Bridge NAS / SMB Shares to the Modern Cloud

How to connect a NAS / SMB share to CloudsLinker

NAS / SMB uses server parameters: host IP address, username, password, port (default 445), and optional domain (default WORKGROUP).

Before you start

Decide your reachability model — this is the most important decision:

• Option A (safer): expose SFTP or WebDAV from the NAS instead. Both Synology DSM and QNAP QTS support enabling SFTP (port 22) or WebDAV (port 443) on the NAS. These are single-port, encrypted, and far less attack-surface than open SMB. Use CloudsLinker’s dedicated SFTP / WebDAV connectors.
• Option B (legacy): port-forward SMB port 445. If you must use SMB, configure your router to forward port 445 to the NAS, and combine with strict IP allowlist restricting access to CloudsLinker’s IP range only. Never forward 445 to 0.0.0.0/0.

For corporate AD-joined NAS, you’ll also need:

• Domain name (e.g. CORP.EXAMPLE.COM)
• Service account with read-only or read-write access to the shares you want to migrate
• DNS resolution for the domain controllers (or hardcoded IP)

Connection steps

1. In CloudsLinker, click Add Cloud → choose NAS (or SMB).
2. Enter a display name (e.g. “Synology DS923+ — backup”).
3. Enter the host IP address (or DNS name) of your NAS.
4. Enter the username and password for the NAS user account. For dedicated migrations, create a NAS user account scoped to specific shares.
5. Enter the port (default 445).
6. (Optional) Enter the domain if your NAS is joined to an Active Directory domain. Default is WORKGROUP for standalone NAS.
7. Click Confirm — CloudsLinker negotiates the highest mutually-supported SMB version (typically SMBv3) and shows the connection ready.

Firewall must allow port 445

The NAS’s firewall and any router between CloudsLinker and the NAS must allow inbound TCP port 445 from CloudsLinker’s IP range. If the connection fails, the most common cause is firewall blocking — check your router’s port-forward rules and the NAS’s local firewall settings.

Revoke access

To revoke CloudsLinker’s access: change the NAS user’s password, or delete the dedicated NAS user account. Connection becomes immediately unusable. There’s no token-revocation flow because SMB itself uses static credentials.

NAS / SMB upload & download limits you should know

NAS / SMB is a protocol bridge — limits depend on your NAS hardware and SMB version:

• Default port: 445 (SMBv2 / SMBv3 over TCP). Legacy SMBv1 used ports 137–139 over NetBIOS.
• SMB versions:
  • SMBv1: deprecated, exploited by EternalBlue / WannaCry. Never enable on internet-exposed NAS.
  • SMBv2: widely supported, no encryption by default.
  • SMBv3: current standard, includes end-to-end encryption and MITM protection.
• Authentication: NTLM (workgroup mode), Kerberos (AD domain mode).
• Maximum file size: no SMB-protocol cap. Practical limit: NAS filesystem (Btrfs / ext4 / ZFS — 16 TiB+ per file).
• Bandwidth: capped by NAS uplink and your ISP residential upload speed (typical home: 50–500 Mbps; office: 1–10 Gbps).
• Concurrent connections: NAS-side configurable; typically 5–50 simultaneous SMB sessions per user.
• Encryption: SMBv3 negotiates AES-128 / AES-256 encryption when both sides support it.
• Authentication caching: Kerberos tickets cached typically 10 hours; NTLM has no session caching.
• Common NAS platforms: Synology DSM 7.x, QNAP QTS 5.x, TrueNAS SCALE / CORE, Samba on Linux, Windows Server File Services.
• Synology security: generally good; recent patches RISK:STATION zero-click within 48 hrs.
• QNAP security: historically more troubled; multiple ransomware campaigns (QLocker, DeadBolt). Stay current on firmware.
• Open port 445 risk: prime target for ransomware and wormable exploits — never expose to public internet without IP allowlist.

Sources: SecurityScorecard: Port 445 SMB risks, UK Government Security: Open port 445, Synology Product Security Advisory, Enterprise SMB/CIFS Deployment Guide.