gameboy1024 Thanks. I already use DDNS, but after a factory reset I assume a conventional VPN server running on the NAS would become unreachable because the router loses its NAT/port-forwarding rules, correct? DDNS could still point to the public IP, but there would no longer be an inbound rule forwarding the VPN port to the NAS.
In that case, running something like Tailscale directly on the NAS seems much more robust, since it establishes outbound connections and does not depend on manual port forwarding (Ive never used it before). As long as the NAS still has valid LAN connectivity and Internet access after the router resets, I would expect Tailscale to reconnect automatically.
Have you tried anything like this after one of these unexpected factory resets?
One concern I still have is the NAS IP configuration. My NAS currently uses a static IP. After a factory reset, the router’s default DHCP pool would be restored, so theoretically it could assign the NAS’s static address to another DHCP client, causing an IP conflict. And if the factory-default LAN subnet differs from my current one, the NAS could lose connectivity altogether.
So Tailscale seems like a good workaround for losing port-forwarding, but it still depends on making the NAS network configuration resilient to the router returning to factory defaults.