Photos shot on a trip don't need an external drive shuffle at the hotel desk anymore. They land on your home NAS while you're still out, and you can flip through them on your phone from a café before the flight back.

Who this is for

A photographer in their 30s shooting on the Sony α7 IV for both work and travel
Someone with a single-bay NAS (e.g. an old WD My Cloud Gen1) sitting unused at home
Cloud-storage subscriptions feel like waste, but external drives alone feel risky
Words like "router port forwarding" or "VPN client config" sound exhausting

This post is the big-picture overview of a setup where the camera silently backs up to the NAS and the photographer can browse the NAS from anywhere. The exact commands and shell scripts live in a GitHub repo at the bottom.

Three scenarios

1) Pressing the shutter at home Direct FTP upload to the NAS over the same WiFi. No internet round-trip.

2) Pressing the shutter at a hotel abroad The shot uploads via LTE / hotel WiFi to a tiny cloud VM (Oracle Cloud Free Tier, Hetzner, fly.io…). The VM forwards it to your home NAS within ~1 minute.

3) Opening the NAS from a café phone Type the domain → enter a 6-digit OTP from email → every folder on the NAS is right there. Pass once, and you sail through for 24 hours.

All three with zero open inbound ports on the home router, no PC kept awake, and only the camera + NAS doing real work.

The big picture

[Camera]   ──── home WiFi ────►  [NAS vsftpd]
   │
   └──── LTE / foreign WiFi ─►  [Cloud VM vsftpd] ─── rsync ───►  [NAS]

[Browser (anywhere)]  ─── HTTPS ───►  [Cloudflare Edge]
                                          │
                                  [Cloudflare Access OTP gate]
                                          │
                                ─── outbound tunnel ───►  [cloudflared on the NAS]
                                                                       │
                                                                       └──►  [WD UI]

Home (LAN)Camera → NAS vsftpd, direct

On the roadCamera → cloud VM → rsync to NAS

Anywhere viewingBrowser → Cloudflare Access OTP → tunnel → NAS

In one sentence: the NAS never opens an inbound port. Every external connection rides on a tunnel that the NAS itself opened outward.

How is it built? (3 phases)

1. On home WiFi — camera ↔ NAS direct FTP

Create a per-camera user on the NAS (e.g. camera-a7m4) with write access to a single folder, enable vsftpd, then point the α7 IV's FTP Server 1 at the NAS's LAN IP, port 21, Passive ON. Done.

Plain FTP — keep it strictly LAN-only. Never expose port 21 publicly.

Camera-side setup checklist

These items were verified against the α7 IV ↔ WD My Cloud Gen1 pair in real operation.

Item	Value / Note
Camera menu path	MENU → Network → Transfer/Remote → FTP Transfer Func. → Server Setting
Secure Protocol	Off (Gen1 supports neither FTPS nor SFTP)
Passive mode	On
Directory format	Standard — let the NAS handle date-based foldering separately
User isolation	Do not reuse the admin account. The dedicated `camera` user gets write access to a single share only.
Public access on the share	Off — authentication required
After a camera factory reset	The FTP password is wiped. Keep it in a password manager and re-enter it on the camera.
EPSV behaviour	The NAS replies `229 Entering Extended Passive Mode`; the camera handles this automatically.

Do not try SFTP for the camera path. The α7 IV does not speak SFTP. On WD My Cloud, SSH only accepts root, so isolating a camera-only SFTP user would require editing sshd_config in the system partition — a change that can be reverted by firmware updates or leave the box in an inconsistent state. The combination that works is plain FTP on the LAN (kept private) plus FTPS on the cloud staging VM (encrypted over the open internet).

2. On the road — camera ↔ cloud VM ↔ NAS

A small always-on VM (Oracle Cloud Always Free works great) gets vsftpd; the α7 IV's FTP Server 2 points there. (If your camera supports FTPS, slap a Let's Encrypt certificate on it for encrypted upload.)

Files staged on the VM are pulled home by the NAS over SSH + rsync every minute. Critically, the NAS pulls outbound — no inbound hole at home.

3. View the NAS from anywhere — Cloudflare Tunnel + Access

Run cloudflared on the NAS itself (ARMv7 binary, ~50 MB RAM). The NAS opens an outbound QUIC tunnel to Cloudflare. Route a hostname through that tunnel to the WD UI, and gate the whole thing with Cloudflare Access (one-time PIN to your email).

URL: https://<your-subdomain>.<your-domain>
Auth: 6-digit OTP to your email (24-hour session)
Auto-start on NAS boot + 5-minute watchdog (two cron lines)

What you get

Item	Result
Open inbound ports on home router	0
Always-on PC required	None (just the NAS)
Monthly cost	$0 beyond the domain (Cloudflare Zero Trust free, Oracle Always Free)
External authentication	Email OTP — without your email, no one can pass the gate
When the camera is away from LAN	Auto-falls-back to the cloud VM → arrives at the NAS within ~1 min
Single point of failure for new shots	Neither — both paths run independently, and a cron watchdog resurrects the tunnel if it crashes

Pitfalls people commonly hit on first run

"Password change required but no TTY" when rotating the NAS root password → just SSH in once and run passwd interactively. Automated runtimes need a real PTY (wexpect / pexpect).
Domain works, but 403 Forbidden /UI → WD My Cloud's Apache restricts /UI to LAN IPs by default. Replace ${LOCAL_NET} with Require all granted in wdnas-ui.conf (one sed line, full instructions in the repo).
OTP email never arrives → 90% of the time it's in Gmail's Promotions tab. Search from:cloudflareaccess.
VM disk fills up → use rsync's --remove-source-files and a weekly safety net: find /staging -mtime +7 -delete.

What this recipe deliberately does not do

❌ Expose SMB/FTP to the public internet
❌ Open inbound router ports
❌ Wake-on-LAN trickery (the NAS is the always-on host)
❌ Force you to run a Tailscale/WireGuard client on every device

Detailed commands and configs

The full English step-by-step (9 steps, including cloudflared install, the Apache patch, and the cron registration), every gotcha, and the end-to-end verification checklist live in this GitHub repo:

👉 github.com/pola2025/a7m4-wd-mycloud-connection

Closing thought

Once it's set up, you barely think about it. The distance between taking a photo and knowing it's safe somewhere shrinks to nothing — and that lightens the act of pressing the shutter. On the road, in the studio, anywhere.

댓글

댓글 작성