Synology OpenVPN Not Connecting? Server & Client Setup
Choose whether your Synology NAS should be an OpenVPN server or client, follow the matching DSM setup, and fix ports, profiles, certificates, or CGNAT.
Quick Answer: Choose Server or Client Before You Configure Anything
For secure outbound NAS traffic, create an OpenVPN client profile in DSM and import a provider file; NordVPN is the broadest starting choice because its current guide supports DSM 6.1 and later. For remote access to your home NAS, install Synology VPN Server, enable OpenVPN, forward UDP 1194, and test from outside Wi-Fi. Do not try to run Synology’s OpenVPN client and OpenVPN server at the same time—the same protocol cannot fill both roles.
Server means remote access
The NAS accepts inbound OpenVPN connections so you can reach files or the home LAN while away.
Client means outbound privacy
The NAS connects to a commercial VPN using an imported .ovpn profile and provider service credentials.
One protocol, one role
DSM cannot use its VPN client and VPN Server with OpenVPN simultaneously. Pick the job that matters.
Synology OpenVPN setup planner
Select the job, DSM generation, and inbound internet condition. The result changes immediately and points to the setup that can actually work.
What should the NAS do?
Which DSM generation?
Can your router receive inbound traffic?
Check the WAN address before opening a port
Compare the router WAN IPv4 with the public IPv4 reported online. If they differ, or the WAN address is private or in 100.64.0.0/10, solve double NAT or CGNAT before changing OpenVPN.
Prepare the server, then verify WAN accessSynology OpenVPN server vs client
Both screens mention OpenVPN, but the traffic direction, prerequisites, and proof of success are opposite.
| Decision | Synology as server | Synology as client |
|---|---|---|
| Primary job | Reach the NAS or home LAN while away | Send NAS internet traffic through a provider |
| Inbound access | Public IPv4, forwarded UDP port, or an alternative path required | Not required; the NAS initiates the connection |
| DSM location | VPN Server package → OpenVPN | Control Panel → Network → Network Interface |
| Commercial VPN subscription | Not needed for direct home remote access | Needed to obtain provider servers and credentials |
| Success test | Connect from mobile data and open a permitted LAN resource | Confirm the NAS public IP and target application traffic |
QuickConnect is not the OpenVPN transport
How to set up Synology OpenVPN Server
This path creates private remote access to the NAS and selected LAN resources. It does not send normal NAS traffic through a commercial privacy VPN.
- 1
Reserve the NAS LAN address
Give the NAS a stable address through a router reservation. The port forward and firewall rule must keep pointing to the same device.
- 2
Install VPN Server and grant access
Install Synology VPN Server from Package Center. In Privilege, allow only the accounts that should connect and use strong unique passwords.
- 3
Enable OpenVPN
Open VPN Server → OpenVPN, enable the server, keep UDP 1194 unless you intentionally choose another port, and enable LAN access only when remote clients need it.
- 4
Export and edit the client profile
Export the configuration, extract it, and replace YOUR_SERVER_IP in VPNConfig.ovpn with the current public IP or Synology DDNS hostname.
- 5
Forward the exact UDP port
On the internet-facing router, forward UDP 1194 to the reserved NAS address and allow that same source path in DSM Firewall. TCP 1194 is a different rule.
- 6
Test from outside the home
Import the profile into OpenVPN Connect, disable phone Wi-Fi, connect over mobile data, and open one permitted NAS or LAN resource. An inside-Wi-Fi test is inconclusive.
Expose the VPN port, not the DSM sign-in page
How to connect Synology to OpenVPN as a client
Use this path when Download Station, backups, or other NAS-originated traffic should exit through a commercial VPN. DSM supports OpenVPN TUN profiles, not TAP bridging.
- 1
Download a router-compatible profile
From the provider account, download a current UDP .ovpn file, any required CA certificate, and the separate OpenVPN service credentials.
- 2
Create a VPN profile in DSM
Open Control Panel → Network → Network Interface → Create → Create VPN profile, then select OpenVPN via importing a .ovpn file.
- 3
Import the file and service credentials
Name the profile, enter the manual OpenVPN username and password, import the .ovpn file, and add the matching CA certificate if DSM asks for it.
- 4
Choose routing and reconnect behavior
Use the VPN as the default gateway only when all NAS internet traffic should follow it. Enable automatic reconnect and avoid sharing the connection unless the NAS is deliberately acting as a router.
- 5
Connect one profile
Apply the profile, select it, and click Connect. If DSM rejects it, start with the provider’s router or legacy-compatible OpenVPN file rather than editing random directives.
- 6
Verify the NAS route
Check the external IP from a NAS-originated task and test the target package. A browser test on your laptop does not prove Download Station or backup traffic is using the tunnel.
Best VPNs with current Synology OpenVPN guidance
These subscriptions are for the outbound client route. They do not make an unreachable home OpenVPN server accessible through CGNAT.
NordVPN
The clearest choice for both DSM 7 and older DSM 6.1+ installations.
- Maintains a dedicated Synology DSM 6.1+ setup guide
- Six independent no-logs assurance engagements, latest by Deloitte
- Operating since 2012 with a long public security track record
- 30-day money-back window for eligible purchases
Proton VPN
A strong DSM 7 option when public code and audit reports are priorities.
- Maintains a dedicated DSM 7+ Synology setup guide
- Apps are fully open source and independently audited
- Backed by a privacy ecosystem with more than 100 million accounts
- 30-day money-back guarantee on eligible paid plans
PureVPN
A documented Synology option backed by a long service history.
- Maintains a current Synology NAS OpenVPN setup guide
- Uses an always-on independent no-log audit model
- Operating since 2007 with more than 18 years in the market
- Reports more than 3 million users across the service
Advanced CGNAT option: reach Synology OpenVPN through FRP
Want lower ongoing costs and already have programming or server-operations skills? FRP through a small public server can cost less than a full VPN subscription, but you must configure Linux, a firewall, frps, frpc, access protection, monitoring, and security updates. It is not suitable for ordinary beginners. Use this only to make a Synology OpenVPN server reachable behind CGNAT; it is not a privacy VPN, and you should expose only the intended VPN endpoint—not DSM administration.
Fix Synology OpenVPN not connecting
Start with the visible symptom and whether the NAS is the server or client. The same “connection failed” message can represent opposite traffic directions.
| Symptom | Likely cause | Focused fix |
|---|---|---|
| Remote client times out | Wrong DDNS address, UDP forward missing, firewall mismatch, double NAT, or CGNAT | Compare public and WAN IPv4, confirm UDP 1194 reaches the reserved NAS address, and test from mobile data. |
| Certificate expired or TLS verification fails | Old exported profile, replaced DSM certificate, wrong system time, or mismatched CA | Correct NAS and client time, update the certificate, export a fresh profile, and replace the old profile on every client. |
| DSM rejects the .ovpn profile | Unsupported directive, TAP profile, embedded option DSM does not accept, or missing CA | Download the provider’s router-compatible TUN profile and required certificate. Use a different documented profile before manually editing it. |
| OpenVPN connects but the home LAN is unreachable | LAN access disabled, DSM firewall block, or the remote network uses the same subnet | Enable client LAN access, allow the VPN subnet to the intended destination, and change one overlapping LAN subnet. |
| Synology client connects but NAS apps lose internet | Bad provider DNS, stale profile, or default-gateway routing without a working tunnel route | Disconnect the profile to confirm causation, import a current nearby-server profile, and recheck the gateway and DNS choices. |
| OpenVPN works but Synology is slow | NAS CPU encryption limit, TCP profile, distant server, or slow storage workload | Measure the same task without VPN, prefer a nearby UDP profile, and check CPU and disk use during the transfer. |