I do not have any firewall rules prohibiting traffic to eliminate this as a potential problem. The firewall can ping both NAS and the gateway is set to the IP for the vlan.
I agree that offsite is best, but think I would be in the same boat with a site to site VPN, right?