manwichmakesameal
Basically when you make a new group or user, make sure that the NUMBER that it’s using matches whatever you’re using on your export. So for example: if you use groupadd -g 5000 nfsusers just make sure that whenever you make your share on your NAS, you use GID of 5000 no matter what you actually name it. Personally, I make sure the names and GIDs/UIDs are the same across systems for ease of use.
I’m 100% sure that your problem is permissions. You need to make sure the permissions match. Personally, I created a group specifically for my NFS shares then when I export them they are mapped to the group. You don’t have to do this, you can use your normal users, you just have to make sure the UID/GID numbers match. They can be named different as long as the numbers match up.
This is also dependent on who is running the server and how it’s set up. If it’s the matrix.org you’re using, I couldn’t tell you. If it’s someone hosting/you’re self-hosting, you need a STUN server for traversing NAT. It’s not part of the default Synapse docker install and I’m not sure about non-docker installs.
Having your ISP do your port forwarding seems alien to me as that’s not the norm where I am. Since it seems like a standard thing where you are, you may run the risk of another ISP doing the same thing. Personally, if the price is right, I’d take the latency hit and get a VPS and route all inbound traffic through that via wireguard.