🗄️ About Synology NAS VPN
Setting up VPN on your Synology NAS protects all downloads, enables secure remote access, and can route your entire network through TorGuard. Perfect for 24/7 protection of torrents, Usenet, and automated downloads.
Why Use VPN on Your NAS?
Common Use Cases
📥 Download Protection
- Torrent anonymously 24/7
- Hide Usenet activity
- Protect automated downloads
- Avoid ISP throttling
🏠 Remote Access
- Access NAS from anywhere
- Secure file sharing
- Stream media library
- Manage downloads remotely
🌐 Network Gateway
- Route devices through VPN
- Protect smart home devices
- Bypass geo-restrictions
- Network-wide protection
Compatible Synology Models
Value Series (J)
Models: DS220j, DS420j, DS620slim
CPU: ARM-based, limited VPN performance
VPN Speed: 5-15 Mbps
⚠️ Basic VPN only, not for heavy use
Plus Series (+)
Models: DS220+, DS720+, DS920+
CPU: Intel Celeron, hardware encryption
VPN Speed: 50-100 Mbps
✓ Recommended for most users
XS/XS+ Series
Models: DS1621xs+, RS1221+
CPU: Intel Xeon/AMD Ryzen
VPN Speed: 200+ Mbps
✓ Best performance
DSM Version Compatibility
| DSM Version | OpenVPN Support | Import .ovpn | Notes |
|---|---|---|---|
| DSM 7.2 | ✅ Full | ✅ Yes | Latest features, recommended |
| DSM 7.0-7.1 | ✅ Full | ✅ Yes | Stable, widely used |
| DSM 6.2 | ✅ Full | ✅ Yes | Legacy, consider upgrading |
| DSM 6.0-6.1 | ⚠️ Limited | ❌ No | Manual config required |
Prerequisites
Before You Start
- Internet connection is stable and working
- NAS volume status is healthy (no degraded RAID)
- DSM is updated to latest version for your model
- Admin access to DiskStation Manager
- TorGuard VPN account credentials ready
- Downloaded OpenVPN config file from TorGuard
Step-by-Step Configuration
1Access Control Panel
Log into your Synology DSM and navigate to the Control Panel:
Click Control Panel from the main menu
Then click on Network under the "Connectivity" section:
Navigate to Network settings
2Create VPN Profile
Click on Network Interface tab, then Create → Create VPN Profile:
Create new VPN profile
Select OpenVPN (via importing .ovpn file) and click Next:
Choose OpenVPN with config import
3Import Configuration
📥 Getting Your Config File
- Visit TorGuard Config Generator
- Select your desired server location
- Choose encryption and port settings
- Download the .ovpn file
Enter your credentials and import the config file:
Enter VPN credentials and browse for config file
⚠️ Important Credential Note
Use your TorGuard VPN service credentials, not your website login. Find these in your client area under "VPN Credentials".
4Configure Settings
Review settings and enable all recommended options:
Check all options and click Apply
Recommended Settings:
- ✅ Use default gateway on remote network - Routes all traffic through VPN
- ✅ Reconnect when VPN connection is lost - Auto-reconnect feature
- ✅ Enable IPv6 - If your network supports it
5Connect to VPN
Select your VPN profile and click Connect:
Highlight profile and click Connect
6Verify Connection
Once connected, the status will show as "Connected":
VPN successfully connected
7Verify IP Address
Test your connection using SSH:
ssh admin@your-nas-ip
curl http://checkip.dyndns.org
Or from any device on your network, visit myip.tg
DSM 7 Specific Updates
🔄 DSM 7 Changes
DSM 7 introduced several VPN improvements:
- VPN Plus Server: Enhanced VPN server capabilities
- Certificate Management: Better handling of VPN certificates
- Performance: Improved VPN throughput on supported models
- Interface: Cleaner VPN management interface
Advanced Configuration
Route Specific Applications
Configure only certain apps to use VPN:
- Go to Control Panel → Network → Network Interface
- Click your VPN connection → Edit
- Uncheck "Use default gateway on remote network"
- Add specific routes for applications:
# Example: Route only Download Station through VPN route add -net 10.8.0.0/24 gw 10.8.0.1
Kill Switch Implementation
Ensure downloads stop if VPN disconnects:
- Create a scheduled task in Control Panel → Task Scheduler
- Set trigger: "Boot-up"
- Add this script:
#!/bin/bash # Check VPN status every 60 seconds while true; do if ! ip a | grep -q "tun0"; then # VPN is down, stop Download Station synoservice --stop pkgctl-DownloadStation else # VPN is up, ensure Download Station is running synoservice --start pkgctl-DownloadStation fi sleep 60 done
Multiple VPN Profiles
Set up profiles for different purposes:
- Downloading Profile: Closest server for best speed
- Streaming Profile: Dedicated streaming IP
- Privacy Profile: Double VPN or specific country
Performance Optimization
🚀 Speed Optimization Tips
-
Use UDP Protocol
When generating config, select UDP for better performance
-
Lower Encryption
Use AES-128-GCM instead of AES-256 for faster speeds
-
Disable Compression
Modern connections don't benefit from compression
-
Resource Monitoring
Check CPU usage in Resource Monitor during transfers
Integration with Synology Apps
Download Station
- All downloads automatically use VPN
- Set bandwidth limits to prevent saturation
- Enable scheduling for off-peak downloads
Docker Containers
Route specific containers through VPN:
# In container settings
--net=container:vpn_container_name
Surveillance Station
- Access cameras remotely via VPN
- Secure footage uploads to cloud
Troubleshooting
VPN Won't Connect
- Verify credentials are correct (VPN, not website login)
- Check if port is blocked by router/firewall
- Try different server or protocol (TCP vs UDP)
- Ensure time/date is correct on NAS
- Update DSM to latest version
Slow Download Speeds
- Check CPU usage - may need more powerful NAS
- Try servers closer to your location
- Switch to UDP protocol
- Reduce encryption level
- Check if ISP throttles VPN traffic
Can't Access NAS Remotely
- VPN changes your external IP
- Use QuickConnect for remote access
- Set up DDNS with new IP
- Configure port forwarding on VPN (dedicated IP)
Apps Not Using VPN
- Check "Use default gateway" is enabled
- Restart affected applications
- Verify with
curl ifconfig.mein SSH - Check routing table:
route -n
Security Best Practices
🔒 Security Recommendations
- Enable 2FA on DSM admin account
- Use strong, unique password for VPN
- Regularly update DSM and packages
- Disable unnecessary services
- Configure firewall rules properly
- Monitor login attempts in Security Advisor
Alternative: Docker VPN Container
For advanced users, run VPN in Docker:
- Install Docker package from Package Center
- Deploy TorGuard VPN container
- Route other containers through VPN container
- More flexible but requires Docker knowledge
Need Help?
If you're having trouble with your Synology VPN setup:
Include your NAS model and DSM version for faster assistance