DB-유

VPN Server on Synology: OpenVPN

· synology, vpn, openvpn

I got tired of looking at my router's port forwarding list. DSM, SMB, a database port, each one a small bet that nothing in it has a hole. A VPN gives me the same access to the network with exactly one open UDP port, and the VPN Server package on DSM 6 includes an OpenVPN server that's good enough for a handful of users. The parts that need care are the exported profile and the firewall.

This is my configuration, plus how to make the exported .ovpn work on Windows, Android and iOS. You need DSM 6.1 or 6.2 with VPN Server installed, a DDNS hostname, and a router where you can forward UDP 1194. No certificate is needed on the NAS; the package makes its own CA.

Enabling the OpenVPN server

Open VPN Server → OpenVPN. Tick "Enable OpenVPN server" and set:

  • Dynamic IP address: 10.8.0.0. Clients get addresses from this /24. Choose something that does not collide with your LAN or with the networks your clients connect from (10.0.0.x and 192.168.1.x are the usual collisions).
  • Maximum connection number: 5 for home use.
  • Maximum number of connections with same account: 3, so one user can have a laptop and a phone connected.
  • Port: 1194, Protocol: UDP.
  • Encryption: AES-256-CBC. Authentication: SHA512.
  • Enable compression on the VPN link: off. Compression with TLS has known weaknesses and gains little.
  • Allow clients to access server's LAN: on. Without this the client can only reach the NAS.
  • Enable IPv6 server mode: off unless you route IPv6 internally.

Apply. The package writes its configuration to /usr/syno/etc/packages/VPNCenter/openvpn/openvpn.conf; do not edit it directly, the GUI regenerates it.

Who may connect

VPN Server → Privilege lists DSM users with a checkbox per protocol. Untick OpenVPN for everyone except the accounts that need it, and use dedicated accounts rather than the admin user. VPN authentication uses DSM passwords, so make sure those accounts have strong ones and, ideally, 2-step verification on their DSM logins (the VPN itself does not do OTP).

Firewall and port forward

Control Panel → Security → Firewall → Edit Rules → Create: built-in application VPN Server (OpenVPN), UDP 1194, source All. Then forward UDP 1194 on the router to the NAS.

If you need clients to reach other machines on the LAN and the NAS is not the default gateway, the return traffic from those machines must find its way back to 10.8.0.0/24. The VPN Server package NATs client traffic through the NAS address by default, so this works out of the box; only disable NAT (there is no GUI option, it is a iptables rule the package adds) if you know why.

The client profile

VPN Server → OpenVPN → Export configuration. The zip contains VPNConfig.ovpn, ca.crt and a readme. Open the .ovpn in a text editor and change:

remote YOUR_SERVER_IP 1194

to your DDNS name:

remote nas.example.synology.me 1194

Also uncomment redirect-gateway def1 if you want all internet traffic from the client to go through the VPN (useful on hotel Wi-Fi), and leave it commented for split tunnelling. The file already contains ca.crt inline in newer package versions; if not, add:

<ca>
-----BEGIN CERTIFICATE-----
...contents of ca.crt...
-----END CERTIFICATE-----
</ca>

Then distribute the single file. On Windows install the OpenVPN GUI and drop the file in C:\Users\<name>\OpenVPN\config\. On Android and iOS use the OpenVPN Connect app and import the file. All clients prompt for the DSM username and password.

Trying it

Connect from a phone on mobile data. Don't test from the home Wi-Fi; I wasted time on that once. On the NAS:

sudo cat /var/log/openvpn.log | tail -20
sudo ip addr show tun0

You should see tun0 with 10.8.0.1 and the log showing the user authenticated and a "Peer Connection Initiated" line. VPN Server → Connection List shows the client with its assigned 10.8.0.x address. From the phone, open http://192.168.1.20:5000 and a share via a file manager app to prove LAN access works.

When it goes wrong

  • The client hangs at "Connecting" and the log shows TLS Error: TLS key negotiation failed to occur within 60 seconds: UDP 1194 is not reaching the NAS. Check the router forward and the DSM firewall rule, and confirm the client is not on a network that blocks UDP (try the TCP option in the package if so).
  • AUTH_FAILED: wrong DSM password, or the user is not ticked under Privilege. Also check Control Panel → Security → Account → Auto Block; failed VPN attempts count and can ban your own phone.
  • Connected but cannot reach anything on the LAN: "Allow clients to access server's LAN" is off, or the client's local network uses the same subnet as your LAN. Renumber one side.
  • Windows client connects but DNS does not resolve internal names: add dhcp-option DNS 192.168.1.1 to the .ovpn and run the OpenVPN GUI as administrator so it can set the adapter's DNS.

OpenVPN on the NAS isn't fast, a DS218+ tops out around 100 Mbit/s on AES-256. Fine by me for DSM, files and a remote desktop, and my router's forward list is now one line long.