How to Harden a Home NAS Against Ransomware

Two things actually lose people the data on a home NAS. One is a faulty drive, which burn-in testing and parity largely handle. The other is ransomware, and parity does nothing about it at all. An array with double parity encrypts just as thoroughly as a single disk, because from the file system's point of view an encryption run is a perfectly ordinary sequence of writes by an authorised user. The defences are different in kind, and there are only two that carry most of the weight: keep the management interface off the internet, and keep immutable snapshots.

Below is the reasoning behind each control, then a checklist you can work down in an evening. Of the sixteen items, 3 are critical, 6 are high risk, and 13 of them take minutes rather than hours. Nothing here needs new hardware except the last section on network segmentation.

Why does parity not protect you from ransomware?

RAID protects against a drive dying. It does not protect against a write. That single sentence is the whole problem. Parity exists so that when a member of the array stops responding, the remaining members can reconstruct what it held. Ransomware does not make a drive stop responding. It opens your files, writes encrypted versions over them, and the array faithfully computes new parity across the new contents, exactly as designed.

The same is true of a mirror, of SHR-2, of RAIDZ3, and of any layout in the RAID capacity calculator. Redundancy is availability, not history. What defeats encryption is having a version of the file from before the encryption, in a place the encrypting process could not reach. That is either a snapshot the attacker cannot modify, or a copy on media the attacker cannot see. Everything else on this page exists to make those two things harder to bypass.

Should you ever expose a NAS admin interface to the internet?

No. This is the least nuanced advice on the site. Every large-scale ransomware campaign against consumer NAS units has begun the same way: an administrative interface reachable from the open internet, found by automated scanning, then entered through weak credentials or an unpatched flaw. The attacker never needs to target you. Scanners sweep the entire address space continuously, and an exposed NAS login page is found within hours of appearing.

Exposure happens three ways, and only one of them is deliberate:

• Port forwarding you set up so you could reach the NAS from work. Delete the rule.
• UPnP, which lets any application on the network ask the router to open a hole, with no authentication and no notification. Turn UPnP off on the router and on the NAS. It exists to make games and consoles convenient, and it will happily publish a file server to the world.
• A vendor remote access service left on by default, which relays connections through the manufacturer's infrastructure. This is far better than a raw forwarded port because there is no open port on your address, but it does mean the vendor's relay is now part of your threat model. If you do not use it, turn it off.

Check what is actually open, do not assume. Look at the port forwarding table in the router and at the UPnP-created mappings list, which is usually a separate page. A rule you added years ago for a different device can still be pointing at the address the NAS now holds.

How do you get remote access without port forwarding?

A VPN moves the authentication step from the file server to a tunnel, so nothing on the NAS is reachable until the tunnel is already established and verified. An attacker scanning your address sees nothing to talk to at all, because a WireGuard endpoint does not reply to unauthenticated traffic.

Three approaches, in ascending order of how little you have to think about:

• WireGuard on the router or on the NAS. One UDP port, modern cryptography, key-based authentication and no login page to brute force. Most current routers include it, and Synology, QNAP and TrueNAS all offer a server package. You still forward one port, but the thing behind it discards every packet that is not signed by a key you issued.
• Tailscale or a similar mesh overlay. Devices connect outward to a coordination service and find each other, so there is no inbound port at all. The trade is that a third party manages your device identity, which for most home users is a reasonable exchange for removing the entire class of exposure mistakes.
• A reverse proxy with strong authentication in front, if you genuinely need a browser-reachable service such as a media library for people who will not install a VPN client. Terminate TLS at the proxy, put an authentication layer in front of the application, and never proxy the NAS management interface itself. This is the most fragile option and the one that requires you to keep up with the proxy's own updates.

Risk grade is the consequence of the method being attacked successfully, not the likelihood. The distinction that matters most is the third column: a WireGuard endpoint does not answer unauthenticated packets at all, so an automated scan finds nothing to work on, while a forwarded web interface presents a login page to everyone who asks.

Whichever you pick, the NAS management interface stays local-only. Remote administration happens after you are on the tunnel, from an address inside the network, exactly as if you were at home. If your NAS platform supports restricting the admin interface to a specific source range, do that too, so a compromised device on the guest network cannot reach the login page either. See NAS networking basics for how addressing and subnets fit together on a home network.

Which account settings should you change on day one?

An account with a known username is half compromised before anyone guesses a password. Every NAS platform ships with a predictable default administrator, and every credential-stuffing tool starts there.

• Create a new administrative account with a name nobody would guess, then disable the built-in one. Disabling is better than renaming where the platform allows it, because renaming sometimes leaves the original identifier valid underneath.
• Turn on two factor authentication for every account that can administer anything. This is the control that survives a password stolen from a browser on a laptop, which is how home NAS compromise usually happens: not from the internet, but from a machine already inside the network.
• Enable automatic account lockout. Something like five failed attempts within a few minutes, then a block on the source address for an hour. It converts an unlimited guessing machine into a handful of tries.
• Use a unique password per service, from a password manager. Reuse is the mechanism by which a breach somewhere unrelated becomes a login on your file server.
• Give ordinary user accounts access only to the shares they need. Ransomware encrypts precisely the set of files the compromised account could write to, so a media account that cannot write to the documents share limits the blast radius by construction.
• Turn on notifications for failed logins, for new administrator sessions and for storage events. Finding out in an hour instead of a month decides whether the snapshot you need still exists.

Why is an end-of-support NAS a liability?

A NAS past its support date will never receive another security fix, and every flaw disclosed from that point forward stays open on it permanently. The disclosure is the problem: publishing a fix tells attackers what to look for, and unpatched units become a published, searchable target set.

Vendors typically support a consumer NAS for five to eight years after release, which is often shorter than the working life of the hardware. The unit keeps serving files perfectly, which is exactly why people keep them, and the software underneath quietly stops being maintained. Check the vendor's support lifecycle page for your model number and diarise the date.

If replacing it is not in the budget this year, an old unit can still be useful without being dangerous. Give it no route to the internet at all, use it strictly as a local backup target receiving pulls from the main NAS, and make sure it never holds the only copy of anything. A machine with no outbound path cannot be reached by an inbound one either. Migrating to a bigger NAS covers moving the data when the replacement does arrive, and the drives usually move across with it, so the cost is the enclosure rather than the whole array.

Which services should you turn off?

Every enabled service is code listening for input, and code you do not use provides no benefit to offset its risk. The defaults on a consumer NAS are set for compatibility with the widest possible range of clients, which means several protocols nobody should still be using.

• SMBv1. Turn it off, on the NAS and on every client. It has no meaningful integrity protection, it was the transport behind the most damaging worm outbreaks in the history of file sharing, and every operating system made in the last decade speaks SMB2 or SMB3. Where the platform allows it, set a minimum protocol of SMB3 and enable signing.
• Telnet and unencrypted FTP. Both send credentials in clear text. Use SSH and SFTP, and turn SSH off entirely unless you actively use it.
• UPnP and NAT-PMP, on the router and on the NAS, for the reasons above.
• Guest access and anonymous shares. Convenient for a printer, catastrophic on a documents share.
• Any package you installed once to try. Media servers, download clients, container platforms and web applications all bring their own update cadence and their own flaws. Uninstall what you do not use.

Then keep what remains patched. Turn on automatic security updates if the platform separates them from feature updates, and if it does not, set a reminder to check monthly. An unpatched NAS on an otherwise well-configured network is still the weak point.

Why is an immutable snapshot better than a writable backup?

A snapshot is a point-in-time record of a file system that costs almost nothing to keep, because it stores only the blocks that have changed since it was taken. On a NAS running Btrfs or ZFS, an hourly snapshot of a documents share consumes a rounding error of space and can be rolled back in seconds.

That makes snapshots the single most effective ransomware control available to a home user, but only under one condition: the snapshot must be immutable, meaning read-only and locked against deletion for a retention period, so that an account with full write access to the live data still cannot touch the history. Modern ransomware explicitly looks for and deletes shadow copies and snapshots before encrypting, because the operators know that a rollback makes their leverage disappear. An immutable snapshot refuses that deletion at the storage layer, no matter who asks.

A writable backup on the same NAS is much weaker. If the compromised account can write to it, it is simply another set of files to encrypt. This is the difference that matters most in practice and it is worth checking explicitly in your platform's settings: look for wording such as immutable, locked, or a retention period that cannot be shortened.

A sensible home retention schedule is hourly snapshots kept for a day, daily kept for a fortnight, and weekly kept for a quarter. That is roughly forty restore points, it costs very little space on data that changes slowly, and it means a slow-burning corruption discovered weeks later is still recoverable.

That leaves one large hole, and it is the reason people who back up carefully still lose everything: a permanently mounted backup share is reachable by whatever infected the client. To an infected computer, a mapped network drive is not a backup. It is a drive letter. Software running as you can write anywhere you can write, and if the backup target is mapped and writable, it gets encrypted in the same pass as the local documents folder. This is how people lose the original and the copy in one event, and it is the most common way a conscientious backup strategy fails.

Three fixes, in ascending order of strength:

• Invert the direction. Have the NAS pull from the client on a schedule rather than the client pushing to the NAS. The client then holds no writable path to the backup at all, and the credentials that could reach it live only on the NAS.
• Snapshot the backup share too, immutably. Even if the copy is encrypted, the history is not.
• Keep a copy on media that is physically disconnected between jobs. A cable that is unplugged is unreachable by any attacker, which no software control can quite match. A single large external drive such as a 20 TB WD Elements or the 18 TB version is cheap per terabyte relative to a second NAS, and rotating two of them means one is always off site.

That third point is the offline element of the 3-2-1 rule, explained properly in the 3-2-1 backup rule guide. Three copies, on two kinds of media, one of them off site. Ransomware is precisely the threat that clause was written for, and a desktop external drive in a drawer at a relative's house satisfies it for the price of a couple of NAS drives. Size the copy with the 3-2-1 sizing calculator.

How should the home network itself be segmented?

A VLAN is a logically separate network running over the same physical switches, so devices on one cannot talk to devices on another unless a firewall rule permits it. The reason it belongs on a NAS hardening page is that the least maintained software in most homes is not on the NAS at all. It is on the cameras, the smart plugs, the television and the doorbell, most of which run old kernels, ship with hardcoded credentials, and stopped receiving updates years ago.

A workable home layout is three segments. Trusted computers and the NAS on one. Everything with an app and a cloud account on a second, with no route to the first. Guests on a third, with internet access and nothing else. The NAS then accepts connections only from the trusted segment, which means a compromised camera has nowhere to go.

This is the one item on the list that may cost money, because it needs a router and switches that understand VLAN tagging. A VLAN capable router plus a managed switch is the usual shape, and the 2.5GbE switch roundup notes which models are managed rather than unmanaged. If that is not happening this year, prioritise the free items instead: they carry more of the benefit.

While you are in the router, restrict administrative logins by source range where the NAS supports it, and if the platform offers geographic blocking, deny everything except the country you live in. Neither is a serious obstacle to a determined attacker, since addresses are easy to route around, but both remove an enormous amount of automated background noise from the logs, which makes the alerts that remain worth reading.

What does the full hardening checklist look like?

Work down this list in order. The risk column is the consequence of skipping the item, not the likelihood of it being exploited, and the effort column is honest.

Risk grades reflect how a home NAS is actually compromised in published incident reporting: exposed management interfaces and reused credentials dominate, and everything else is a distant second. Effort figures assume a mainstream NAS platform with a web interface rather than a hand-built server.

How do you know any of it worked?

Verification is short and worth doing once a year.

• Check what is reachable from outside. From a phone on mobile data, with the VPN off, try to reach the NAS. You should get nothing. Then check the router's port forwarding table and its UPnP mappings list separately, because those are two different pages and both can hold surprises.
• Read the login log. Failed administrative logins from addresses you do not recognise mean something is reaching the interface that should not be able to.
• Restore a file from a snapshot on purpose. Not a test of the snapshot, a test of you: knowing where the rollback button lives before the day you need it is most of the value.
• Restore a file from the offline copy on purpose. A backup nobody has ever restored from is a hypothesis. This is the step people skip and the one that catches a job that has silently been failing for months.
• Confirm the snapshots are actually immutable by trying to delete one from an ordinary user account. If it succeeds, the setting is not what you think it is.

None of this makes a home NAS unbreakable, and it is not meant to. It removes the routes that are actually used, and it makes sure that if something does get through, the recovery is a rollback rather than a loss. Those are the two outcomes worth engineering for. Hardware failure is handled by parity and by testing drives before you trust them. This page handles the other one.

Related reading

• 3-2-1 backup rule guide for the offline copy that survives an encryption event
• NAS networking basics for addressing, subnets and where a VPN fits
• NAS against cloud storage for how the two threat models differ
• 3-2-1 sizing calculator to size the off-site copy
• Best external drives for NAS backup for the disconnected copy