Generally should be more performant than SMB due to it being less chatty. NFSv3 is the standard workhorse, while NFSv4 is slightly chattier but with more stable port number (for firewall ACL), and other features like link aggregation.

Authentication is performed either with an external Kerberos ticket server (with encryption baked in as well), or through a DNS/IP whitelist from the NFS server itself, i.e. AUTH_SYS (Synology DSM does not support NFS-over-TLS, so will need to tunnel over VPN if needed).

1. sys auth with no mapping: the client computer determines authorization via UID/GID. Typically one would set a consistent GID on the client and the server. Use when client computer has multiple users.
2. sys auth with squashed mapping (typically admin): any of the users on the client does not require explicit authorization. Use when client computer itself is trusted.
3. Kerberos auth: mapping handled on the server. Use in a production system.

Some steps to bootstrap a Kerberos server:

• Synology Directory Server for active directory. For example, domain ad.EXAMPLE.COM, workgroup AD. DNS server to perform query forwarding for ad.EXAMPLE.COM.

Abandoned...