NAS Network Setup Guide for Home and Small Office
Connecting a Network Attached Storage (NAS) appliance like a Synology DiskStation, QNAP, or TrueNAS box with default settings leaves transfers bottlenecked at 112 MB/s and exposes administrative ports to ransomware bots if UPnP is active. Optimizing IP binding, SMB3 Multichannel over 2.5GbE/10GbE links, and zero-trust overlay VPNs delivers fast, hardened file sharing.
- Assign a DHCP Static IP Reservation on your router (Plus a matching fallback IP on the NAS) so mapped SMB/NFS shares never break.
- For single-client speed boosts across dual NICs, enable SMB3 Multichannel instead of 802.3ad LACP (which caps a single TCP stream to one link).
- Never expose NAS DSM/QTS admin ports (
5000,5001,8080) or SMB port445to the WAN via port forwarding or UPnP. - Use Tailscale or a router-hosted WireGuard VPN for encrypted remote file access and off-site snapshot replication.
DHCP IP Reservations, DNS Hostnames & UPS Integration
When your NAS first boots on the LAN, it requests a dynamic IPv4 address via DHCP. If that IP changes after a power outage, mapped Windows network drives (\\192.168.1.x\Share), Proxmox NFS datastores, and Time Machine backups immediately fail. Rather than typing a blind static IP exclusively inside the NAS, configure a DHCP Static Reservation on your router tying the NAS's primary MAC address to a fixed IP outside your dynamic pool (for example, 192.168.1.10).
Once reserved, you can also set the static IP inside the NAS OS (e.g., Synology Control Panel > Network > Network Interface > Edit) with your router (192.168.1.1) as Default Gateway and DNS Server so the NAS remains reachable even if the router's DHCP daemon is restarting. Additionally, connect a pure-sine-wave UPS to the NAS via USB and enable Control Panel > Hardware & Power > UPS so Btrfs/ZFS storage pools unmount cleanly before battery exhaustion.
Breaking the 1GbE Limit: 2.5GbE, 10GbE & SMB3 Multichannel vs. LACP
A single Gigabit Ethernet (1000BASE-T) port tops out at roughly 112–115 MB/s after TCP/IP and SMB framing overhead—far slower than modern RAID arrays or NVMe caches, which easily sustain 400 to 1,000+ MB/s. If your NAS has two or four 1GbE or 2.5GbE ports, you must choose between two aggregation strategies:
- 802.3ad Dynamic Link Aggregation (LACP): Bonds two ports into one logical trunk on a managed switch. However, LACP hashes traffic per IP/MAC/Port tuple, meaning one workstation copying a file still gets only 112 MB/s, while two workstations get 112 MB/s simultaneously.
- SMB3 Multichannel (Best for 1–3 Users): Leave both NAS LAN ports on the same subnet with two separate IPs (e.g.,
.10and.11) connected to an unmanaged switch, and enable Enable SMB3 Multichannel under File Services > SMB > Advanced Settings > Others. A workstation with a 2.5GbE NIC (or dual 1GbE NICs) will open parallel TCP streams across both NAS ports simultaneously, doubling single-client speeds to 225 MB/s!
MTU 1500 vs. Jumbo Frames (MTU 9000) Realities
Many NAS guides recommend enabling Jumbo Frames (MTU 9000) to boost throughput. In modern networking with hardware TCP Segmentation Offload (TSO) and Large Send Offload (LSO), raising MTU from 1500 to 9000 bytes yields less than a 2% throughput gain on 2.5GbE/10GbE while introducing severe troubleshooting headaches if even a single device on the broadcast domain is left at MTU 1500.
If a client with MTU 9000 sends a large frame to a printer, IoT bridge, or router interface configured for MTU 1500 on the same VLAN, the frame is silently dropped at Layer 2, causing mysterious SSH hangs and stalled SMB transfers. Only enable MTU 9000 on a dedicated, isolated storage subnet/VLAN (such as a direct 10GbE DAC cable or storage VLAN between an ESXi/Proxmox host and your NAS) where every NIC and switch port explicitly supports 9216-byte frames.
Hardening Remote Access: Blocking UPnP & Deploying Tailscale/WireGuard
Ransomware campaigns such as DeadBolt and eCh0raix continuously scan public IPv4 ranges for exposed NAS login portals (5000/5001 on Synology, 8080/443 on QNAP). Never use the NAS's built-in "EZ-Internet" or "Auto Router Configuration" wizards, which use UPnP to open WAN port forwards automatically.
- Disable Admin Default & Enable 2FA: Create a named administrator user, enforce TOTP/WebAuthn 2FA, and disable the default
adminaccount under Control Panel > User & Group. - Use Tailscale or WireGuard: Install the native Tailscale package from the NAS Package Center (or enable a WireGuard VPN server on your router). You can then mount SMB shares and access the NAS web UI from anywhere over an encrypted
100.x.y.zWireGuard tunnel with zero open WAN ports.
Finally, enable the built-in NAS firewall with a default-deny rule that allows SMB, NFS, and HTTPS management packets exclusively from your local RFC 1918 LAN and Tailscale subnets.
NAS Network Connectivity Options & Real-World SMB Throughput
| Network Configuration | Switch Requirement | Single-Client Max Speed | Multi-Client Aggregate Speed |
|---|---|---|---|
| Single 1GbE Port | Any Gigabit Switch | ~113 MB/s | ~113 MB/s |
| Dual 1GbE with 802.3ad LACP | Managed LACP Switch | ~113 MB/s (1 stream per MAC/IP) | ~225 MB/s (Across 2+ clients) |
| Dual 1GbE with SMB3 Multichannel | Unmanaged 2.5GbE or 1GbE Switch | ~225 MB/s (Requires 2.5G or 2x1G PC) | ~225 MB/s |
| Single 2.5GbE Port (Cat5e/Cat6) | Unmanaged 2.5GbE Switch | ~280 MB/s | ~280 MB/s |
| 10GbE RJ45 or SFP+ DAC | 10GbE Switch or Direct Attach | ~1,100 MB/s (NVMe/6+ drive RAID) | ~1,100 MB/s |
NAS Network & Security Hardening Checklist
- Bind the NAS MAC address to a fixed IPv4 reservation in your router's DHCP server (e.g., 192.168.1.10).
- Disable UPnP on your router and verify zero WAN port forwards point to ports 445, 5000, 5001, or 8080.
- Disable the factory default 'admin' account, create a custom admin username, and require hardware key or TOTP 2FA.
- Set minimum SMB protocol to SMB2 with Large MTU and maximum protocol to SMB3 (disable legacy SMB1/CIFS).
- Enable SMB3 Multichannel if using multiple LAN ports without a managed LACP switch, or upgrade to a 2.5GbE/10GbE NIC.
- Schedule immutable local Btrfs/ZFS snapshots and configure encrypted off-site 3-2-1 backups over Tailscale or S3/B2.
Frequently Asked Questions
Why am I still getting only 112 MB/s after setting up 802.3ad Link Aggregation (LACP) on my NAS?
IEEE 802.3ad LACP never splits a single TCP session across multiple physical cables because packets arriving out of order would degrade TCP performance. LACP increases total bandwidth when multiple computers access the NAS at once; to double speed to a single PC, disable LACP and enable SMB3 Multichannel instead.
Is Synology QuickConnect safe to use without opening router ports?
When UPnP and manual port forwarding are disabled on your router, Synology QuickConnect uses an outbound relay tunnel that does not expose open WAN ports. However, Tailscale or a router-based WireGuard VPN is faster, supports direct SMB file mounting in Finder/Explorer, and requires zero public login portal exposure.
Can I add a 2.5GbE or 5GbE USB Ethernet adapter to an older Synology or QNAP NAS?
Yes. Most x86 and ARM64 Synology and QNAP models support RTL8156 (2.5GbE) and AQC111U (5GbE) USB 3.0 adapters either natively (on QNAP QTS) or via community-maintained Realtek r8152 driver packages on Synology DSM 7.2, boosting transfer speeds to ~280 MB/s.
Related Wired LAN Setup & Engineering Guides
- Small Business Network Setup Checklist — Build a reliable small business network with our checklist covering Dual-WAN failover, 4-VLAN segmentation, PoE budgets, UPS sizing, and WPA3 WiFi security.
- VLAN Basics for a Small Office (802.1Q Guide) — Master IEEE 802.1Q VLAN tagging for small offices: configure Access vs Trunk switch ports, PVIDs, multi-SSID WiFi mapping, and inter-VLAN firewall rules.
- SMB3 Multichannel Setup Guide: 5 Gbps Over Dual 2.5GbE NAS Ports — Double your NAS transfer speeds from 280 MB/s to 550+ MB/s over dual 2.5GbE ports by enabling SMB3 Multichannel on Synology DSM 7.2, TrueNAS, and Windows 11.
- Subnet Mask Beginner Guide (CIDR /24, /23 & /16) — Understand IPv4 subnet masks, CIDR notation (/24, /23, /16, /30), binary bitmasking, usable host formulas, and RFC 1918 private IP ranges for home and office.