Skip to content

ACCOUNT SETTINGS

Making Your NAS Reachable

Switch on WebDAV and make your NAS reachable from the internet, so Beeswax can store project files on it.

Overview

Beeswax can keep project files on your own NAS (see NAS Storage). Beeswax runs on the internet, so it reaches your NAS from outside your office, the same way you would from home. This article covers the part before you connect it in Beeswax: switching on WebDAV, and giving the NAS an address the internet can reach.

When you're done, you'll have three things to enter in Beeswax:

  1. An address that starts with https://, including the port, for example https://cedar-studio.synology.me:5006.
  2. A shared folder on the NAS for Beeswax, for example beeswax (the base path /beeswax/). It must already exist: Test Connection checks it.
  3. A NAS user just for Beeswax, with read and write access to that folder and a strong password.

Beeswax only accepts new addresses that start with https://, because the NAS login is sent with every request.

Step 1: Switch on WebDAV

Beeswax talks to your NAS using WebDAV, a standard way of sharing files over the web. Use HTTPS, and note the port.

NAS Where HTTPS port
Synology (DSM 7) Install WebDAV Server from Package Center, then tick Enable HTTPS 5006 (default)
QNAP (QTS / QuTS hero) Control Panel > Network & File Services > Win/Mac/NFS/WebDAV > WebDAV the one shown on that page
TrueNAS (SCALE / Community Edition) Apps: install the WebDAV app, choose HTTPS, and change authentication from No Authentication to Basic the one the app shows
UGREEN (UGOS Pro) Control Panel > File Service > WebDAV 5006 (default)
Asustor (ADM) Services > WebDAV 9802 (default)

Other makers have a WebDAV setting too. Check your NAS's own documentation.

Step 2: Find out what kind of internet address you have

Your internet provider gives your router a public IP address. There are three kinds:

  • Fixed (static): it never changes.
  • Changing (dynamic): it can change from time to time. Most plans work this way.
  • Shared: some providers share one public address between many customers (this is called CGNAT). Your router then has no address of its own, and nothing outside can connect in.

To check: open your router's status page and find its internet (WAN) address. If it is between 100.64.0.0 and 100.127.255.255, or it doesn't match what a "what's my IP" website shows, your address is shared. Go to Step 3B below.

Step 3A: Your own address — forward a port and add a DDNS name

  1. Forward one port in your router: the NAS's WebDAV HTTPS port, to the NAS. Forward only that one. Never forward the NAS's admin page.
  2. Give the address a name. If your address can change, use a DDNS (dynamic DNS) name that follows it. Synology includes a free one (Control Panel > External Access > DDNS, provider Synology, for example cedar-studio.synology.me). So does QNAP (myQNAPcloud, a name at myqnapcloud.com), and many routers have a DDNS setting too. On a fixed address a name still helps, because the certificate needs one.
  3. Add a certificate for that name. Synology and QNAP can get a free one from Let's Encrypt. On a Synology, Let's Encrypt needs port 80 reachable while the certificate is issued and renewed.
  4. Leave Verify SSL Certificate switched on in Beeswax. With a real certificate, Beeswax can check it is really your NAS answering before it sends the login.

Your address is then the name plus the port, for example https://cedar-studio.synology.me:5006.

QuickConnect and myQNAPcloud Link won't work. They relay connections for the maker's own apps. Synology says QuickConnect doesn't carry WebDAV. Use the DDNS name instead.

Step 3B: A shared address — use a Cloudflare Tunnel

With a shared address, port forwarding can't work. You have two choices:

  • Ask your provider for a public address of your own. Many will, sometimes for a fee. Then follow Step 3A.
  • Use a Cloudflare Tunnel, which works on Cloudflare's free plan.

A Cloudflare Tunnel runs a small Cloudflare program (cloudflared) on your NAS, or on another computer that's always on in your office. It connects out to Cloudflare and keeps that connection open, so no ports are opened on your router.

  1. Your domain needs to be on Cloudflare (its nameservers point to Cloudflare).
  2. Create a tunnel and run cloudflared on the NAS (as an app or container) or another always-on computer. TrueNAS has a cloudflared app.
  3. Add a published application route: a name on your domain, such as nas.yourbusiness.com, pointing at the NAS's WebDAV address on your office network, such as https://192.168.1.50:5006. If the NAS uses its own self-signed certificate, turn on No TLS Verify for that route. That setting covers only the leg inside your office.
  4. In Beeswax, the address is https://nas.yourbusiness.com. Cloudflare's certificate covers that name, so leave Verify SSL Certificate switched on.

Things to know:

  • Don't put a Cloudflare Access login in front of that name. Beeswax can't sign in to it.
  • Upload size: Cloudflare's Free and Pro plans accept up to 100 MB in a single upload.

Keeping it safe

Beeswax's servers don't have a fixed IP address, so your router or NAS can't be set to let only Beeswax in. The NAS login is what protects it:

  • Give Beeswax its own NAS user, with access to the Beeswax folder only.
  • Use a strong password. Beeswax stores it encrypted.
  • Keep the NAS's software up to date.
  • Forward only the WebDAV HTTPS port, never the NAS's admin page.

When you send someone a share link, it goes to Beeswax, never to your NAS. Beeswax fetches the file and passes it on, so your NAS's address stays hidden.

Next: connect it in Beeswax

Now enter the address, the folder and the login in Beeswax. See NAS Storage.

← All resources Still have a question? ↗
Browse Topics