First, a disclosure: Yuxinan is a multi-site networking product made by Siwenlide, and we are a stakeholder in this article. Many of the answers that turn up when you search this question online are still stuck ten years in the past: port forwarding, turning on Remote Desktop, setting up FTP — with these approaches, the question today is not “do they work” but are they secure. The conclusion in one sentence: to access the head office NAS and ERP, there is only one secure approach — expose nothing to the public internet; instead, let the branch store and home computers “enter the head office intranet”. Once networked, NAS and ERP are still accessed at their original intranet addresses, exactly as if you were in the office.
1. Three old approaches that “seem to work” — today they are three pitfalls
- Port forwarding (exposing NAS/ERP ports to the public internet): it requires a public IP address (broadband providers today basically no longer give one out), and worse, within minutes of being exposed it will be picked up by internet-wide scanners. NAS is the number one target of ransomware, and exposing an ERP port is like leaving the company’s account books on the side of the road. Least recommended.
- Direct Remote Desktop (opening port 3389): this is the most heavily brute-forced port there is, bar none. A weak password plus public RDP = waiting to have your files locked.
- Using cloud drives/WeChat to send files instead: file versions get messier with every transfer, and ERP simply cannot be used this way — the ERP client needs a real-time connection to the database, not file transfers.
The common root problem with all these approaches: they “expose things outward” rather than “let people in”. The direction is backwards.
2. The right approach: expose nothing, and let visitors “enter the intranet”
The approach of the new generation of networking (the route Yuxinan takes): place one networking terminal at headquarters, one at the branch, and install a client on home computers; it uses direct P2P connections and automatically falls back to the cloud relay if a direct connection cannot be established — no public IP needed, no port forwarding, no router configuration changes (the principles are covered in Does multi-site networking need a public IP?). A few minutes later:
- NAS is still at the same address starting with 192.168 as before; open it on your home computer and you can reach it, just as if you were sitting in the office;
- The ERP client connects directly to the head office server with no changes to any ERP settings — it thinks you are on the LAN, because after networking you really are on the LAN;
- There is no exposure surface on the public internet at all; scanners have nothing to latch onto.
3. Different roles, different ways to connect
| Who needs access | How to connect | Notes |
|---|---|---|
| Branch store (the whole store) | Place one networking terminal at the branch | Every computer in the store can access headquarters, covering both the POS and surveillance (see the POS article, the surveillance article) |
| Individuals at home or travelling | Install the client on their computer and assign accounts per person | A laptop can connect back to headquarters wherever it goes; ERP, NAS and printers all work |
| A quick check on a phone | Install the app on the phone to connect | Enough for checking inventory or approving a document; for heavy work a computer is still more comfortable |
4. The security balance sheet: how it differs from port forwarding
- Exposure surface: with port forwarding, “the front door is on the public internet and anyone can come and knock”; with networking, “there is no door on the public internet at all” — only members pulled into the group can reach it;
- Transmission: all networking traffic is encrypted end to end;
- Permissions: access control can restrict “the branch to only the network segment where NAS and ERP reside”, isolating the office network and the finance server from each other;
- Staff changes: when an employee leaves, simply remove their account in the admin console and it stops working immediately — no need to change passwords everywhere as with port forwarding.
5. Is the speed fast enough
With a direct P2P connection, traffic runs between the two endpoints without passing through a third party, and the speed depends on the broadband at both ends — transferring large files and editing documents on the NAS online are both fine; when hole punching fails and traffic goes through the cloud relay, bandwidth depends on your plan (2 Mbps on the free version), and small-packet operations such as entering orders in ERP or checking inventory remain smooth, while large file transfers are best moved to a higher tier. A full breakdown of stability is in Is multi-site networking stable?.
6. Implementation steps (half a day’s work)
- Place one networking terminal at headquarters and power it on to register;
- First use the free version to get “headquarters + one access point” working: the Yuxinan free trial version is permanently ¥0 and activated on registration, and includes a quota of 2 terminals (the quota covers hardware);
- On a home computer, access the NAS’s intranet address and open the ERP client — if it connects, the approach is proven;
- Then scale up according to the number of stores and users; the tiers and limits are covered in what the free version can do and where it falls short and the cost breakdown of networking for chain stores.
Frequently asked questions
Q: The ERP vendor says it “must be on the same LAN” — does networking count?
A: Yes. After networking, the branch and headquarters are one LAN, and what ERP sees is a direct connection to an intranet address. This is the essential difference between networking and traditional remote tools — traditional tools “operate a computer remotely”, whereas networking means “your computer is on that network”.
Q: The NAS is a Synology/QNAP — does that matter?
A: No. Networking solves whether the network is reachable; it has nothing to do with the NAS brand, and you access it exactly as you did before.
Q: Home broadband and headquarters broadband are with different carriers — will it lag?
A: Hole punching across carriers has a slightly lower success rate, so traffic may go through the relay. Over the relay, checking documents and transferring small files are fine; if you transfer large files often, consider a higher tier. Testing the free version for a week first is the most reliable way to judge.
Q: Is it safe to install the client on employees’ phones?
A: The client issues accounts per person, and the admin console records who connected and when; if a phone is lost, removing that account in the console disables it immediately — far safer than port forwarding, where “the password is known to everyone if you never change it”.
Prices and bandwidth for the Yuxinan free and paid versions are subject to the public pages on its official website as of October 2026.
