All Products
Search

This Product

    File Storage NAS:On-premises access to Apsara File Storage NAS via a NAT gateway

    Document Center

    File Storage NAS:On-premises access to Apsara File Storage NAS via a NAT gateway

    Last Updated:Jun 21, 2026

    If data transfer security is not a high priority, you can use a NAT Gateway to access Apsara File Storage NAS from an on-premises data center over the public internet.

    Create a file system and mount target

    1. Create a file system. For more information, see Create a General-purpose NAS file system.

    2. Add a VPC-type mount target. For more information, see Add a mount target.

    (Optional) Configure a whitelist

    Apsara File Storage NAS uses permission groups as whitelists to control access from specific IP addresses or CIDR blocks.

    1. Log on to the NAS console.

    2. Create a permission group.

      1. In the left-side navigation pane, choose File System > Permission Group.

      2. In the top navigation bar, select a region.

      3. On the Permission Group page, click the General-purpose NAS or Extreme NAS tab, and then click Create Permission Group.

      4. In the Create Permission Group dialog box, configure the parameters.

        For more information about the parameters, see Key parameters.

        For example, set Name to VPC-01, select VPC for Network Type, enter a Description, and then click OK.

    3. Add a rule to the permission group.

      1. Find the permission group that you created. In the Actions column, click Manage Rules. Then, click Create Rule and configure the rule parameters.

        For more information about the parameters, see Manage rule parameters.

        In the Create Rule dialog box, configure Authorized IP Address, Access, User Permission, and Priority, and then click OK.

      2. Click OK.

    4. Select and apply the permission group.

      1. Go to the File System List page. Find the target file system and click Manage.

      2. On the Mount Targets page, find the mount target, click Modify Permission Group in the Actions column, and select your permission group.

      3. Click OK.

    Configure a NAT gateway

    After completing these steps, you can mount the Apsara File Storage NAS file system on any internet-connected Windows or Linux computer to transfer files.

    1. Log on to the VPC console.

    2. Create a NAT Gateway. For more information, see Create a public NAT gateway.

      Note

      The NAT Gateway must be in the same VPC as the Apsara File Storage NAS file system.

    3. Associate an EIP with the NAT Gateway. For more information, see Apply for an EIP.

    4. Create a DNAT entry. For more information, see Create and manage DNAT entries.

      The following table describes the key parameters.

      Parameter

      Description

      Select EIP

      The public IP address of the EIP that you created.

      Select Private IP Address

      Select Manually Enter and enter the IP address of the mount target.

      You can run the ping command on an ECS instance in the same VPC to obtain the IP address of the mount target. Example:

      ping 0dc404****-****.cn-hangzhou.nas.aliyuncs.com

      For more information about mount target addresses, see Manage mount targets.

      Port Settings

      • Specific Port: (Recommended)

        • NFS file system:

          • Public Port: 111, 2049

          • Private Port: 111, 2049

          • Protocol: TCP

        • SMB file system:

          • Public Port: 4456

          • Private Port: 445

          • Protocol: TCP

      • Any Port: (Not recommended)

        All requests to the EIP are forwarded to the Apsara File Storage NAS file system. We recommend that you specify specific ports.

    Mount the file system

    NFS file system

    1. Install an NFS client. For more information, see Install an NFS client.

      If an NFS client is already installed, skip this step.

    2. Mount the NFS file system. For more information about mount command parameters, see Parameters.

      mount -t nfs4 <public-ip-address>:/ /mnt

      • <public-ip-address>: The public IP address of your EIP.

      • /mnt: The local mount point.

    SMB file system

    1. Start the Workstation service and the TCP/IP NetBIOS Helper service. For more information, see Enable the Workstation and TCP/IP NetBIOS Helper services.

    2. Check whether port 445 is in use on your local machine.

      • Run the following command:

        netstat -ano | findstr ":445"

      • If output similar to the following is returned, port 445 is in use.

        TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    [::]:445               [::]:0                 LISTENING       4

        In the output, 4 is the process ID (PID) of the program that is using port 445.

      If port 445 is in use, run the following command in Command Prompt, or press Win+R, enter services.msc, and then check the status of the Server service in the Services window.

      sc query LanmanServer

      • If the Server service is RUNNING, run the following command to stop and disable it. Alternatively, open the Services window (press Win+R and enter services.msc) to manually stop and disable the service. After disabling the service, restart your computer and make sure that port 445 is no longer in use.

        net stop LanmanServer && sc config LanmanServer start= disabled

      • If the Server service is in the STOPPED state, or if port 445 is still in use after you restart your computer, you can run the following command to check which program is using port 445. After you confirm that the program can be safely stopped, terminate it and restart your computer.

        tasklist /FI "PID eq 4"

        In the command, replace 4 with the PID returned by the netstat -ano | findstr ":445" command.

    3. Configure local port forwarding

      Port 445 is the default port for SMB and is considered high risk. ISPs block it by default. If your on-premises data center accesses Apsara File Storage NAS over the internet by using a NAT Gateway, you must configure local port forwarding.

      On your local Windows client, use netsh to forward local port 445 to a non-445 port (4456).

      netsh interface portproxy add v4tov4 listenaddress=<local-ip-address> listenport=445 connectaddress=<public-ip-address> connectport=4456

      In this example, 192.168.xx.xx is the IP address of the local server (you can also use 127.0.0.1), and 100.10.xx.xx is the public IP address that is generated when you create an EIP. Replace these placeholders with actual values.

      Note

      If you set the public port to 445 or Any Port for the DNAT entry, you do not need to configure local port forwarding. You can directly mount the file system by using the public IP address of the EIP.

    4. Mount the SMB file system. For more information, see Mount an SMB file system.

      net use D: \\<local-ip-address>\myshare

      • D is the drive letter to which you want to mount the file system on your Windows operating system. Replace it with the actual drive letter.

      • <local-ip-address> is the IP address of your local server. You can use 127.0.0.1.

      • myshare is the name of the SMB share. Do not change this name.

    Verify the mount

    NFS file system

    Run the mount -l command. The following output indicates that the mount is successful. After the mount is successful, you can perform read and write operations.

    <public-ip-address>:/ on /mnt type nfs4 (rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=xxx,local_lock=none,addr=<public-ip-address>)

    SMB file system

    In File Explorer, check whether you can access the SMB file system. If you can, the file system is mounted, and you can now read from and write to it.

    Note

    If the mounted drive letter is not found, you can enter \\192.168.xx.xx\myshare in File Explorer to access the share. In this path, 192.168.xx.xx is the IP address of the local server. Please replace it with the actual value.

    The myshare folder contains two files: fio-2.18-x64.zip and fiotest.txt.