Private NAS: Buy vs Build Your Own Storage

By State of Surveillance Last Updated: July 2026

Why Own Your Storage

The cloud is someone else's computer, and that someone scans your files. Free and cheap providers mine content for ads and AI training, hand data to law enforcement on a subpoena, and quietly raise prices once you are locked in. A Network Attached Storage box (a NAS) puts the drives in your house, under your keys.

The catch: a NAS you set up wrong is worse than the cloud. Expose it to the open internet and you are one unpatched bug away from ransomware. This guide covers what to buy, what to build, and the safeguards that separate a private NAS from a public liability.

Before you spend a cent, read our companion pieces: the encrypted cloud storage comparison if you are still deciding whether to self-host at all, and the self-hosted Nextcloud guide if you want a Dropbox-style sync layer running on top of the NAS you build here.

Our Verdict on Self-Hosting

🛡️ Trustworthy when it is locked down. A NAS that never touches the public internet, gets automatic security updates, and pushes an encrypted offsite backup beats any consumer cloud on privacy. A NAS with a port forwarded to it and default logins is a ransomware statistic waiting to happen. The hardware is the easy part. The safeguards section below is the real work.

Buy vs Build at a Glance

Option Price Class Skill Needed Privacy Posture Ransomware Track Record
Synology Mid to high Low Good if you disable cloud extras Clean vs mass ransomware waves
QNAP Low to mid (best specs per dollar) Low to medium Good if locked down Bad: QLocker 2021, DeadBolt 2022
UGREEN NASync Low to mid Low to medium New software, verify defaults Short history, few incidents
TerraMaster Low (budget) Medium Depends on TOS config Mixed, has been targeted
DIY TrueNAS (used PC) Low if you reuse hardware High Best: open source, ZFS, you control it Yours to manage
DIY openmediavault (Pi 5) Lowest Medium to high Best: open source, minimal surface Yours to manage

None of these is private out of the box. The privacy column assumes you follow the safeguards at the end of this guide. Skip them and any option becomes a data leak.

The Prebuilt Options

Synology: Polished, But Watch the Drive Lock-In

Why people pick it: DiskStation Manager (DSM) is still the most polished NAS operating system in 2026. It is the box you hand a non-technical relative. Snapshots, Docker, and a clean web UI all just work.

What went wrong in 2025: Synology's 2025 Plus-series models (DS925+, DS1825+ and other 2025 Plus units) originally required Synology-branded or certified drives. On non-certified third-party drives, the models blocked storage-pool creation, volume-wide deduplication, drive lifespan analysis, and automatic drive firmware updates, and dropped you to limited support.[1] Since Synology does not make hard drives (it rebrands drives from vendors like Seagate, Toshiba, and Western Digital with custom firmware), this was pure lock-in that let rivals market themselves as the open alternative.[1]

The walk-back: After the backlash, Synology restored third-party HDD and SATA SSD support on the 2025 Plus units with the DiskStation Manager 7.3 update (M.2 NVMe drives still require the compatibility list for storage pools), so you can once again run Western Digital and Seagate drives without losing core features.[2] The policy moved more than once, so check the current compatibility list for the exact model before you buy.

Privacy caveats to fix on day one

  • QuickConnect relay: Synology's QuickConnect reaches your NAS over LAN, WAN, or hole punching, and when none of those work it relays your connection through Synology's own relay servers.[3] Relay traffic is encrypted end to end, so Synology cannot read your files, but you are still routing through their infrastructure and trusting their availability. Use a WireGuard tunnel instead (below) and you never need the relay.
  • Usage analytics: DSM ships with device and usage analytics turned on. Open Control Panel and turn them off.
  • Cloud accounts: Skip the Synology Account and third-party cloud sync unless you actually need them. Every account you link is another party that knows your NAS exists.
Check current Synology models and drive compatibility →

Vendor link. We may earn a commission if a program is in place.

QNAP: Best Hardware for the Money, Ugly Security Past

Why people pick it: QNAP throws more hardware at the price than anyone. ZFS via QuTS hero, more bays, faster networking, PCIe expansion. Power users who want storage tiering and control gravitate here.

The brutal part: QNAP has the worst ransomware history in consumer NAS, repeatedly targeted by DeadBolt, Qlocker, and eCh0raix.[5] Starting January 2022, DeadBolt ransomware repeatedly hit internet-exposed QNAP units, encrypting files with a .deadbolt extension and hijacking the login page with a ransom note.[5] DeadBolt came back in fresh waves through 2022, including a widescale campaign in May, each targeting NAS that were reachable from the open internet.[6] At one point Trend Micro counted over 83,000 QNAP services exposed to the open internet, each one a candidate target.[6]

The honest read: Every one of those campaigns had the same root cause. The NAS was exposed to the internet. QNAP hardware is fine. QNAP owners who port-forwarded their boxes got burned. Buy QNAP for the specs, then treat the safeguards section as mandatory, not optional. QNAP itself now tells owners to stop exposing the NAS and to route access through WireGuard instead.[7]

See QNAP NAS lineup →

Vendor link. We may earn a commission if a program is in place.

UGREEN NASync: The Budget Disruptor

Why people are watching it: UGREEN entered the NAS market with the NASync DXP series in early 2024 and has been undercutting the incumbents on price ever since. In 2026 the lineup spans the DXP series (two-bay to eight-bay), a home-focused DH series (DH2300, DH4300 Plus), and a new AMD-powered DXP GT high-speed line.[8] The DXP2800 GT and DXP4800 GT launched at $429.99 and $559.99 against list prices of $509.99 and $659.99.[8]

The honest read: The hardware is strong for the money and the DSM-style software is improving fast, but it is new. New NAS software means fewer eyes on the security defaults and a shorter track record. Verify what the box phones home by default, turn off any cloud relay you do not need, and do not treat a young platform as battle-tested. Good value, not yet a safe bet for a set-and-forget appliance.

See UGREEN NASync models →

Vendor link. UGREEN runs a public affiliate program (see notes).

TerraMaster: Cheapest Way Into a Prebuilt Box

Why people pick it: Price. The four-bay F4-424 Pro lists at $859.99 in mid-2026 and drops to around $730 in seasonal sales, and packs an Intel Core i3 8-core chip, 32GB DDR5, dual 2.5GbE, and two M.2 NVMe slots.[9] The newer F4-425 line and the 10GbE F4-424 Max sit above it. TerraMaster's TOS operating system has matured, and TOS 7 on newer units ships a rebuilt interface and AI features on top of long-standing Docker and virtual machine support.[9]

The honest read: You get a lot of hardware cheap, but TOS is the least polished of the mainstream options and TerraMaster boxes have been targeted in past NAS attack campaigns. Fine for a technical owner who will keep it patched and off the internet. Not the box for someone who wants to forget it exists.

See TerraMaster models →

Vendor link. We may earn a commission if a program is in place.

The DIY Options

Building your own NAS is the most private path: open-source code you can audit, no vendor cloud, no drive lock-in, and a much smaller attack surface if you install only what you need. The cost is your time and your willingness to own the maintenance.

TrueNAS Community Edition on a Used Office PC

What it is: TrueNAS SCALE was renamed TrueNAS Community Edition in April 2025 with the 25.04 "Fangtooth" release, unifying the old CORE and SCALE lines into one free, open-source platform.[10] The current release is 25.10 "Goldeye," out October 28, 2025,[11] and it is the platform's most widely deployed version.[12] It runs on the ZFS filesystem, which gives you checksummed data integrity, snapshots, and cheap-to-store copy-on-write backups.

The build: A used business mini-PC or tower with a modern Intel or AMD chip, 16GB or more of RAM, and a few SATA drives is the sweet spot for value and power. ZFS likes RAM and likes ECC memory if the board supports it. You get enterprise-grade storage features on hardware that cost you a fraction of a prebuilt.

The tradeoff: You are the sysadmin now. You handle updates, pool layout, and recovery. TrueNAS makes this manageable through a clean web UI, but if a drive dies at 2am, nobody is on call but you.

Download TrueNAS Community Edition →

Free and open source. Vendor link, no cost to you.

openmediavault on a Raspberry Pi 5

What it is: openmediavault (OMV) is a free, Debian-based NAS OS. Pair it with a Raspberry Pi 5, which now has PCIe support, plus an M.2 NVMe HAT or a SATA HAT, and you have a tiny, near-silent, low-power file server.

The reality check: NVMe on the Pi 5 can read around 800 MB/s locally, but gigabit Ethernet caps real network transfers to roughly 115 MB/s no matter how fast the drive is. This is a light-duty box: documents, photo backups, a personal cloud for one household. It is not the machine for 4K video editing over the network. Install OMV on Raspberry Pi OS Lite, not the desktop image, or the install fails.

New to the Pi side of this? Start with our Raspberry Pi privacy home server guide and the Raspberry Pi kit buyer's guide so you order the right HAT, power supply, and cooling the first time.

The Safeguards: This Is the Real Meat

Every ransomware headline in this guide traces back to a NAS that was reachable from the open internet with weak defenses. Hardware choice barely matters here. These steps do. Do them on any box you buy or build.

Rule 1: Never Port-Forward Your NAS. Ever.

Do not open port 5000, 5001, 8080, 443, or any NAS service port on your router. Attackers run automated scanners across the entire internet looking for exactly these. A forwarded NAS port is a target painted on your data. This single mistake is how QNAP owners got hit by DeadBolt and QLocker.[5] If you did nothing else from this list, doing this one thing would prevent most NAS disasters. Also turn off UPnP on your router so the NAS cannot quietly open a port for itself.

Rule 2: Remote Access Through WireGuard Only

When you need your files from outside the house, connect to a WireGuard VPN that lives on your router or a small server, then reach the NAS as if you were home. WireGuard is fast, lightweight, and the modern standard for self-hosted VPNs. The only port exposed to the internet is the VPN's, and it does not answer to anyone without your key. QNAP now recommends exactly this to cut down exposed services.[7]

We have a full walkthrough: how to set up a WireGuard VPN server at home. If you would rather buy a router that does this for you, see the privacy router comparison. Keeping the NAS on its own network segment adds another wall; our home network VLAN segmentation guide covers that.

Rule 3: Snapshots Plus Offline and Offsite Backup (3-2-1)

A NAS is one copy of your data. One copy is not a backup. Follow the 3-2-1 rule: three copies of anything you care about, on two different media types, with one copy offsite.

  • Snapshots: Turn on filesystem snapshots (ZFS on TrueNAS, Btrfs on Synology). A snapshot lets you roll back a folder to yesterday after an accidental delete or a ransomware hit, as long as the attacker cannot reach the snapshot itself.
  • Offline copy: Keep a copy that is not always plugged in. An external drive you connect for backups and then unplug cannot be encrypted by ransomware that only lives on the network.
  • Encrypted offsite copy: Push an encrypted backup to a remote service so a house fire or theft does not wipe everything. Use a provider with strong client-side encryption. We rate IDrive for cheap cloud backup with private-key encryption, pCloud with its Crypto add-on for a lifetime-plan option, and SpiderOak for zero-knowledge design. Compare them in our cloud backup comparison and encrypted cloud storage comparison.

Rule 4: The Boring Hardening Checklist

  • Auto-updates on. Every ransomware wave in this guide exploited a known, patchable bug. Turn on automatic security updates for the NAS OS.
  • Rename the admin account. Delete or disable the default "admin" user and make a new admin with a different name. Half of automated attacks assume the username is admin.
  • 2FA on every account. Enable two-factor authentication on the NAS and on any linked account.
  • Strong, unique passwords. Store them in a password manager, not a sticky note.
  • Kill services you do not use. Every enabled app is attack surface. Turn off media servers, cloud sync, and remote features you are not actively using.

Which Should You Buy or Build?

Pick a prebuilt if:

  • You want it working in an afternoon
  • You will not enjoy being the sysadmin
  • You value a polished app and mobile experience

Synology for polish, QNAP for specs, UGREEN or TerraMaster for budget. Lock every one of them down.

Build a used-PC TrueNAS if:

  • You want maximum privacy and control
  • You want ZFS integrity and snapshots
  • You are comfortable owning maintenance

Best value and best privacy posture if you have the skills.

Build a Pi 5 openmediavault box if:

  • Power draw and silence matter most
  • Your needs are light: docs, photos, one household
  • You want the cheapest private option

Just do not expect fast transfers over gigabit.

Whatever you choose:

  • Never port-forward it
  • Reach it via WireGuard only
  • Run 3-2-1 backups with an encrypted offsite copy
  • Auto-updates, renamed admin, 2FA

The safeguards matter more than the brand.

The Bottom Line

Our Recommendation

Most people: A current Synology sitting behind a WireGuard tunnel is the easiest private setup that a non-technical person can actually maintain. Just verify drive compatibility for the exact model first, and turn off analytics and QuickConnect.

Best value and best privacy: A used office PC running TrueNAS Community Edition. Open source, ZFS integrity, no lock-in, no vendor cloud. It asks more of you and gives back more control.

The part that is not optional: Do not expose the box to the internet. Reach it through WireGuard. Snapshot it, back it up 3-2-1 with an encrypted offsite copy. A poorly secured NAS is not privacy. It is a slower, more personal version of the cloud you were trying to leave.

Compare current Synology models →

Vendor link. We may earn a commission if a program is in place.

Keep Going

References

  1. NAS Compares : Synology 2025 NAS Hard Drive and SSD Lock-In Confirmed (April 2025)
  2. Tom's Hardware : Synology walks back compatibility policy with DSM 7.3
  3. Tech Guide Central : Is Synology's QuickConnect Secure? (connection order and relay encryption), summarizing Synology's QuickConnect White Paper (PDF)
  4. TechTarget : QNAP devices hit by DeadBolt ransomware again (2022)
  5. BleepingComputer : QNAP alerts NAS customers of new DeadBolt attacks
  6. Trend Micro : DeadBolt ransomware multitiered extortion analysis (2022)
  7. QNAP : Use WireGuard VPN to reduce NAS services exposed to the internet
  8. UGREEN : NASync DXP GT lineup and pricing (2026)
  9. TerraMaster : F4-424 Pro specifications
  10. TrueNAS : Meet TrueNAS Community Edition (25.04 Fangtooth, April 2025)
  11. TrueNAS : Goldeye 25.10 official release (October 2025)
  12. TrueNAS Forums : Goldeye 25.10 takes over (most widely deployed version, 2026)

Related Reading