Access a home NAS without a public IP
If your ISP uses CGNAT, you cannot port-forward. An FRP tunnel from the NAS (or a machine on the same LAN) gives you a public hostname or host:port.
Do not expose SMB, AFP, or the whole disk over the internet. Publish the admin HTTPS UI or one specific app (Photos, a backup API). File copies at Free's 1 Mbps are not usable; upgrade if you need real throughput. Content must follow the Acceptable Use Policy.
HTTP for the NAS web UI
Synology DSM, TrueNAS, OpenMediaVault, and similar UIs are websites. Create an HTTP tunnel pointed at the LAN IP and the UI port (often 5000 / 5001 / 80 / 443 on HTTP). Visitors open https://<tunnel-id>.<region>.tunnel.nicefrp.com with a platform certificate. Details: the same flow as the Quick Start.
If the NAS UI itself speaks HTTPS on the LAN, either:
- point frpc at the HTTP port if the NAS still serves it, or
- use a paid HTTPS passthrough tunnel and supply the certificate (see FRP vs ngrok vs Cloudflare Tunnel).
Paid plans can attach your own hostname (custom domains). Cloudflare Tunnel is a better fit if the zone already lives on Cloudflare and you only need HTTP.
TCP for one service
SSH to the NAS, a single docker published port, or a vendor app that is not HTTP: create a TCP tunnel. The console shows node:port. Anyone with that address can connect — treat it like opening a firewall port. Prefer SSH keys over passwords.
UDP (some camera or game protocols) is paid only and abuse-limited.
Limits that matter at home
| Plan | Tunnels | Bandwidth | Traffic / 30 days | Protocols |
|---|---|---|---|---|
| Free | 1 | 1 Mbps | 5 GiB | TCP, HTTP |
| Starter | 3 | 5 Mbps | 100 GiB | TCP, UDP, HTTP, HTTPS + custom domain |
Free is enough to open DSM from a café. It is not a substitute for off-site backup or streaming a media library to friends.