Blog / how-to
Setting Up Your First NAS the Right Way (Synology DSM)
A NAS done right on day one: drive choice, real redundancy, per-person accounts, remote access without port forwarding, and a backup for the NAS itself.
A NAS is the best money a small office or a serious home user can spend on their data, and it's also the device people most often set up badly in the first hour and then never touch again. By the end of this guide you'll have a NAS with real redundancy, accounts that make sense, remote access that isn't a security hole, and a backup of the NAS itself. This is written for someone setting up their first one, using Synology's DSM as the running example because that's what most people end up buying; the concepts apply to any brand.
Usual disclaimer: vendors move menus between software releases, so if a screen doesn't match what I describe, search the help for the feature name. The order and the reasoning are what matter.
Plan before you buy anything
Decide what the box is actually for. General file storage and computer backups are one workload. Camera footage is another, and it's hungry. Mixing them on a two-bay unit is how people run out of space in a year.
Buy at least a two-bay enclosure so you can mirror drives, and buy NAS-rated drives (Seagate's IronWolf and WD's Red lines are the common ones), not desktop drives, because a NAS keeps drives spinning in a warm box around the clock and desktop drives aren't warrantied for that life. Then do the capacity math honestly: with mirroring, two 8 TB drives give you roughly 8 TB usable, not 16 TB, and you want to land under 70 percent full on day one. Storage you grow into is cheap. Storage you migrate out of is not.
Build the storage pool with real redundancy
First boot, the setup wizard will ask how to arrange the drives. This choice is close to permanent, so get it right now. In DSM this lives in Storage Manager: you create a storage pool, then a volume on top of it.
Two rules. One, pick a layout that survives a drive failure: a mirror on a two-bay unit, or Synology's SHR on larger units, which also lets you mix drive sizes later and still keeps single-drive redundancy. Never pick the "no protection" or JBOD option to get more space; you're volunteering to lose everything the day one drive dies, and consumer drives do die. Two, if you're offered a choice of file system, take Btrfs over ext4. Snapshots alone are worth it: they're the fastest way to walk back an accidental deletion or a ransomware-encrypted folder.
Create accounts like you mean it
The mistake I see on almost every NAS I inherit: one shared login that everyone in the office knows, with full access to everything. Make a personal account for each user, give each one access only to the shared folders they need, and turn on the Recycle Bin option for every shared folder so a fat-fingered delete is a two-minute fix instead of a restore job.
While you're in there, deal with the admin side: disable the default admin account and use a uniquely named administrator account with a long password instead. The default names are the first thing automated attacks try.
Set up remote access without opening the door
Everyone wants their files from anywhere. The wrong way to get that is forwarding the NAS's management port through your router, which puts the login page of a box holding everything you own on the public internet. Don't do it, even "temporarily."
Use the vendor's relay service instead (QuickConnect, in Synology's case) or, better, a VPN into your network. Turn on two-factor authentication for every account that can log in remotely, and enable the automatic installation of security updates. A NAS is a small Linux server; unpatched, it's a target.
Back up the NAS itself
Here's the line to remember: RAID is not a backup. Redundancy protects you from a dead drive and nothing else. Deletion, ransomware, theft, a power surge, a fire: the mirror faithfully replicates all of them.
So the NAS needs its own backup. Synology's own guidance is the standard 3-2-1 rule, three copies of your data, on two different types of media, one of them off-site, and their Hyper Backup app is the tool for it: schedule a versioned backup to a USB drive you rotate, to a cloud destination, or to a second NAS somewhere else. Versioned matters. A plain sync copies the ransomware along with everything else; versions let you step back to before it happened.
Test it
A setup you haven't tested is a theory. Delete a test file and recover it from the Recycle Bin. Roll a folder back from a snapshot. Restore one file from the Hyper Backup job, because a backup you've never restored from doesn't count. Log in remotely from your phone and confirm 2FA challenges you. Finally, set up email or push notifications so the NAS can tell you about a degraded drive, then send the test notification and confirm it arrives. A mirror with one dead drive that nobody notices for eight months is just a slow single drive.
Where this gets harder than a blog post
This covers the one-time setup, and for a household or a small office it's most of the job. It gets harder when there are real permission structures across departments, camera retention sharing the box with business data, or replication between sites. And the part no wizard handles: drives age, firmware needs judgment before applying, and those health notifications only matter if someone acts on them. Keeping a NAS trustworthy for five years is a watching job, not a set-up job.
If you've bought the hardware and want someone to sanity-check the plan before the data moves in, that's a cheap conversation compared to redoing it later: book a second opinion.