Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently purchased a network attached storage for personal file storage and would like my family members to store files on the device from their computers as a remote backup.

I'd like to secure the port that's used to sync files so that only their computers will have access. The solution should be easy for them to implement and use on a daily basis. I believe that backing up files should be easy, seamless, and automatic. Most of these files are media (pictures, home movies, etc). Backing up files to an alternative cloud based system is not an option.

My problem is that each of these computers have dynamic IP addresses so it's not as simple as setting up the firewall to only allow from a handful of IP addresses. They don't change very often, but they do change.

I'm running a DDWRT-based (standard) router connected to the NAS so I can add custom firewall rules if needed or run a script. For the sake of this question, the port that the service is running on is TCP 5678. What's the best solution to secure access to the NAS?

Possible solutions:

  • Setup a VPN (not very convenient for users)
  • Setup firewall rules based on the entire network of the clients ISP
  • Setup firewall rules and update the IP address using a dynamic DNS service and a script that runs periodically

I've created a simple diagram to show my setup.

network diagram

share|improve this question
Couldn't you just implement MAC address filtering? – user67809 Feb 6 '15 at 4:15
Is this a question or an answer? If it is an answer ,please elaborate on it. Also keep in mind that MAC addresses can be spoofed fairly easily. – ilikebeets Feb 6 '15 at 4:54
Even if it wasn't trivial to circumvent, MAC filtering doesn't work over the Internet. MAC addresses are only visible on the local network. – Mark Feb 6 '15 at 4:54

The answers will be protocol/application dependent. Basically, if you can use a secure tunnel or a VPN solution, you will have pretty good security. Someone might be able to knock on the port, but they won't be able to connect without credentials (and certificates if you can).

You could try to setup a simple VPN using something like Hamachi, TeamViewer, or OpenVPN. Once this is setup for your family with the certs and passwords, you could allow them to use any existing protocols or to access a network share (though for performance reasons I would not recommend just using a network share over Internet/WAN).

One solution that makes this relatively easy is to use any of a number of software which allow you to mount a drive locally via SFTP. They have free and commercial solutions for various operating systems (e.g., SFTP Net Drive, OSX Options, google for others). If you just want them to be able to drop file, this is a good lightweight solution because you can just make it another drive on their network and since its SFTP there is less overhead then other solutions. The caveat of course is that they either need to type a password each time they load the file or you need to store it on their system, but that is likely a concern with anything user friendly. You could also script something.

If you have passwords and certificates at your VPN level and let your firewall manage your VPN that would minimize exposure, but may be unnecesary (just because people scan my SSH sever, they don't get on because they don't have a cert + credentials).

For a pure automated backup, I would look at some of the free P2P features of CrashPlan. Other backup tools usually have an SFTP connection option as well, where you can do a traditional periodic file backup with incrementals, differentials, deltas, etc.

share|improve this answer

Your network diagram was not attached.

I would download No-Ip on each of the remote workstations you want to back up. Assign them all a hostname and then use the hostname for your firewall rules to allow access. Setting up the firewall rules for the ISP network is not recommended at all.

The port the service is running on is irrelevant. The port doesn't provide the security, the device and transmission protocols (HTTPS, SSH, SFTP) provide the security.

As far as the backing up, you can use a PowerShell or a Batch file to do the backups and set it on a scheduled task to back up their computers. You would probably need to use SFTP to do the file transfer which would require you to hardcode the password in the scripts. Not a very secure method at all but in the jest of automation, it's a must.

share|improve this answer
No-Ip could work, but I'd have to periodically reset IPtables because DNS resolution only occurs once until IPtables is reset/refreshed. What happens if the client's IP changes? Also, I understand the port doesn't provide security, but the software package I'm using will provide data transmission via SSL. – arcdegree May 6 '13 at 19:25
If you do the scheduled tasks, you could script firewall commands in the admin panel of DD-WRT to readd the hosts which will resolve them, thus refreshing it in the firewall. You can use a cron and shell script. like this: – Travis May 6 '13 at 19:57

I would use Duplicati ( to SFTP the files to the NAS. You could set up a separate share for each backup to isolate the risk of compromise if the password was leaked. Set up your NAS with dynamic DNS and have the clients push the data to the NAS, so that you only have to worry about your IP address, not theirs. Duplicati can also do encryption and incremental backups.

Also, if you do decide to use Duplicati, make sure you select the SSH option, not the FTP option to do SFTP. It's weird like that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.