Home NAS Access

The problem

Home NAS devices like Synology, TrueNAS, and Nextcloud are built for always-on access to your files, photos, and media. But they sit behind your home router, invisible to the internet. If your ISP uses carrier-grade NAT (CGNAT), you cannot forward ports even if you wanted to. Many users do not have access to their router configuration at all.

The traditional workarounds each have drawbacks. Port forwarding exposes your NAS directly to the internet and breaks under CGNAT. Dynamic DNS services are fragile, suffer from TTL propagation delays, and still require an open port. VPNs work but demand client software on every device you want to connect from, and mobile clients are unreliable. Airdress gives your NAS a stable public URL that works from any browser on any device, with no router changes.

Architecture

flowchart LR
    A[Phone / Laptop] -->|HTTPS| B[Relay PoP]
    B -->|WireGuard| C[Operator]
    C --> D[NAS Web UI]

Your phone or laptop connects to your *.a.airdr.es name over HTTPS. The relay PoP forwards the traffic through a WireGuard tunnel to the operator running on (or next to) your NAS. The operator hands it to the NAS web interface.

Walkthrough

1. Install the operator

   Install on the NAS itself (if it supports Linux binaries) or on a companion device like a Raspberry Pi on the same local network:

   curl -fsSL https://get.airdress.co/operator | sh

   Confirm it installed:

   airdress-operator --version

2. Start the operator exposing the NAS web UI

   Point the operator at your NAS web interface port. The port depends on your NAS platform:

   Synology DSM

   Synology DSM listens on port 5000 (HTTP) or 5001 (HTTPS) by default.

   airdress-operator serve --bind 0.0.0.0:5001

   If DSM is configured to use non-default ports, substitute your custom port number.

   TrueNAS

   TrueNAS serves its web UI on port 80 (HTTP) or 443 (HTTPS).

   airdress-operator serve --bind 0.0.0.0:443

   Nextcloud

   Nextcloud typically runs on port 80 (HTTP) or 443 (HTTPS) behind Apache or nginx.

   airdress-operator serve --bind 0.0.0.0:443

   If you run Nextcloud in Docker with a mapped port (e.g. 8080), use that port instead.

   Wait for the tunnel to establish:

   INFO  wireguard handshake complete  relay=ams  latency=12ms
   INFO  operator ready  wg_port=51820

3. Verify remote access

   From your phone or any device outside your home network, open a browser and navigate to:

   https://your-name.a.airdr.es

   You should see your NAS login screen. Log in with your NAS credentials as usual.

4. Set up as a systemd service

   For the operator to survive reboots and run unattended, create a systemd unit:

   sudo tee /etc/systemd/system/airdress-operator.service > /dev/null <<'EOF'
   [Unit]
   Description=Airdress Operator
   After=network-online.target
   Wants=network-online.target
   
   [Service]
   ExecStart=/usr/local/bin/airdress-operator serve --bind 0.0.0.0:443
   Restart=always
   RestartSec=5
   
   [Install]
   WantedBy=multi-user.target
   EOF

   Enable and start it:

   sudo systemctl daemon-reload
   sudo systemctl enable --now airdress-operator

   Check that it is running:

   sudo systemctl status airdress-operator

What is happening under the hood

When you open your-name.a.airdr.es in a browser:

1. Airdress authoritative DNS resolves the name to the relay VIP 185.43.32.11.
2. Anycast BGP routing delivers the request to the nearest relay PoP (currently Newark or Amsterdam).
3. The relay forwards it through the WireGuard tunnel to the operator running on your NAS or companion device.
4. The operator proxies the request to the NAS web UI on localhost.
5. The NAS responds, and the reply travels the same path in reverse.

Your NAS never needs an open port on your router. The operator initiates the outbound WireGuard connection, which works behind NAT and CGNAT.

Production considerations

• TLS is preserved. If your NAS serves HTTPS natively (Synology DSM on port 5001, TrueNAS with a certificate), TLS passthrough on the relay keeps the connection encrypted end to end.

• Run as a systemd service. The operator should start automatically on boot. The systemd unit in step 4 handles this, including automatic restarts on failure.

• Bandwidth. All traffic flows through the relay. This is well-suited for file browsing, photo viewing, and media streaming. Multi-gigabyte file transfers will work but are limited by relay throughput. For bulk transfers, consider a direct local connection.

• Keep the operator updated. Re-running the installer picks up the latest stable release safely:

  curl -fsSL https://get.airdress.co/operator | sh

Next steps

Quickstart Install the operator and confirm it is running in under five minutes.

Configuration Fine-tune the operator with a TOML config file and environment variables.

Deployment Checklist Production readiness checklist for running the operator as a long-lived service.

Reachability is the missing piece of personal software Why reachability matters for home servers and personal infrastructure — on the Airdress blog.