How to use a QNAP NAS as S3 storage for server backups with QuObjects
QuObjects is a free QNAP app that serves a shared folder on the NAS as S3-compatible storage, so backup tools that write to S3 can write to the NAS. Set it up with its own storage space, a private bucket and a NAS user whose key reaches nothing else. Then make the NAS reachable from the servers that upload to it, preferably through a tunnel rather than an open port.
What you need
- An x86 QNAP NAS, or an ARM model in the TS-x32 series or the TS-1635AX.
- QTS 5.0.0 or later. QNAP lists QuTS hero h5.0.0 too, but only with QuObjects 2.3 or earlier.
- For servers in a data centre: a way to reach the NAS from the internet over HTTPS with a valid certificate (see below).
Install QuObjects and choose how it serves
- Sign in to the NAS as an administrator, open App Center, search for QuObjects and click Install.
- Open QuObjects and go to Server Settings.
- Choose Standalone server, set the connection type to HTTPS and keep the port at 8010, the default. Click Apply.
The other server type, Virtual host web server, runs QuObjects inside the NAS's web server, which must be turned on in Control Panel → Applications → Web Server. Standalone is simpler and keeps QuObjects on its own port.
A storage space, a bucket and a key for backups only
In QuObjects, a storage space is a shared folder and a bucket is a top-level folder inside it. Keep backups in a storage space of their own.
- In Control Panel, create a NAS user for backups, with no access to other shared folders.
- In QuObjects → Storage Space, click Create, name it (no spaces), pick a volume and grant only the backup user permission.
- In Buckets, select the storage space, click Create, name the bucket and keep it Private.
- In User Management, click Add User, add the backup user, and create an access key for it.
- Open the key's details: under Amazon S3 you'll find the service endpoint, the access key and the secret key.
When creating the bucket you can also turn on versioning, and object lock with a retention period in Governance mode (administrators can still delete) or Compliance mode (nobody can, until the period ends). Turning on object lock also turns on versioning.
Reach the NAS from the internet
A server in a data centre cannot reach 192.168.x.x. Choose one of these:
- A Cloudflare Tunnel. Nothing on your router is opened. In Cloudflare's Zero Trust dashboard, create a tunnel, then run its connector in Container Station with the token it gives you. Add a public hostname, such as
s3.example.com, with service type HTTPS and URL192.168.1.10:8010(the NAS's own address), and turn on Disable TLS certificate verification, because QuObjects' own certificate is self-signed. Cloudflare supplies the certificate fors3.example.com. - One forwarded port. Forward TCP 8010 on your router to the NAS, give the NAS a name with myQNAPcloud, and install a certificate for that name on the NAS, so clients don't refuse the connection.
docker run -d --name cloudflared --restart unless-stopped \
cloudflare/cloudflared:latest tunnel --no-autoupdate run --token <your-tunnel-token>Cloudflare caps each request at 100 MB on its Free and Pro plans (200 MB on Business). Tools that upload large files in parts of under 100 MB work through a tunnel; one that sends a whole large file in a single request does not. Never forward the NAS's sign-in ports (8080, 443) to the internet.
Test it with the AWS CLI
From the server that will upload, save the key as a profile and try a round trip. QuObjects accepts any region name in requests; us-east-1 works with most tools.
[profile qnap]
region = us-east-1
endpoint_url = https://s3.example.com
request_checksum_calculation = when_required
response_checksum_validation = when_requiredaws configure set aws_access_key_id <access-key> --profile qnap
aws configure set aws_secret_access_key <secret-key> --profile qnap
echo hello > test.txt
aws s3 cp test.txt s3://server-backups/test.txt --profile qnap
aws s3 ls s3://server-backups/ --profile qnap
aws s3 rm s3://server-backups/test.txt --profile qnapThe two checksum lines stop recent AWS CLI versions from adding checksums that some S3-compatible servers reject. If uploads work without them, you can leave them out.
Limits and what QuObjects does not do
| Limit | QuObjects |
|---|---|
| Largest object | 16 TiB on QTS (48.8 TiB on QuTS hero) |
| Largest single upload | 1 TiB |
| Parts per multipart upload | 10,000, each 5 MiB to 5 GiB |
| Buckets and objects | No limit |
QuObjects covers the bucket, object and multipart APIs backup tools use, plus presigned URLs and CORS. Lifecycle rules are not in its list of supported APIs, so old backups won't expire by themselves: let your backup tool's retention delete them. QNAP itself recommends testing before relying on it, since a NAS-backed store can behave slightly differently from cloud object storage.
Frequently asked questions
- Can I use QuObjects over Tailscale instead of the internet?
- Yes, if every server that uploads is on your tailnet and connects to the NAS's Tailscale address. A hosted backup service outside your tailnet cannot reach it that way.
- Does QuObjects work with restic, rclone and other S3 tools?
- It speaks the S3 bucket, object and multipart APIs those tools use. Point them at the QuObjects endpoint with path-style addressing, and test a backup and a restore before relying on it.
- Is a QNAP NAS safe to put on the internet?
- Only with care. Expose QuObjects alone, preferably through a tunnel, keep QTS and its apps updated, and keep another copy of your backups elsewhere.
How this was checked
Commands, limits and prices were checked against these official pages, on October 24, 2026:
- QNAP: QuObjects tutorial (installation, server settings, users, storage spaces, buckets, APIs and limits)
- QNAP: QuObjects product page
- Cloudflare Docs: origin parameters (noTLSVerify)
- Cloudflare Docs: limits (request body size by plan)
- AWS CLI User Guide: configuration and settings (request_checksum_calculation)