Daniel Lyons' Notes

How to set up a reverse proxy on Synology NAS

Description

Notes

00:00 Introduction to Synology Reverse Proxy

  • One of the best hidden features in DSM
  • Superior interface compared to Linux servers
  • Unlocks extensive functionality within Synology DSM

00:28 Key Benefits

  • Run multiple instances of DSM on the same public IP address
  • Expose only specific applications to the internet
  • Easily apply SSL certificates
  • Enhanced security through hostname requirement instead of direct IP scanning

02:07 What is a Reverse Proxy?

  • Routes incoming traffic based on hostname to different backend servers
  • Example: Google uses reverse proxy to route search.google.com and drive.google.com to different servers on the same IP address and port
  • Improves security by hiding backend servers from direct internet exposure

04:20 Accessing Reverse Proxy in DSM

  • Location: Control Panel → Login Portal → Advanced → Reverse Proxy
  • Create new rules with source and destination configuration

04:56 Source Configuration

  • Protocol: HTTP or HTTPS
  • Hostname: The domain (e.g., search.google.com, drive.google.com)
  • Port: 80 for HTTP, 443 for HTTPS (customizable)

05:37 Destination Configuration

  • Hostname: IP address or hostname of the backend server
  • Can be local network IP or localhost for Docker containers
  • Port: Port number of the backend application

06:33 Advanced Options

  • Custom header: Sometimes needed for specific applications
  • Advanced settings: Generally not required for standard web apps

07:07 Built-in Application Reverse Proxies

  • Applications tab provides pre-configured reverse proxies for apps with web interfaces
  • Domain section allows custom domain configuration (e.g., drive.ds-space.co)
  • Provides security through obscurity as only those knowing the domain can access

07:41 Using with Synology Drive

  • Access Control profile allows IP-based access rules
  • Centralized certificate management through reverse proxy
  • Example: drive.ds-space.co routes to Synology Drive application

10:08 Private Network Setup with DNS

  • Set up internal DNS server to point domain to NAS IP address
  • Example: drive.ds-space.co points to NAS IP internally
  • Allows organized access via domain names instead of remembering ports
  • Useful for accessing applications remotely within private network

12:25 ⭐ Proxying Docker Containers

  • Example: Open Speed Test container running on port 3000 (HTTP) and 3001 (HTTPS)
  • Normal access: IP address + port number
  • Create reverse proxy rules to use custom domain (e.g., speed.ds-space.co)

13:45 Creating HTTP and HTTPS Rules

  • Create separate rules for HTTP (port 80) and HTTPS (port 443)
  • Destination: localhost:3000 for Docker container
  • DNS record needed: speed.ds-space.co points to NAS IP address

14:40 HSTS Configuration

  • HSTS forces automatic HTTPS rewrite
  • Only use when you have properly signed SSL certificates
  • Warning: Will mark non-HTTPS as untrusted

15:02 Reverse Proxy for Other Devices

  • Can proxy to any IP address on local network (routers, other servers, etc.)
  • Important security consideration: Any reverse proxy rule added with port forwarding (80/443) becomes publicly accessible if hostname is known
  • Access Control profiles can restrict by source IP address

17:26 SSL Certificate Management

  • Centralized certificate assignment for all reverse proxy rules
  • Two approaches:
    • Individual certificate for each domain
    • Wildcard certificate for multiple subdomains
  • Configure certificates in Security and Certificates section
  • Assign certificates to specific reverse proxy rules via dropdown

18:51 Benefits of Wildcard Certificates

  • Single certificate covers multiple subdomains
  • Run all local projects with HTTPS on one NAS
  • Provides professional appearance for shared file URLs
  • Removes odd-looking port numbers (e.g., 5001) from shared links

20:20 Summary and Use Cases

  • Powerful feature for limiting exposure (e.g., only expose Synology Drive)
  • Security through obscurity: hidden in common web ports noise
  • Professional appearance for client sharing
  • Flexible solution for managing multiple applications and containers
How to set up a reverse proxy on Synology NAS
Interactive graph
On this page
Description
Notes
00:00 Introduction to Synology Reverse Proxy
00:28 Key Benefits
02:07 What is a Reverse Proxy?
04:20 Accessing Reverse Proxy in DSM
04:56 Source Configuration
05:37 Destination Configuration
06:33 Advanced Options
07:07 Built-in Application Reverse Proxies
07:41 Using with Synology Drive
10:08 Private Network Setup with DNS
12:25 ⭐ Proxying Docker Containers
13:45 Creating HTTP and HTTPS Rules
14:40 HSTS Configuration
15:02 Reverse Proxy for Other Devices
17:26 SSL Certificate Management
18:51 Benefits of Wildcard Certificates
20:20 Summary and Use Cases