How to Use a VPN with Synology NAS

A Synology NAS is a small server that sits in a cupboard and holds photos, documents, backups and sometimes a few apps. Once people start thinking about privacy or remote access, the VPN question shows up in a confusing way. "I want a VPN on my NAS" can mean three different things, and each needs a different setup. Pick the wrong one and you either gain nothing or accidentally leave a door open.

This article sorts the three cases, explains the settings that matter on Synology's DiskStation Manager (DSM), and gives a practical order of work. It does not name or endorse any VPN company, and it does not promise that every VPN login will work in every NAS profile. Menu names change between DSM versions, so treat the steps as a guide to what to look for rather than a click-by-click script.

Which of the three setups do you actually want?

Start by saying out loud what problem you are solving.

Goal	The NAS is a...	What it means
"My NAS downloads or syncs over the internet and I want that traffic protected"	VPN client	The NAS connects out to an outside VPN server and sends some or all of its internet traffic through it
"I want to open my files from a hotel or office without exposing the NAS to the world"	VPN server	The NAS accepts connections from your authorised devices and gives them access to your home network
"I want my laptop protected on public Wi-Fi, and I also want to reach the NAS"	Neither	A VPN app runs on the laptop; the NAS stays as it is, and you reach it by a separate route

Most confusion comes from mixing the second and third rows. A commercial VPN app on your laptop protects the laptop's traffic. It does not give your laptop a way into your home network, and in some setups it actually makes reaching local devices harder. Reading self-hosted vs commercial VPNs first helps you see why those are different products with different jobs.

Setup A: the NAS as a VPN client

This is the case where the NAS itself should send its traffic through an outside VPN server. People do it when the NAS runs download tools, indexers, containers or sync tasks and they would rather those connections do not show their home address.

DSM includes a VPN client feature. In recent versions you find it under Control Panel, then Network, then Network Interface, where you can create a VPN profile. You are offered a few connection types, and you import or enter the details that your provider publishes. For OpenVPN-type profiles you typically upload a configuration file and enter the username and password. The wording varies with your DSM version.

Steps that work in most cases:

1. Check what your provider supplies. A profile for DSM needs a connection file or a set of server details. The provider's own documentation, or for XPASS the setup information on your My Pass page, tells you which connection methods exist. If nothing matches what DSM accepts, a NAS profile is not an option for that service, and you should say so rather than guessing.
2. Create the profile in the Network Interface area and fill in the username and password from the provider. Do not reuse your website email.
3. Look for the setting that controls routing. Some versions offer an option to send all traffic through the remote network. If you switch it on, nearly everything leaves through the tunnel. If you switch it off, only traffic for the VPN's own network goes through, which is not what you want here.
4. Connect and confirm the NAS shows a connected state.
5. Test from the NAS side. Use a task that reveals the outbound address, such as a command-line check or a download tool's status page, and confirm the address is not your home one.
6. Test local access. Open a file from your computer over the home network. If it fails or becomes slow, local traffic is being pulled into the tunnel and you need to adjust the routes.

A client profile on a NAS is often an all-or-nothing switch. That is where containers come in: some users run a VPN client inside a container for one specific app, so only that app's traffic goes through the tunnel. This is more advanced and depends on your container setup and the provider's files. If you go that route, take it slowly and keep a plain backup of the NAS settings first.

Setup B: the NAS as a VPN server

If your goal is to reach your files and home devices securely from outside, the NAS can be the VPN's entry point. Synology provides a VPN server package for this. You install it from the package centre, choose a connection type and create accounts or certificates for the people allowed to connect.

What you need to get right:

• Pick the least risky connection type. Older types such as PPTP have known weaknesses; our article on PPTP security explains why. Prefer modern options that DSM offers, and read the platform's current guidance. NIST's guide to IPsec VPNs and the OpenVPN community resources are neutral references.
• Forward only the ports you need. Your router must pass the VPN server's port through to the NAS. Open one port, not a range, and read VPN port forwarding explained so you understand what you are exposing.
• Check for CGNAT. If your provider shares one public address among many customers, forwarding will not work at all, and you will need a different approach such as a relay or an address from the provider.
• Use strong, separate credentials. Create accounts only for people who need access, and enable two-factor authentication on the NAS itself. What two-factor authentication is covers the options, and CISA's guidance is a clear plain-language reference.
• Restrict by account and, if possible, by network. The firewall feature in DSM lets you limit which source addresses can reach the VPN port. Only do that if your travelling addresses are predictable.
• Keep DSM and packages updated. Exposed network devices are a common target. Patches matter.

Once connected, your laptop or phone gets an address on a virtual network and can reach the NAS and other home devices as if it were at home. Everything else on the device still goes where it normally would unless you configure otherwise.

If you travel often, you might want both: a server on the NAS for home access and a commercial VPN app on the laptop for public Wi-Fi. They can coexist, but they need a bit of care, which is the next topic.

Setup C: a VPN on your computer, and reaching the NAS at the same time

This is the most common real situation. You turn on a VPN app on your laptop, and the NAS on your home network suddenly seems to disappear.

What happens is that the VPN app sends all of the laptop's traffic through the tunnel, including requests for local addresses like 192.168.1.50. The VPN server cannot reach inside your house, so the request fails. Some VPN apps include a setting that keeps local network traffic outside the tunnel, often called local network access or LAN bypass. If your app has it, turn it on. Others offer split tunneling, which lets chosen apps or destinations skip the tunnel.

Practical options when the NAS vanishes:

1. Use the app's local-network setting, if available, and reconnect.
2. Connect to the NAS by its local address, not by a name that resolves through the VPN's DNS. Names ending in your own home domain may not resolve through an outside resolver.
3. Use split tunneling for the file manager or the NAS client, so that traffic goes direct.
4. Pause the VPN for a minute when you only need to copy files and you are on a network you trust.

When you are away from home, reaching the NAS needs Setup B or Synology's own remote-access features. A VPN app does not open that door.

What to route through a VPN and what to leave alone

If you do put the NAS behind a VPN client, be selective. Not everything the NAS does benefits.

NAS task	Send through the VPN?	Reason
Downloads and indexing	Often yes	Keeps the home address out of those connections
Containers that fetch from the web	Often yes	One tunnel for the whole container
Local file sharing and media streaming at home	No	Local traffic should stay on the LAN
Cloud backups and sync to a storage service	Depends	Fine if stable, but long sessions can drop
Remote access features that rely on the vendor's relay	Usually no	Can conflict with the tunnel
Update checks and package downloads	Either	Works in both cases

If you do route everything, expect some side effects. The vendor's remote-access feature may stop working. A scheduled task may fail when the tunnel drops. And local access from other devices may need explicit routes. This is why selective routing, where the NAS allows it, is worth the extra effort.

A kill-switch-like behaviour also deserves thought. If the tunnel drops and the NAS keeps running, downloads may continue on your normal connection, revealing the home address you meant to hide. DSM does not give every setup a firm kill switch, so test what happens when you disconnect on purpose, and decide whether a firewall rule or a container-based approach is safer for you.

Troubleshooting a NAS with a VPN

Symptom	Likely cause	What to try
Profile will not connect	Wrong credentials or wrong file; time or date wrong on the NAS	Re-enter details; check the NAS clock and time zone
Connects, but no internet from the NAS	Routing option or DNS not set	Toggle the default-gateway option; set a DNS server
NAS unreachable from your computer after connecting	Local traffic captured by the tunnel	Disable the all-traffic option; add a local route
Connection drops every few hours	Idle timeout, or the provider's server restarted	Enable reconnect; check logs
VPN server works inside the house but not outside	Port not forwarded, firewall, or CGNAT	Check the forwarding rule and compare your router's WAN address with your public address to rule out CGNAT
Remote vendor feature stops working	Both features fighting over routes	Turn off the client profile while you use it

For general troubleshooting that applies to any VPN, VPN not connecting gives a methodical checklist. On the NAS, the log centre often tells you what failed far more clearly than the connection status does.

Security habits worth building before you start

A NAS is a store for private data, so a VPN is only one layer among several.

• Back up before changing network settings. Export the DSM configuration and keep a copy of important data elsewhere.
• Turn off services you do not use. Every listening service is a potential entry point.
• Avoid exposing the management page directly. If you need remote administration, reach it through the VPN server, not through a forwarded web port.
• Use separate admin and everyday accounts. Disable default accounts where the system allows.
• Check the firewall after every change. A rule that is too broad can undo your care.
• Remember what a VPN does not cover. It does not stop malware that you copy to the NAS, a stolen password, or a bad share setting. See what a VPN cannot protect you from.

Summary

"VPN on a Synology NAS" means one of three things. Use DSM's VPN client profile when the NAS itself should send traffic through an outside server, a VPN server package when you want secure access to your own files from elsewhere, and a plain VPN app on your computer when the laptop is what needs protection. Check what your provider actually supplies before planning a NAS profile, keep local traffic off the tunnel, forward only the ports you need, and test what happens when the tunnel drops.

If you decide you want a VPN for your computers and phones, the pricing page lists the prepaid options, and the download page points to the free VPNclient app.