My neighbor lost twelve years of family photos to a burst pipe that soaked the shelf his NAS sat on. He had backups. Both drives were on the same shelf.
That is the whole problem in one sentence. A backup that lives in the same building as the original is not really offsite, and offsite is the only copy that survives fire, flood, theft, or a wave of ransomware that walks through every device on your LAN.
The good news: you do not need a monthly cloud bill to fix this. A second NAS parked at a relative's house, syncing quietly over the internet, gives you a genuine third copy for the price of the hardware and a bit of electricity. Here is exactly how I set mine up, and the traps I hit along the way.
What you actually need before you start
You need two NAS units. They do not have to match. My main box is a Synology DS920+ and the offsite unit is an older DS218+ my brother keeps in a spare room forty minutes away.
You need a home you trust to host the second unit, ideally with a wired connection and a router someone will not unplug. And you need upload bandwidth, which is the part most people underestimate.
One more thing. This is the offsite leg of a proper 3-2-1 setup, not a replacement for your local backup. You still want a copy on your main NAS, a local backup, and then this remote one. Backblaze has a clear plain-language explainer on the 3-2-1 backup strategy if you want the reasoning.
Step 1: Prep the second NAS at the remote site
Take the offsite unit to its new home first and get it fully working there. Update the operating system, create drives, and set an admin account with a strong password you store in a manager, not in your head.
Give it a fixed local IP on the host's router so it does not wander after a power cut. On Synology, that is Control Panel, Network, Network Interface, then edit the LAN and set it manually.
The first time I did this I skipped the fixed IP. Two weeks later the host rebooted their router, the NAS grabbed a new address, and my nightly job failed silently for eleven days before I noticed.
Decide how the two boxes will talk
You have two realistic options for reaching the remote NAS across the internet. The safe one is a site-to-site VPN. The lazier one is opening a single port with strong encryption.
I strongly prefer the VPN because it keeps the remote NAS off the public internet entirely, which matters more every year as automated attacks scan for exposed devices.
Step 2: Build the tunnel between the two locations
The cleanest setup is a VPN between the two routers, so both NAS units behave as if they sit on one network. If the host router supports WireGuard or OpenVPN, use it. Many do not, so the practical fallback is running the VPN on the NAS itself.
Synology offers a free package called VPN Server, and there is a community WireGuard package that is faster and simpler to keep alive. QNAP has QVPN built in. Point the remote router to forward the VPN port (WireGuard defaults to UDP 51820) to the remote NAS, and connect your home side as a client.
Once the tunnel is up, ping the remote NAS by its VPN IP from your home NAS. If that reply comes back, the hard part is over.
Step 3: Choose the replication tool
Now pick the software that moves the data. On Synology the two main choices are Hyper Backup and Snapshot Replication, and they solve slightly different problems.
| Tool | Best for | Versioning | Recovery style |
|---|---|---|---|
| Hyper Backup | File and folder backups with many restore points | Yes, deep history | Restore files or whole folders |
| Snapshot Replication | Fast failover of shared folders and iSCSI | Yes, snapshot based | Switch over to the copy quickly |
| rsync task | Cross-brand or Linux targets | No by default | Plain file mirror |
For most home users backing up photos, documents, and media to a second Synology, Hyper Backup is the right call. It keeps versions, so if ransomware encrypts your files and the change syncs, you can still roll back to a clean copy from last week. Synology documents the tool in its Hyper Backup help pages.
Backing up to a QNAP or a plain Linux box instead? Use an rsync task, and add your own versioning by keeping snapshots on the receiving side.
Step 4: Create the backup job
Open Hyper Backup on your home NAS and add a new task. Choose the remote destination type. If you built the VPN, pick rsync and point it at the remote NAS by its VPN IP address and rsync account.
Select the folders that actually matter. Do not back up everything by reflex. My job covers photos, documents, and a small pile of scanned paperwork, which is about 900 GB. I deliberately leave out re-downloadable movies, because pushing 4 TB of films over a home upload line is a waste of days.
Turn on client-side encryption and write down the key somewhere safe. This matters because your data is now sitting in someone else's house, and if that unit is ever stolen you want the thief holding an unreadable brick.
Step 5: Set retention and schedule
Configure how many versions to keep. I use Synology's Smart Recycle, which thins older restore points automatically and keeps roughly the last 30 daily versions plus a spread of weekly ones. That gives real protection against a slow-burning problem you notice late.
Schedule the job to run overnight, when neither household is streaming. I run mine at 2am. Daily changes are usually a few gigabytes, so it finishes in well under an hour once the giant first sync is done.
Let that first full backup run to completion before you trust anything. On my line the initial 900 GB took about four days. If your host has decent upload, do the very first sync on the same LAN before moving the box offsite, then relocate it and let daily changes trickle over the internet.
Step 6: Test a restore before you rely on it
A backup you have never restored is a rumor. Once the first sync finishes, actually pull a file back.
In Hyper Backup, open the task, browse the remote versions, pick a folder, and restore it to a scratch location on your home NAS. Confirm the files open and the dates look right.
Then simulate the scary case: pretend your main NAS is dead. Can you reach the remote unit's data on its own, decrypt it with your stored key, and get files off it? If the answer is yes, you have a real offsite backup. If you are not sure, you do not yet.
Keeping it healthy for years, not weeks
The failure mode with remote backups is not setup, it is silent drift. Jobs stop, and nobody watches the box that lives in another town.
Turn on email or push notifications for backup success and failure so a broken run pings your phone. I also glance at the task list once a month and check the timestamp of the last good backup. Thirty seconds, and it has caught two dead jobs for me over three years.
Swap a fresh drive into the remote unit every few years, keep both boxes on the latest OS for security patches, and make sure your host knows never to factory-reset the friendly gray box in the corner. Do that, and the copy at your brother's place quietly earns its keep the day your own house has a very bad morning.
Frequently asked questions
Do both NAS units have to be the same brand or model?
No. If both are Synology you get the smoothest experience with Hyper Backup and versioning built in. To back up a Synology to a QNAP or a Linux box, use an rsync task instead and add snapshots on the receiving side for version history.
Is a VPN really necessary, or can I just open a port?
You can technically forward a single encrypted port, but a site-to-site VPN keeps the remote NAS off the public internet entirely, which is far safer against automated attacks. WireGuard is fast and easy to run directly on the NAS if the host router does not support it.
How long does the first backup take?
It depends almost entirely on your upload speed. On a 20 Mbps upload line, roughly 1 TB takes about 5-6 days. Daily changes afterward are usually a few gigabytes and finish in under an hour, so plan for a slow start and easy maintenance.
What happens if the remote NAS is stolen?
With client-side encryption turned on in Hyper Backup, the thief gets an unreadable set of files without your key. That is exactly why you enable encryption and store the key in a password manager, never on the device itself.
How much does this cost to run compared to cloud backup?
After the hardware, your ongoing cost is electricity, roughly a few dollars a month for a small NAS left on. There is no per-terabyte cloud fee, which is why a second NAS pays for itself within a year or two versus paid cloud storage for large photo and media libraries.
How often should I check that it is still working?
Enable email or push notifications for backup failures so problems reach you immediately. On top of that, glance at the task list once a month to confirm the last successful backup timestamp is recent. Silent job failures are the number one way remote backups quietly die.
