Which Ports Should You Open for Synology Drive?

If you’ve just set up Synology Drive on your NAS, the next hurdle is often the network side of things. A few well‑chosen ports let you sync files, collaborate on documents, and stream media without a hitch. Open the right ones and you’ll enjoy smooth, on‑the‑go access; miss a critical rule and you’ll be staring at connection errors instead of your latest project.

Why Port Management Matters

Synology Drive isn’t just a file‑sharing app—it’s a suite of services that talk to each other over specific TCP and UDP channels. Your router’s firewall, any external security appliances, and even Windows or macOS firewalls can block those channels if you haven’t explicitly allowed them. That’s why a quick port audit can spare you a lot of troubleshooting later.

Core Ports You’ll Need

Below is the minimal set of ports that must be reachable from the Internet (or from your office LAN if you’re keeping everything internal). All of them use TCP unless noted otherwise.

• 5000 – Synology DSM default HTTP (web admin, also used by Drive client for initial discovery)
• 5001 – HTTPS for DSM (recommended to keep traffic encrypted)
• 6690 – Synology Drive Server (file transfer and sync)
• 443 – General HTTPS services (QuickConnect, Cloud Sync, and optional mobile apps)
• 22 – SSH (optional but handy for advanced diagnostics; can stay closed if you never use it)
• 32443 – if you enable Synology Drive’s optional “Secure HTTPS” mode on a custom port

Remember: if you change any of these default numbers in DSM’s Control Panel → Network → Port Settings, you’ll need to adjust your router accordingly.

How to Open the Ports on a Typical Home Router

Every router UI looks a bit different, but the steps are generally the same.

1. Log in to your router’s admin page (often 192.168.1.1 or 192.168.0.1).
2. Locate the “Port Forwarding”, “Virtual Server”, or “NAT” section.
3. Create a new rule for each port above:
   • Protocol: TCP (or “Both” if the interface forces you to pick).
   • External Port: the number from the list.
   • Internal IP: the static IP address you assigned to your Synology NAS.
   • Internal Port: same as the external port unless you’ve mapped it differently.
4. Save the changes and, if your router offers it, click “Apply” or “Reboot”.
5. Test each rule with an online port checker or by simply trying to connect from a remote device.

When You’re Behind a Double NAT

Some ISPs hand out a router that’s already doing NAT, then you plug in your own router. In that case, you have to forward the same ports on both devices. Otherwise the outer gateway swallows the packets before they even reach your Synology.

Optional Ports for Extra Features

Synology Drive can play nicely with a few additional services. You don’t need them for basic file sync, but they become handy if you’re using the full ecosystem.

• 80 – HTTP redirection to 443 (useful if you want browsers to auto‑upgrade).
  Only open if you trust the network.
• 1900 – SSDP for DLNA discovery when streaming media from Drive to smart TVs.
• 9000‑9003 – Ports used by Synology’s “WebDAV” interface (if you enable WebDAV for legacy clients).

Testing Connectivity Without a Full‑Blown Scan

A quick way to confirm everything is in order is to use the Synology Assistant utility. It scans your local subnet, finds the NAS, and tells you whether the required ports are reachable. For remote checks, a simple telnet your‑nas‑address 5001 from a laptop outside your network will let you know if the HTTPS port is truly open.

Common Mistakes to Avoid

• Using the wrong protocol. UDP won’t work for these services; make sure TCP is selected.
• Port conflicts. If another device already uses, say, port 5000, change the DSM port in Control Panel first.
• Dynamic IP address. If your NAS’s internal IP changes after a reboot, the forwarding rule points to nothing. Reserve a static lease in DHCP.
• Forgetting to disable “Block all incoming connections” on the NAS firewall. Even with router forwarding, the NAS can still reject traffic.

Do You Need a VPN?

Opening ports to the internet always carries a bit of risk, even if you stick to HTTPS. Many power users prefer to keep all Synology services behind a VPN—OpenVPN or WireGuard—so the NAS never exposes those ports publicly. In that scenario you’d only open the VPN port (1194 for OpenVPN by default) and keep the Drive ports locked down.

Quick Reference Table

Wrapping It Up

Getting Synology Drive to work over the internet is mostly a matter of opening the right handful of TCP ports and making sure your NAS has a steady internal address. Double‑check each rule, test from outside your home network, and consider a VPN if you want that extra layer of security. Once the ports are set, you’ll be able to pull, push, and collaborate on files from wherever you are—no more “cannot connect” headaches.