How to map your Synology as a network drive over the internet

Why your mapped drive vanishes the moment you leave

At home, mapping the NAS is glorious: \\my-nas\share, pick a drive letter, done. That works because your laptop and your NAS are on the same local network, and my-nas is a name that only means something there. Step onto café Wi-Fi and that name resolves to precisely nothing — there's no route from the open internet to a private device sitting behind your router.

So "map my Synology over the internet" is really one question: how do I get a route to the NAS from outside? There are four honest answers, and they differ mostly in how much of your NAS you have to expose to strangers to get there.

The classic routes (and their catches)

Credit where it's due — every one of these works, and people have run them for years. They just come with strings attached.

Forward SMB (port 445) to the NAS. The tempting one: forward the SMB port on your router and map \\your-public-ip\share. Please don't. Port 445 is among the most relentlessly scanned and attacked ports on the internet, and exposing it is a recurring headline in ransomware post-mortems. Fast to set up, genuinely dangerous.

WebDAV over HTTPS. The one most remote-mapping guides actually recommend: enable Synology's WebDAV Server, get a certificate, forward port 5006, and map the drive to https://your-ddns:5006. It's encrypted in transit and far safer than raw SMB — but you're still publishing a login page to the world, and WebDAV can be fiddly with large files, file locking, and apps that expect a genuine drive rather than a web mount.

A VPN back home. The prosumer favourite: run a VPN server (WireGuard, OpenVPN, or Synology's own) so your laptop joins your home network, then map \\my-nas\share as if you were on the couch. Technically excellent and properly private. The catch is that it's the most setup, and it still stumbles behind CGNAT unless you add a relay — plus a VPN gives you the whole network when you only wanted one drive.

The four routes, side by side

The pattern: the easy methods expose something to the internet, and the safe method (a VPN) is the most work. RocketZero is trying to be the safe and easy corner of that table.

The drive-mount way: a real SMB drive, no open ports

RocketZero takes the VPN idea — carry SMB inside an encrypted tunnel so nothing is exposed — and removes the part where you build and babysit the VPN. Under the hood it's WireGuard (the same modern encryption a mesh VPN uses) with a self-hosted control plane, so the NAS and your computer connect directly, peer-to-peer when the network allows it and fall back to an encrypted relay when it can't punch through.

The practical upshot: the drive mount is end-to-end encrypted. On a direct path your files never touch our servers; on a relay the relay only ever sees ciphertext. There's no port to open, no DDNS to maintain, and it works behind CGNAT — the exact situation where port forwarding is off the table because you don't even have a public IP.

And because it speaks real SMB, you get a real drive — a proper V: on Windows or a mounted volume in Finder on a Mac — not a web mount pretending to be one. You sign in with your existing NAS username and password (there's no separate RocketZero account), and those credentials live in the OS keychain, never in plaintext and never on our servers.

One honest caveat: RocketZero also gives your NAS a friendly your-nas.roze.to address that opens DSM in a browser — that web path is a hosted reverse proxy (same trust model as Cloudflare Tunnel), not end-to-end encrypted. It's the drive mount that's E2E. Different job, different guarantee.

What it actually looks like

After the two installs, the NAS shows up in Windows Explorer under "This PC" as ordinary drive letters — the same place your USB stick lands. Open, edit, and save straight off it; the fact that the bytes are travelling across an encrypted tunnel from the other side of the country is invisible.

So which should you pick?

FAQ