Hi - I am almost embarassed to ask this, as I have done extensive QVPN stuff in the past with OpenVPN, QBelt and Wireguard, and during that period of time (Covid Era - 2020, 2021, 2022) I was plagued with Deadbolt and QLocker virus, because I opened up ports on internet routers (port forwarding) to allow these services to work.
Since that time I have only used ZeroTier and Tailscale for remote VPN access - mainly to allow for remote backups between QNAP systems with HBS3. And Daniel at QNAP has shown me Twingate using a docker, and now ZeroTier is no longer working with QuTS 6.0.x unless I go into a docker, so I use Tailscale, and it works perfectly fine.
But I saw something on QBelt again, and it’s changed a little since 2020, 2021 - so I figured - ok, let me try this out again. I go thru the setup on my QNAP and my computer - easy enough - and it’s not working BECAUSE I WONT OPEN UP PORT 443 on my internet router to get it to work. I check with ChatGPT, Google AI, etc. and they all agree. But I am asking YOU for verification of this - without port forwarding port 443 on my internet router and pointing to the QNAP IP address on my network - I am not going to get QBelt to work - CORRECT ? Or am I missing something.
Thank you for your assistance and confirmation. As I said at the beginning - I am embarassed to even be asking a question like this.
I assume you are using port 443 UDP on both the client and QVPN server? If it doesn’t work, try port 4433 on both and open up that port and on your home firewall and direct the UDP traffic to the IP address of your NAS. O2 were blocking UDP traffic on port 443, but they seem to have removed the block where I am.
I guess you didn’t read the entire thread here. I am well versed in QVPN, and at the start of Covid, I learned all about QNAP QVPN, and Open VPN, Wireguard, and QBelt. ALL of them require ports to be opened on the internet router. When I did this, on about 200 different QNAP clients, about 50 of those clients got (depending on the date of me doing this) either the QLocker Virus, or the Deadbolt virus - both which are now infamous QNAP virus. So around late 2022, because of the nighmare that I created, I stopped doing any of the QNAP VPN solutions, and started to use ZeroTier, and Tailscale. Since the end of Covid - the demand for remote access across the internet to a QNAP server has not decreased. When ZeroTier stopped their support as of QuTS 6.0.x, I went back to Tailscale, and have posted on this very forum about this. And Daniel from QNAP also figured out how to get Twingate to work on a QNAP in docker (ZeroTier still works with QuTS 6.0.x IF you use a docker in Container Station). But the easy answer for me today is Tailscale. (And Tailscale has much later versions of their .qpkg than the 1.4.0 version listed in the QNAP App Center).
SO - I watch lots of QNAP videos, and I just saw a recent QNAP Canada Video on using QBelt, and since I had not done any of this since around 2022, I figured - let me give this a shot again. And I did - the menus changed a little, but it’s easy to setup. But it DOES NOT WORK, unless you open up ports on your internet router, using Port Forwarding. WHICH IS CRAZY - because the world is full of hackers that want to put virus on your products - QNAP or otherwise. So the moral here is DONT EXPOSE YOUR QNAP to the internet by opening up ports on your internet router (like 1194 for OpenVPN or 443 for QBelt).
The reason why Tailscale (and ZeroTier and Twingate) are wonderful, is that these programs allow for remote access over the internet - without having to open up any ports on your internet router. These programs work EVEN if you have a double NAT on your router (cable company router, AND your router).
I see you are doing a lot of security products - then you know very well that modern security systems DO NOT require ports on the internet router to be opened for users to get remote access to their cameras or NVR’s.
Why use a VPN on the QNAP. Why not use a VPN on the router or a R-Pi set up for this purpose. The router is the best solution…
I’m sure you have your reasons but to me, creating a VPN inside a LAN is a recipe for trouble as there has to be ports open to allow the traffic from the router. TailScale works because it’s a relay service using Wireguard but direct VPNs are going to be faster.
why not use a VPN on the router ? Simple answer. I don’t know all the routers on the market. I know how to do this now on the Ubiquiti Dream Machine series of routers - but most people just have their cable company routers - and there are millions of variations, and almost no one even knows how to log into their router at customer sites, so I can get into the settings.
It just like with the NAS systems - I know QNAP, and I know Synology, but I don’t know Asustor, I don’t know UGreen, I don’t know Terramaster - and there are plenty of others out there on the market. I can’t learn all of them. Same applies to the router.
Even when I got myself into trouble 2020 - 2022 - I had to get into the clients router just to do the port forwarding, and it would sometimes take HOURS to find out the model number (over the phone - I do remote work all over the place), and then either try to Google the information, or have to call their cable ISP provider to find out how to get into these systems.
With any of these relay service products (Tailscale, etc) - you don’t have to do anything - it just works, and you don’t get into trouble.
You’re correct. QBelt currently runs in traditional server mode, so it requires port forwarding on your router: UDP 443 by default, or another port you set in QVPN Service. It won’t connect without one.
Good news: we’re planning to launch a new VPN service next year that won’t require open any port or use port forwarding. Stay tuned!
