacerex.co/will/32/14_2.png) [@Will](https://forums.spacerex.co/u/Will)\ **Post date:** [March 19, 2023, 2:09am UTC](https://forums.spacerex.co/t/best-way-securing-a-secondary-off-site-nas-backup/138/4 "2023-03-19T02:09:16Z")
So if you are just backing up a single NAS you can use the main NAS as an openVPN server, and then have the offsite NAS automatically connect back. Though I will say that can be a huge pain. Sometimes the backup will just not reconnect to the VPN server ---
**Author:** ![Gsugar](https://forums.spacerex.co/user_avatar/forums.spacerex.co/gsugar/32/300_2.png) [@Gsugar](https://forums.spacerex.co/u/Gsugar)\ **Post date:** [March 19, 2023, 10:40pm UTC](https://forums.spacerex.co/t/best-way-securing-a-secondary-off-site-nas-backup/138/5 "2023-03-19T22:40:41Z")
That’s essentially what I have set up now except the VPN server is running on my home Tplink Omada hardware instead of the home Nas. Everything works but host names resolution ofcoure. I’m assuming set up a DNS on the synology would resolve that. Not sure if this is possible but is there a way to define in the Hyperbackups target host to still work if the VPN dropped. Ie DDNS or VPN… ---
**Author:** ![Gsugar](https://forums.spacerex.co/user_avatar/forums.spacerex.co/gsugar/32/300_2.png) [@Gsugar](https://forums.spacerex.co/u/Gsugar)\ **Post date:** [March 22, 2023, 10:52pm UTC](https://forums.spacerex.co/t/best-way-securing-a-secondary-off-site-nas-backup/138/6 "2023-03-22T22:52:25Z")
Spoke too soon … Works but the VPN drops out after a few Hrs and the Synology fails to reconnect. The Nas is set to try to reconnect. According to the router the pipe is still up just no client. I’m not using OpenVPN but L2TP/IPSec. ---
**Author:** ![Gsugar](https://forums.spacerex.co/user_avatar/forums.spacerex.co/gsugar/32/300_2.png) [@Gsugar](https://forums.spacerex.co/u/Gsugar)\ **Post date:** [March 22, 2023, 11:27pm UTC](https://forums.spacerex.co/t/best-way-securing-a-secondary-off-site-nas-backup/138/7 "2023-03-22T23:27:22Z")
Ok I answered my own question. Seem the issues is common to Synology. THe auto reconnect does not wokr. Here is a blog page with one of the best VPN reconnect scripts to address the issues. This guy seem to know what he’s doing and requires no modification to the script in default mode. [https://blog.harrier.us/reconnecting-a-failed-vpn-connection-on-synology-dsm-6](https://blog.harrier.us/reconnecting-a-failed-vpn-connection-on-synology-dsm-6) ---
**Author:** ![Will](https://forums.spacerex.co/user_avatar/forums.spacerex.co/will/32/14_2.png) [@Will](https://forums.spacerex.co/u/Will)\ **Post date:** [March 23, 2023, 12:36am UTC](https://forums.spacerex.co/t/best-way-securing-a-secondary-off-site-nas-backup/138/8 "2023-03-23T00:36:51Z")
I have had a much better experience and don’t need to use this anymore on dsm 7 ---
**Author:** ![Will](https://forums.spacerex.co/user_avatar/forums.spacerex.co/will/32/14_2.png) [@Will](https://forums.spacerex.co/u/Will)\ **Post date:** [March 23, 2023, 12:38am UTC](https://forums.spacerex.co/t/best-way-securing-a-secondary-off-site-nas-backup/138/9 "2023-03-23T00:38:05Z")
Other option would be something like this: > [@How to Hyper Backup to a Remote Synology NAS, using TailScale (without port forwarding)](http://forums.spacerex.co/t/how-to-hyper-backup-to-a-remote-synology-nas-using-tailscale-without-port-forwarding/219): > > Overview You cannot use quick connect when backing up a NAS using hyper backup. Instead Synology recommends you use port forwarding, and DDNS. However if you do not have the ability to do port forwarding on the remote backup destination (because you have StarLink or any other CGNAT) this becomes impossible. However you are able to use the free tier of TailScale to do this. This was in response to a post by @ranord50[http://forums.spacerex.co/t/starlink-twingate-and-hyper-backup/218](http://forums.spacerex.co/t/starlink-twingate-and-hyper-backup/218)How to …