clippings, Portfolio, Tech

How to wrestle your Synology into exposing itself to FTP

For a very long time now, possibly for the entire life of my main personal blog, Lunar Obverse been operating without any automatic backups. I know, shocking. I’m a technology professional; I have multiple backups for my computers and phones, cloud plus local for everything. Having been on the help desk when someone called in asking for help recovering lost files that weren’t backed up, I empathize with the pain of loss.

That changed this weekend. And wow, what a painful process it was.

This blog runs on WordPress, and the recommended program/plugin for backups is Jetpack, though there are several others. The problem with them is that they all cost money, typically a monthly charge. I’m not above paying for a necessary service when it makes sense, but a) I’m currently unemployed, and 2) I have a massive 12 TB Synology on my home network with 5+ TB of storage space empty. I also own a handful of unused domain names, and I understand file transfers and some command line stuff. Surely I can take all these disparate pieces and cobble together an automatic backup?

Turns out I can. But it took a lot of individual steps, and lots of tweaking. I’ll try to go through them in the order it makes the most sense for someone using this article as a how-to.

Step Zero: The Disparate Pieces

As I said, the blog runs on WordPress. It’s hosted on Bluehost, which is fine. They give me command-line and CPanel access to the underpinnings of my site, though for the most part I didn’t need to mess with that. But I did need to find and install the BackWPup plugin. The free version lets me schedule backups, select what gets backed up, and then save or send the backup to a variety of locations, like via email, to Microsoft Azure, S3, or even Dropbox. The one I was most interested in, though, was FTP.

Sure, that’s an antiquated and insecure means of transmitting files over the internet. Maybe rsync would be better? But FTP is simple. Right? It should be simple. I’ll start there.

Step One: Name Games

I had to then figure out the safest way for me to allow an external server to FTP files onto my Synology DS418. My home network is provided by Xfinity, which is my only choice, but some testing showed that they aren’t yet blocking ports to my home network. At least they’re not blocking 20, 21, 22, or the weird random ones FTP uses in passive mode. So I took one of my unused domains, and went into the DSM softare under External Access, and added the domain as a Dynamic DNS entry pointed at FreeDNS. That way, if my IP address changes, the DynDNS service will update it to match the domain name.

This worked almost immediately. I could ping the domain and get my home WAN address. Step one completed.

In DSM, Control Panel > File Services I enabled FTP, FTPS, and SFTP, as well as enabling anonymous FTP under Advanced settings. I also set the default home folder for anonymous FTP to the specific folder I wanted to use for backups.

And even though I did this later in the actual process, here’s where you, the smart reader learning from my mistakes, would go in and make sure that the system internal user that would be accepting anonymous FTP requests had read/write permission to that folder. You set the folder permissions under Control Panel > Shared Folder > , Edit > Permissions. Select “System Internal Users” from the drop-down, and then assign read/write permission to the user “Anonymous FTP/Presto/WebDAV”.

Step Two: Expose Your Network

But I still had to open those ports necessary for FTP. My home cable modem/router supports UPnP and Synology DSM can talk to a router using UPnP to configure ports. The problem I ran in to here was that the number of ports needed exceeded the number available either on Synology or my router. So it took several tries, until I finally manually went into the router settings and opened the ports to TCP/UDP traffic myself. Testing this, again, using a website like showed that at least the FTP ports were open. The upper ones wouldn’t be open until an active connection was in progress.

I set up port forwarding on my router to point traffic to those ports to my Synology. That worked beautifully when testing FTP on my internal network. It failed, though, when I tried to run the backup job across the WAN, on my webhost using the job I’d set up in BackWPup.

This is one area I spent a lot of time on, because the blog backup would fail with some generic error like

WARNING: ftp_nb_fput(): php_connect_nonb() failed: Operation now in progress (115)

or

WARNING: ftp_nb_fput(): Entering Passive Mode (xxx,xxx,xxx,xxx,xxx,xxx)

or

WARNING: ftp_nb_fput(): Can't build data connection: Connection refused

And I started by troubleshooting the ports. I logged in to my Synology via ssh with root, and ran tcpdump. That all seemed to work. Looking at the logs, it looked like the connection wasn’t the problem; the plugin was connecting just fine. It just failed when trying to send the files over.

I’ll spare you all the dead ends I went down and cut to the fix: I had to disable SSL-FTP in the plugin. Turns out, Synology doesn’t like that. Or, at least, I couldn’t figure out how to make that work. The files only transferred when that was off on the client end. And believe me, I tried every other setting on both ends. C’est la vie.

Final Thoughts

There are still some quirks of Synology’s implementation of FTP that I want to point out.

  • When I set the folder for backups on the client end, I had to include a leading / on the name. Otherwise, new folders would be created instead of Synology recognizing that the client is putting the files in an existing folder.
  • I messed up when trying to use Let’s Encrypt to create a certificate to secure FTP and SFTP and ssh connections to my Synology. Maybe that’s why explicit SSL-FTP isn’t working? But since I exceeded the number of requests I can make of Let’s Encrypt, until that resets or I figure out how to delete the several I created and deleted, I can’t fix that. That’s a long story.

But it’s all working. I now have twice-weekly full backups of the 21 years of posts I’ve tossed up onto the internet for y’all’s entertainment. A safety net. And then, since I’ve discovered a new hammer, I used it to nail down backups for my neice’s new travel blog, April Taking Off, since I don’t want her to lose her work, and she doesn’t really have anywhere to store offsite backups. (Also you should check out her travel posts, she’s great!)