We hopefully all know the 3-2-1 backup rule:
- Three copies of your data
- On two different media
- One copy off-site
It's this last part of the rule that usually trips people up. Nobody wants to pay for online storage until the end of time. While it's convenient, paying for this insurance storage that you may never actually use isn't the most cost effective thing to do. But there's an alternative, which I have implemented as a combination of Hyper Backup and Tailscale. The only requirement is that you have a friend with an internet connection. If you are a Synology NAS user, implementing this solution is quite easy. Other platforms can surely implement a similar strategy, but that'll be left as an exercise to the reader.
Depending on the amount of data you need to back up, and whether you want redundancy within your remote backups, you may see savings after just 1 year. When it comes to the DiskStation device, cheapest is fine. You won't be doing fancy things like video transcoding or high-speed transfers. However when it comes to picking out a disk, two things are important:
- Make sure that you purchase a drive from the seller directly. Amazon and Newegg both have filters that allow this. If you buy from a reseller, you are almost guaranteed to receive a used disk, even if it is listed as "new". Hard disk resellers play games with attempting to make used drives look new.
- Make sure that you get a hard disk that uses conventional (CMR) writes as opposed to shingled (SMR). WD Red Plus drives appear to hit the sweet spot in price, noise, and RAID friendliness. Seagate Ironwolf drives also seem reasonable.
If you plan to get a newer DiskStation for local use and plan to relegate your older DiskStation for remote backups, be sure to set up a new storage pool and manually restore your storage contents (e.g. via Hyper Backup). If you simply pull the drives and put them into your new device, or even follow the default Synology device migration, you may lose the benefits of having a btrfs filesystem (e.g. scrubbing and checksums).
In the past, ensuring network connectivity between two devices required poking holes in firewalls, configuring software, and potentially even creating your own certificate authority. Not so with Tailscale. All you need to do is sign in with your identity provider
You can choose whichever identity provider that you like. All it is doing is proving that you are you.
The Synology platform has a Tailscale package that you can install.
After installation and opening Tailscale, you will be prompted if you would like to add this device to your Tailscale network. After adding both of your DiskStation devices to Tailscale, be sure to edit the TailScale devices to be sure that Disable key expiry is selected. We don't want our devices dropping offline just because of key expiration.
For reasons I cannot fathom, I noticed that even after installing Tailscale and adding it to my network, I did not notice the presence of a tailscale0 network device or associated IP address. To fix this in Control Panel -> Task Scheduler, click Create and then Triggered Task -> User-defined script.
Select User: root, leave the Event: as Boot-up, and in the Task Settings tab paste this into the User-defined script text box:
#!/bin/sh
TS=/var/packages/Tailscale/target/bin/tailscale
# Give DSM package services and networking time to settle.
/bin/sleep 60
# Make sure /dev/net/tun exists. configure-host normally handles this,
# but doing it explicitly makes the boot task more robust.
mkdir -p /dev/net
[ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200
chmod 0666 /dev/net/tun
# Configure Synology host bits for Tailscale.
/var/packages/Tailscale/target/bin/tailscale configure-host
# Restart the Synology package service for Tailscale.
synosystemctl restart pkgctl-Tailscale.service
# Optional: wait and log whether tailscale0 appeared.
sleep 10
ip addr show tailscale0 >/tmp/tailscale-boot-task.log 2>&1
$TS status >>/tmp/tailscale-boot-task.log 2>&1Configure this on both the Synology that you would like to back up, as well as the one that will be your remote target.
Synology Hyper Backup has two different components that we will be using in our solution. The component on the soon-to-be-remote Diskstation system is called Hyper Backup Vault, which can be used as a Hyper Backup target.
Configuring Hyper Backup Vault will require that this device has a storage volume and shared folder already configured, so that we can select the shared folder for the location of the backups. Since we don't particularly want this device to appear on the network where it will live, in Control Panel, go to File Services and in the SMB tab, uncheck Enable SMB service.
Then we have Hyper Backup itself:
This is the client that you will install on the Diskstation to be backed up.
When creating a new backup configuration in Hyper Backup, you will be asked for the backup type. Select Folders and Packages.
At the Select Backup Destination, select Remote NAS Device.
The Backup Destination Settings stage of the wizard is where the configuration of the soon-to-be-remote device will occur.
- Enter the Tailscale IP of the device. This can be obtained in the Tailscale machines page.
- For
Certificate authentication, clickTrust. - Click the
Log Inbutton. - You will likely get an error related to self-signed certificates, and on this dialog click
Browser Login. - Here you can log in to your Diskstation device using your web browser. You may need to click through certificate warnings, which is fine in this case as it's our own Diskstation, accessed on our own network, and it has self-signed HTTPS certificates.
- Once authentication has completed, you can select the name of the
Shared Folderthat we configured on the device.
The Data Backup stage of the backup wizard will ask you what volumes you'd like to back up. You likely want to select the top level item to back up everything. If there is a particular directory you'd like to not be backed up, you can expand and de-select any item as necessary.
The next stage of Application Backup is mostly irrelevant for our needs.
The Rotation Settings stage can be left at the defaults. If the amount of data is close in size to the remote DiskStation device, you may need to lower the amount of retained versions.
In the Backup Settings stage of the wizard, there is a setting that we do want to enable:
Enable client-side encryption. Enable this, and enter a password that we have stored in a safe place, like our password manager.
It's not that we don't trust our generous friend, but rather we will assume that there are secrets in what we are backing up, and once those bits leave our home, we want to ensure that they are not leaked in any imaginable way.
Once we have configured our Hyper-Backup-via-Tailscale job, we can back it up locally to ensure that it works. Simply click the Back Up Now button in Hyper Backup.
This will ensure that future backups once the DiskStation is truly remote will use minimal bandwidth, as only the changes will traverse the network.
Once we are confident in our scheduled backups via Tailscale, we can move our DiskStation to a truly remote location. All we need is a generous friend with an internet connection and a free ethernet port. Depending on where the port is, you may want to consider wireless connectivity so that it can be put in a basement or a closet that has an electrical outlet so that the hard disk activity noise isn't distracting for your friend. Synology DiskStation devices do not inherently support Wi-Fi, so this can be achieved with a travel Wi-Fi router connected to your device. You will need to manually configure this device to connect to your target environment's Wi-Fi, but once this is done, you should be able to have a DiskStation that has Wi-Fi connectivity. Because we are connecting to this device via Tailscale, it doesn't even matter if our router is operating in bridged mode or not. You might be able to get away with powering the travel router from the DiskStation's USB port, but be sure to measure current draw of your device and test reliability.
Once this machine is powered on in a remote location, it should appear in your Tailscale machine list. At this point, your remote backups should operate just like they did locally.
Hyper Backup has a Backup Explorer button for accessing your remote backups.
Clicking this button will prompt you for your password for your backups, which we saved in our password manager. Here we can select any of the dates for any of our directories/files that we have backed up, and we can either restore them to their original location, or we can copy them to a specified location.
Celebrate your new protection against ransomware or complete catastrophe.