It only has one USB-port and I would hate to waste on just starting FFP.
I got it working by finding a place where /etc/init/rcS calls somehing on the harddisk..
- I got root acces via telnet to the NSA using the web backdoor.
- copied /zyxel/mnt/sysdisk/sysdisk.img to a linux computer (copy to /i-data/md0/admin/ and FTP from there)
- loopmounted sysdisk.img on Linux computer: mkdir ns; mount -o loop sysdisk.img ns; cd ns
- in sbin/chUrlPrefix.sh I added the line /zyxel/mnt/sysdisk/fun_plug
- unmounted ns, copied sysdisk.img back to the nas in /zyxel/mnt/sysdisk/
- installed ffp in /zyxel/mnt/sysdisk/ (I just used wget from the NAS)