Can you use a NAS for server backups? QNAP, Synology, UniFi and Drobo compared

Taking backups or pulling a copy

For most people pulling is the better choice. It keeps the cloud copy, adds a second one at home, and never exposes the NAS. It is the 3-2-1 rule with the NAS as the second copy.

Taking backups directly makes sense when the NAS is the only storage you want to pay for, and you are prepared to keep it patched and reachable.

QNAP

QNAP's free QuObjects app turns a shared folder into S3-compatible storage: buckets, presigned URLs and multipart uploads, which is what backup tools use. It runs on every x86 QNAP and on the ARM models in the TS-x32 series and the TS-1635AX, with QTS 5.0.0 or later. Any tool that writes to S3 can then write to the NAS. See how to set up QuObjects for backups.

To pull instead, Hybrid Backup Sync 3 (HBS 3) has active sync jobs, which copy from a cloud storage space to the NAS. QNAP itself suggests this for a 3-2-1 setup: back up to the cloud, then copy the cloud backup to the NAS. See how to keep a copy on a NAS.

Synology

DSM has no S3 server of its own. Synology C2 Object Storage is Synology's cloud service, not something that runs on your NAS. A Synology can still take backups as files: DSM has an rsync service and SFTP, so a server can push with rsync over SSH if the NAS is reachable.

Pulling is better supported. Cloud Sync connects to S3 storage and has a one-way mode that downloads remote changes only, so the NAS keeps a copy of a bucket without ever uploading to it.

UniFi UNAS

Ubiquiti's UNAS devices run UniFi Drive. It shares files over SMB and backs the NAS up outwards, to another UNAS, an SMB share, or cloud storage such as Google Drive, OneDrive, Dropbox, Amazon S3, Backblaze B2 and Wasabi. It runs no third-party apps or containers, so there is no S3 server to install and no way for the UNAS itself to download from a bucket.

To get server backups onto a UNAS, let another machine on your network do the pulling. Mount a UNAS share on a computer that is on most of the time, and copy the bucket into it with rclone on a schedule:

sudo mkdir -p /mnt/unas
sudo mount -t cifs //192.168.1.20/ServerBackups /mnt/unas -o username=backup,uid=$(id -u)

rclone config create backups s3 provider=AWS region=us-east-1 \
  access_key_id=AKIA... secret_access_key=...

rclone copy backups:my-backup-bucket /mnt/unas --checksum --transfers 4

Drobo

Drobo stopped selling its products and supporting them on January 27, 2023, and its parent company, StorCentric, moved to Chapter 7 liquidation in May 2023. There are no more firmware or security updates.

Before you open a NAS to the internet

NAS devices reachable from the internet have been targets of ransomware that encrypts everything on them. If the NAS is to take backups directly:

• Expose only the one service backups need, such as QuObjects' port, never the NAS's sign-in page.
• Prefer a tunnel (Cloudflare Tunnel, for example) to a forwarded port: nothing on your router is opened, and your home address stays hidden.
• Give backups a user of their own that can reach one shared folder and nothing else.
• Turn on automatic updates for the operating system and the apps, and turn off services you don't use.
• Keep another copy somewhere else. A NAS that is encrypted by ransomware takes its backups with it.

Frequently asked questions

Can I use Tailscale to reach my NAS for backups?

Only if every machine that uploads is on your tailnet. A backup service running in a data centre cannot reach a Tailscale address, so for a hosted backup tool the NAS needs a public address or a tunnel, or it should pull a copy instead.

Is a NAS enough as the only copy of my server backups?

Not on its own. It sits in one place, on one power supply and one internet connection. Treat it as one copy of two, with the other in cloud storage.

Does a Synology NAS speak S3?

Not natively. DSM can download from S3 storage with Cloud Sync and take files over rsync or SFTP, but it has no S3 server of its own.