https://syedzubyl.space Syed Zubyl N — Software Developer focused on Java, Spring Boot, backend development, REST APIs, databases, Flutter and production-oriented applications. Zola en Mon, 20 Jul 2026 00:00:00 +0000 Mon, 20 Jul 2026 00:00:00 +0000 Syed Zubyl N https://syedzubyl.space/blog/building-secure-personal-nas/ https://syedzubyl.space/blog/building-secure-personal-nas/ <h3 id="the-problem">The Problem</h3> <p>I wanted a personal Network Attached Storage (NAS) to back up files and access my data remotely from anywhere. The traditional approach involves buying an expensive Synology unit, opening ports on the home router (Port Forwarding), and setting up Dynamic DNS. Opening ports on a home network exposes it to relentless automated scanning and potential attacks.</p> <h3 id="context">Context</h3> <p>I had an older laptop with decent storage and a reliable power supply (built-in battery acts as a UPS!). My goal was to install Ubuntu Server, attach high-capacity SSDs, and securely access the files over the internet using <code>FileBrowser</code>, but with absolutely zero open inbound ports on my router.</p> <h3 id="what-i-tried">What I Tried</h3> <p>I initially looked into setting up OpenVPN or WireGuard on a Raspberry Pi to VPN into my home network.</p> <h3 id="what-failed">What Failed</h3> <p>While VPNs are secure, they add friction. I wanted the ability to access my files seamlessly from any web browser on any device without installing a VPN client first.</p> <h3 id="what-worked-technical-explanation">What Worked &amp; Technical Explanation</h3> <p>I implemented an outbound-only tunnel architecture using Cloudflare Zero Trust.</p> <p><strong>Architecture Flow:</strong></p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="plain"><span class="giallo-l"><span>Browser → HTTPS → Cloudflare Edge → Cloudflare Tunnel (Outbound) → cloudflared daemon → Local File Browser → SSD</span></span></code></pre> <p><strong>1. Hardware &amp; OS Setup</strong> I installed Ubuntu Server on the old laptop. To ensure storage reliability, I formatted the external SSDs to <code>ext4</code> and mounted them via <code>/etc/fstab</code> using their UUIDs, ensuring they always mount to the exact same directory even if USB ports are swapped.</p> <p><strong>2. Application Layer</strong> I installed <code>FileBrowser</code>, a lightweight web-based file manager. I configured it to run as a background service managed by <code>systemd</code>.</p> <p><strong>3. The Network Layer (Cloudflare Tunnel)</strong> Instead of opening Port 443 on my router, I installed the <code>cloudflared</code> daemon on the Ubuntu server. This daemon establishes a secure, outbound connection to Cloudflare’s edge network.</p> <p>I configured my domain (<code>nas.mydomain.com</code>) in Cloudflare to route traffic through this tunnel to the local <code>localhost:8080</code> (where FileBrowser was running).</p> <p><strong>4. Security</strong> Because the connection is outbound-only, my home IP address is never exposed to the public internet, and no ports are open. Furthermore, I placed the URL behind Cloudflare Access, requiring a One-Time PIN sent to my email before the tunnel even allows traffic to reach the local server.</p> <h3 id="lessons-learned">Lessons Learned</h3> <p>Old hardware is incredibly capable if running a lightweight Linux distribution. Furthermore, modern zero-trust networking tools like Cloudflare Tunnels completely change the paradigm of self-hosting. You no longer need to compromise local network security for remote accessibility.</p> <h3 id="what-i-would-do-differently">What I Would Do Differently</h3> <p>I would implement a secondary local backup strategy using <code>rsync</code> or <code>Restic</code> to occasionally mirror the SSD to a separate drive. While the networking is secure, SSDs can still fail, and RAID 1 over USB is generally not recommended.</p>