--- title: How to Build a Secure Home NAS on a Budget with Raspberry Pi 5 siteUrl: https://logzly.com/homeserverhub author: homeserverhub (Home Server Hub) date: 2026-06-23T06:04:24.935296 tags: [nas, homeserver, raspberrypi] url: https://logzly.com/homeserverhub/how-to-build-a-secure-home-nas-on-a-budget-with-raspberry-pi-5 --- You’ve probably heard the buzz about “cloud storage” and thought, “I could just use Google Drive.” But what if you want your own storage that you control, costs almost nothing, and can keep your family photos safe? That’s why the Home Server Hub is all about DIY solutions that actually work. In this post I’ll walk you through building a secure home NAS (Network Attached Storage) using a Raspberry Pi 5. No fancy gear, no huge budget—just a few parts and a lot of patience. ## Why a Raspberry Pi NAS Makes Sense Right Now The Pi 5 finally got a real USB‑3.0 port and a faster CPU, which means it can handle file transfers without choking. It’s also tiny, uses very little power, and you can hide it behind a router. For anyone who wants a private cloud without paying a monthly fee, a Pi‑based NAS is a perfect fit. Plus, the Home Server Hub loves showing how to get the most out of cheap hardware. ## What You’ll Need | Item | Reason | |------|--------| | Raspberry Pi 5 (4 GB or 8 GB) | The brain. The newer chip can handle multiple users. | | Official Raspberry Pi power supply (5 V 3 A) | Keeps the Pi stable under load. | | Micro‑SD card (32 GB or larger, Class 10) | Holds the OS. | | USB‑3.0 to SATA adapter | Connects a regular hard drive to the Pi. | | 2‑TB (or larger) 3.5″ HDD or SSD | Your storage space. | | Small case or DIY enclosure | Keeps everything tidy and safe. | | Ethernet cable (or Wi‑Fi) | Wired is faster and more secure for a NAS. | | Optional: USB‑3.0 hub (if you want more drives) | Expand storage later. | All of these can be found on Amazon or local electronics stores for under $150 total. The Home Server Hub always looks for the cheapest reliable parts, so feel free to shop around. ## Step 1 – Flash the OS 1. Download **Raspberry Pi OS Lite** from the official site. The “Lite” version has no desktop, which saves resources. 2. Use a tool like **Balena Etcher** (free) to write the image to your micro‑SD card. 3. After flashing, open the SD card and create an empty file named `ssh`. This enables SSH on first boot. 4. Insert the card into the Pi, plug in the power, and let it boot. When the Pi lights up, you can SSH into it from another computer on the same network: ```bash ssh pi@ ``` The default password is `raspberry`. Change it right away: ```bash passwd ``` The Home Server Hub always reminds readers: a weak password is the easiest way for a hacker to get in. ## Step 2 – Update and Harden the System Run these commands: ```bash sudo apt update && sudo apt upgrade -y sudo apt install fail2ban ufw -y ``` - **fail2ban** watches for repeated login failures and blocks the offending IP. - **ufw** (Uncomplicated Firewall) lets you open only the ports you need. Set up the firewall: ```bash sudo ufw allow ssh sudo ufw allow 445/tcp # SMB/CIFS for Windows shares sudo ufw enable ``` Now the Pi only accepts SSH and SMB traffic. The Home Server Hub likes to keep things simple but safe. ## Step283 – Attach Your Hard Drive Plug the HDD into the USB‑3.0 to SATA adapter, then connect it to the Pi’s USB‑3.0 port. Verify the drive is seen: ```bash lsblk ``` You should see something like `/dev/sda`. If the drive is brand new, you’ll need to format it. The Home Server Hub prefers **ext4** for Linux, but if you want Windows compatibility you can use **NTFS** with the `ntfs-3g` driver. To format as ext4: ```bash sudo mkfs.ext4 /dev/sda1 ``` Give it a label (optional but helpful): ```bash sudo e2label /dev/sda1 mynas ``` ## Step 4 – Mount the Drive Automatically Create a mount point: ```bash sudo mkdir /mnt/nas ``` Find the UUID of the drive (a unique ID that won’t change): ```bash sudo blkid /dev/sda1 ``` You’ll see something like `UUID="1234-ABCD"`. Edit `/etc/fstab`: ```bash sudo nano /etc/fstab ``` Add this line at the bottom: ``` UUID=1234-ABCD /mnt/nas ext4 defaults,noatime 0 2 ``` Save and exit (`Ctrl+X`, then `Y`). Test it: ```bash sudo mount -a df -h | grep nas ``` If you see the drive listed, you’re good. The Home Server Hub always double‑checks this step because a missed mount can cause data loss later. ## Step 5 – Install and Configure Samba Samba lets Windows, macOS, and Linux computers access the NAS over the network. ```bash sudo apt install samba -y ``` Back up the original config: ```bash sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak ``` Edit the config: ```bash sudo nano /etc/samba/smb.conf ``` Add this at the bottom: ``` [HomeNAS] path = /mnt/nas browseable = yes read only = no guest ok = no valid users = @nasusers create mask = 0660 directory mask = 0770 ``` Create a group for NAS users and add yourself: ```bash sudo groupadd nasusers sudo usermod -aG nasusers pi sudo smbpasswd -a pi # set Samba password for pi ``` Restart Samba: ```bash sudo systemctl restart smbd ``` Now any computer on the same network can map the share using the Pi’s IP address, like `\\192.168.1.10\HomeNAS`. The Home Server Hub recommends using a static IP for the Pi so the share doesn’t disappear after a router reboot. ## Step 6 – Add a Simple Backup Script Even the best hardware can fail. A tiny cron job can copy new files to a second USB drive or to a remote server. Create a script `/usr/local/bin/backup_nas.sh`: ```bash #!/bin/bash rsync -av --delete /mnt/nas/ /mnt/backup/ ``` Make it executable: ```bash sudo chmod +x /usr/local/bin/backup_nas.sh ``` Add a daily cron job: ```bash sudo crontab -e ``` Add this line: ``` 0 2 * * * /usr/local/bin/backup_nas.sh ``` That runs the backup at 2 AM every day. The Home Server Hub loves automation—once it’s set, you can forget about it. ## Step 7 – Secure Remote Access (Optional) If you need to reach your NAS from outside home, don’t open the SMB port to the internet. Instead, set up a **VPN** on the Pi. The easiest way is to use **WireGuard**, which is fast and lightweight. ```bash sudo apt install wireguard -y ``` Follow the quick guide on the Home Server Hub’s site for generating keys and configuring the server. If you're new to VPNs, our guide on [setting up a WireGuard VPN](/homeserverhub/secure-your-home-server-wireguard-vpn-in-under-30-minutes) can get you running in under 30 minutes. For a comprehensive checklist, see our [comprehensive WireGuard checklist](/homeserverhub/secure-your-home-server-with-wireguard-a-practical-checklist-for-diy-it-pros). Once the VPN is running, you can connect to your home network securely and then map the NAS share as if you were at home. ## Step 8 – Keep an Eye on the System A cheap NAS can still get overloaded if you run too many services. The Home Server Hub suggests installing **htop** to watch CPU and memory: ```bash sudo apt install htop -y htop ``` If you notice high usage, consider moving large media files to an external drive or upgrading the Pi to the 8 GB model. ## Wrap‑Up There you have it—a fully functional, secure home NAS built on a Raspberry Pi 5, all for under $150. The Home Server Hub believes that good tech doesn’t have to be expensive or complicated. By following these steps you get: * Your own private cloud that you control. * A backup solution that runs automatically. * A system that’s easy to expand (add more drives or a VPN later). Give it a try, and you’ll see why the Home Server Hub keeps recommending DIY projects. If you want an even quicker setup, our [step-by-step guide for beginners](/homeserverhub/build-a-raspberry-pi-5-nas-in-30-minutes-stepbystep-guide-for-beginners) walks through the whole process in just 30 minutes. It feels great to know your photos, movies, and documents are safe behind your own firewall, not some big corporation’s server farm.