[jjoonathan]

Yes.

Source: someone who just declared Dropbox critical despite having invested an ungodly amount of time into first an old PC with ubuntu and nextcloud and now my NAS box which I love dearly but is a complete dumpster fire even though I'm tech-literate enough to engage with the enormous number of low-level decisions it regularly throws at me.

It gets new security vulnerabilities every damn week so you can't just turn on the public-facing web services. If you still want those -- and if you want it to replace cloud services, you do -- you'll need to configure the VPN, which is an enormous hassle on both client and server. Also, sometimes there's an update and it just stops working until you pay attention to it. Ditto for network shares, but I think the problem there is in Android / iOS network filesystem implementations. It often Just Doesn't Work, and then I try dropbox and it Just Works. Even when the NAS network share does work, managing permissions is a nightmare, even for simple setups, ditto storage, ditto the VM that theoretically runs nextcloud but in practice gets taken down by an update on a regular basis.

For my next NAS I'm going to try Synology, but they depend on many of the same open source projects that I've seen Just Not Working on the QNAP side, so I'm not terribly hopeful.

Nextcloud devices look promising in the long run but the market hasn't shaken out yet so you're either going to have to invest tons of time in research or you're going to have to do trial and error. In both cases you'll have to make up for deficiencies.

https://nextcloud.com/devices/

[aborsy]

I agree without vpn nas security can be poor. There are a lot of open ports handled by obscure applications.

What would be the difficulty with a vpn? Synology has VPN on device. It seems to be a matter of enabling it. Routers also typically include vpn functionality.

[jjoonathan]

Enabling it is just the start. Then you have to worry about permissions. Then you have to add the configuration to all of your devices. Then you have to hope that the protocol choices you made are compatible. When they aren't, you have to experiment. Then an update breaks them and you have to scramble to find compatible versions/protocols or just live with it being broken until latest is fixed. Even when the network connectivity is working, you aren't done. You have to hope that the subnets and split-horizon DNS allow it to coexist with the other VPNs you have to use. If not, you have to play the VPN hopping game every time you want to use your site. Hope you don't need simultaneous connections! Then you have to worry about apps that complain (or, worse) when underlying storage appears/disappears due to changing networks. Then you have to worry about apps that don't like your DNS (".lan isn't a real TLD, better do something stupid"). Oh, right, you have to setup private DNS -- which your router might have done automatically (which is why you have .lan), but which you might need to reconfigure to workaround the aforementioned problems. Then you have to worry about apps starting to migrate to DoH.

So no, it's not easy, it's a lightweight IT gig just to connect to your damn server! This is one of those tasks that I regularly see highly capable techies underestimate because of some combination of getting lucky on a small number of deployments and/or their brain engaging in protective amnesia to protect them from living with the scars of having wasted big chunks of otherwise perfectly good life fiddling with VPN settings.

Being able to serve resources on the open internet is extremely important and NASes clearly aren't up to the task yet.