Synology NAS OpenVPN Server Setup & Configuration! (Tutorial)
Вставка
- Опубліковано 4 сер 2020
- This tutorial will guide you through the process of configuring OpenVPN on your Synology NAS! This tutorial will guide you through the entire setup process to ensure you set everything up properly, the first time! Make sure that you check out the written instructions as they help guide you through the process and allow you to follow along as we setup OpenVPN on our Synology NAS!
✅ Written Instructions: link.wundertech.net/ovYt
🔔 Subscribe for more tech related tutorials and overviews: link.wundertech.net/ssYt
🚀 Product Recommendations: link.wundertech.net/rmYt
❤️ Check out our website: link.wundertech.net/wtYt
📌 Ultimate Synology NAS Setup & Configuration Guide: link.wundertech.net/nRYt DISCLAIMER: The information in this video has been self-taught through years of technical tinkering. While we do our best to provide accurate, useful information, we make no guarantee that our viewers will achieve the same level of success. WunderTech does not assume liability nor responsibility to any person or entity with respect to damage caused directly or indirectly from its content or associated media. Use at your own risk.
WunderTech is a trade name of WunderTech, LLC. - Наука та технологія
I have watched about 30 tutorials by various providers concerning Synology NAS and its packages. I plan to use one to serve a small business where we desperately need reliable backup, sync and remote access to everything. I almost never comment. Just watch. But your tutorials are so exceptionally well done that I am compelled to let you know how much I appreciate them and how enlightening they have been to me. You teaching method is outstanding. If you don't already teach for a university, you certainly should consider it. Thank you so very much for these. I look forward to watching all that you have created.
That is truly an incredible compliment and I genuinely appreciate your kind words! I am not a teacher at all (work in IT), but I'm glad to hear that the content is easy to understand as that's my goal. Thank you again!
Great video!! Short and to the point without the needless carrying on like most tech guides tend to do.
This was really useful! I appreciated the highlights of the configurations, and the required digression into Split vs Full tunnel. Well done, and thank you!
Very good pacing and very informative and direct. Having the write-ups alongside really made this perfect. Thank you and please keep making videos.
Thanks so much!
A very good tutorial. Enough background to aid understanding without ‘waffle’. Thank you.
Fantastic videos, thanks so much! There's so much to learn as a NAS newbie, but I've watched a few of your videos now and they were all really helpful.
Thanks, exactly what I was looking for. Now I can connect to my NAS from my laptop when I'm away from home
Hi ...
Just a small feedback for all your videos I was checking today, as I just found your channel while searching for cross-side Synology Backup with a friend of mine. Your videos are just simply superb!!! They are straight through the topics, short precise fast comment. Incredible efficient! That's the best ever format I have found on youtube! You are definitely a master in giving the needed information! Great idea to have the detailled step by step part in a document, for whoever wants to get it more detaied ... Videos were far enough so far .. So thanks for your way to spread valuable information in these very efficient videos. Greeting from Luxembourg/Europe ;-)
I really appreciate the kind words, thanks so much! I'm glad to hear that the videos have helped out!
Great tutorial, clear video/audio, and well spoken (excellent tone for tuition)
I very much appreciate your videos, brother. They are direct, concise, informative, yet not littered with so much "tech jargon" that the average person cannot understand or follow the train of thought. If I may make one suggestion, it would appear that several of these synology videos have a single thread running through them. For instance this one, setting up a VPN, or the one that shows how to enable DDNS. It would be helpful for those of us who don't understand the entire process, to view a flow chart or diagram at the beginning of what will be required, instead of saying half way through the video that you should already have "DDNS set up" or you have have already had "VPN set up". Knowing in advance, would be very helpful and keep us from jumping back and forth between different videos, while trying to figure out if we have everything that's required for setup.
Thanks again for such a great how to here. You are truly gifted.....
This is really great advice and definitely something that I will keep in mind moving forward. I appreciate the input!
I have to say you are most awesome at doing these videos. Keep up the great work. Concise and to the point.
Thanks so much for the kind words! I'm glad the videos have been helpful.
First tutorial I’ve seen and helped me understand self hosted vpns a lot. I’m not an IT guy but this makes me feel like I could handle it on my own.
Glad that it helped! Thank you for watching!
Great tutorial. Very much on target in terms of both context and level of detail, so very time efficient. They are also very clear on redirecting to other topics for more details.
Glad to hear! Thanks for the kind words and for watching!
Thank you very much! Very very useful tutorial provided, started from "Complete Synology NAS Setup Guide" video.
Your videos are fantastic! I can't wait until my NAS arrives to start setting it up!
Awesome. I’d really appreciate a full explanation. I’m new to all this and I’m trying to learn as much as possible. Although I’m fairly tech savvy ie I understand to a decent degree what you’re doing and explaining, I’m quite uncomfortable turning something on without knowing all the options and consequences. It’s the difference if it doesn’t work for some reason and I have to troubleshoot effectively instead of just fumbling around.
I understand! I try and keep these brief as I don't want to create super long tutorials, but I will keep that in mind in the future. Are there any specific questions that I can answer? Thanks for watching!
Great Tutorial! Like the format. Keep up the good work
Very good I was able to follow the directions and setup on IOS and tested OK. Thank you!
Explained very well
This videos help a lot for new users!!
Excellent tutorial, thank you!
Thank you so much for making my life easier - especially with that little hint @ 7:25
I'm glad to hear it helped, thank you for watching!
Precision in to point
Great
Thank you
This is excellent. No waffle, just straight to the point for those of us who need to "just get it done". Thank you!
Glad that it helped, thank you for watching!
@@WunderTechTutorials how would synology photos, video or music etc services work if used with openvpn?
@@cesiumion You would connect to the VPN and then access the services using the local IP address.
@@WunderTechTutorials ok that Kinda went over my head. So let's say, I live in Mississippi and I travel to cali, would I be able to use synology photos with my cellular service and access photos on my synology NAS, upload and download photos from my phone.
@@cesiumion When you connect to those apps, you'll enter the NAS's IP address. From there, as long as you connect to OpenVPN, they will work as they do when you're at home. Think of the VPN like being at home when you're connected to it.
trying to keep up! drinking from a fire hose, new to all this, appreciate your time and info. will have to go back over this one to catch it all, I like more detail but again am new to Synology. You are great
I appreciate the kind words! It will all stick soon, it took me a while to understand how they set everything up as well!
Hello...Thank you for this video and all of your videos…they are always very helpful!
Great video! TY
wow it actually worked, thx a lot!
This worked like charm!
Wow, this is super helpful. Thank you so much. I was tinkering with site to site VPN through my router directly, but this is way easier and more logical (DS720+ can handle is easily). Thank you so much for this well explained video!
Edit: What might be a tip: Config your port forwarding as follows: Instead of forwarding UDP 1194 to your NAS, Forward UDP 443 (WAN) to you NAS UDP 1194 (LAN) instead. That way, you open UDP port 443 on the outside. The reason for this: Many public Wifi has port 1194 (for outgoing traffic) blocked. If that's the case you wouldn't be able to connect to your home VPN. Port 443 is almost always open because it's the port for HTTPS traffic.
So: Open UDP 443 (OUTSIDE), forward it to UDP 1194 (to NAS). Don't forget to change the port to 443 in the openvpn config file as well.
I hope this helps some people :) but this video rocks. Thanks!
Great feedback! Thanks for taking the time to write that up and thank you for watching!
Can this port 443 be used twice in the router port forward rules? I have that 443 port forward to something else.
How do you do this ?
@@Popcorncandy09 Depends on the model of your router unfortunately.
@@fdksdk4843 Nope. Just once
excellent, thanks a lot very well explained and worked without issues from first attempt :-)
Bravo again. Really great video
Excellent Videos. Thank you and I love this current format that you do. It appears you give enough details from the ones I have watched for the connection. You might include some details on the clients people use to connect with for Android, IOS , windows or macs, if you know them.
Thanks so much for the feedback, it's truly appreciated! I will look to incorporate some of that in future videos.
You produce amazing and Professional content! Thanks a lot..
Thank you so much!
Excellent thanks
muchas gracias por el tutorial, funciona perfectameente, Thank you!!!!
Good and a clear explanation!! Even for a Dutch :-) Thanks!
you asked if we like your videos? Speaking for myself here, I think your video's and documentations attached, helped me to go through the first bits on setting up and inspired me to learn more. So I'd say, your presentations are just brilliant and extremely helpful. Got to understand this for me complex topic much better - since I tended to ignore this kind of thing I guess.. - and inspired me to understand the whole thing around the in my case Synology ds220+ NAS, to a level of detail that I else would have left aside. So, many thanks for your great efforts to share your expert level knowledge you have obtained over time with all of the people on your channel. I gather most will feel alike me, humble in listening and reading getting to a better understanding and beyond.
I really appreciate the kind words! Thank you so much!
@@WunderTechTutorials am actually setting up my full tunnel vpn with openvpn with your video and documentation as I write now! Learned a bunch and it’s truly supporting me the best! So many thanks! You’re a diamond. I only have a question on how you can shortcut certain apps to the DSM desktop?
@@fransvanderwerf7485 Glad it's helped!! If you right-click the app in DSM, it'll allow you to add it to the desktop.
@@WunderTechTutorials thanks :) I tried that before but it won't let me somehow. I run it on a Mac perhaps that is causing this.. But regardless that, I think you deliver robust masterpieces each time on the subject! :)
Great videos, I'm getting a new nas and without them I'd be lost👍
I'm glad to hear they help, thank you for watching!
Great video !
Excellent format
Thanks so much!
I wanted to express my gratitude for your excellent video. Your clear and concise explanation made it easy for me to follow along. Your use of real-world examples and analogies helped me to grasp the material easily.
Thank you for sharing your expertise and for creating such high-quality educational content. You have made a positive impact on my learning experience, and I'm sure others have benefited as well.
Thanks so much for the kind words! Glad the video helped!
@@WunderTechTutorials Do you have a video tutorial available that demonstrates how to use Remote Desktop Connection to connect to a PC once a VPN connection has been established?
@@hinhtran7640 I don't, but if you open RDP, you should be able to put in the local IP address of the device and connect!
@@WunderTechTutorials I've tried that but it does not work. Is there anything else I need to configure?
@@WunderTechTutorials Have you tried it and does it work?
I've watched a lot of your videos and they're all very good, but I, for one, could use a little more explanation aimed at clueless noobs. Thanks for all your effort.
outstanding
Thank You
Great video, straightforward and easy to understand! Do you know if file sync is possible with Synology Drive Client while outside the LAN via OpenVPN? Thank you
Yes, everything should work as expected when using a VPN. You just need to make sure you're connected. Thanks a lot for watching!
Great Videos :-)
Excellent video showing the basics of connecting and I learnt something new about full tunnel vs split tunnel but I would like to see one on how to get the VPN to connect through piHole when piHole is running in Docker on the same Synology. Been tearing my hair out for months trying to get that to work!
Thanks for watching the video!
You can actually do that fairly easily. I just created a video on Pi-hole in Docker a few days ago. If you watch that video and follow the second method (where you create a Pi-hole network and Pi-hole bridge network), you can use the Pi-hole bridge network as your OpenVPN config file's DNS server. Your NAS can't talk to the macvlan network interface, which is why the bridge is created.
To be clear on what I'm talking about, in my Pi-hole video, I created two networks. The ph_bridge network that I create (192.168.10.2) is what should be used as the DNS server in your OpenVPN config file (dhcp-option DNS 192.168.10.2). If you aren't sure what I'm talking about, watch the Pi-hole video and it will make a little more sense.
If you have any further questions, let me know!
@@xox101 I'm glad to hear that it worked! I will definitely add that to the tutorial as I'm sure it can help others as well. Thanks a lot for checking out the videos!
@@xox101 you are not alone bro! btw you can connect your local domains on openvpn instead of entry ip ? @WunderTech
Sometimes I have to stay in Turkey where most VPNs are blocked. Thanks to your clear and detailed tutorial I have set up my own VPN to access web sites via my NAS. Tested via my phone, fingers crossed when I head for Turkey... Thank you so much.
I'm glad to hear you were able to get it working! If you get there and it's blocked, you might want to change the port to TCP 443 (from UDP 1194). UDP 1194 is a known VPN port (easily blocked on their side) but TCP 443 will be fairly indistinguishable from other SSL traffic. If they've blocked UDP 1194 traffic, TCP 443 will almost certainly not be blocked, so it's a good alternative.
If you're interested in setting that up, follow the same instructions but change everything from UDP 1194 to TCP 443. Let me know if you need any further help.
Thanks a lot for watching!
@@WunderTechTutorials That sounds like a very worthwhile backup plan. I'll set that up too. But not tonight, my brain hurts! Very much appreciated.
@@WunderTechTutorials Worked through my brain pain and forged ahead. At first it didn't work. But then I restarted the NAS and it burst into life. Again, thanks!
@@geoffchr1506 I'm glad to hear it worked! Let me know if it works when you're in Turkey. Safe travels!!
@@WunderTechTutorials I hope I remember! Thanks.
Excellent video!! There must be 100 misleading videos out there, this one was quick and easy. Synology isn't much help, nor is the OpenVPN app. Like those guys are so into programming, they forgot the users and really can't explain what they did.
Your video are awesome man, I tried to follow this video, and honestly, when it came to configuring the port forward on my Router that's when I kinda Lost it, i just didn't know what to do even though you're explaining well. I'm just not familiar with all this stuff..
also, why not just use Synology quick-connect? i seem to be able to do that externally
Thanks so much! There's absolutely nothing wrong with using QuickConnect. The issue (if you classify it as one), is that you aren't in control of it. Meaning that you're relying on Synology to secure the connection. While this is completely fine for a lot of people, some would prefer being the one to manage it, which is why implementing something like OpenVPN is a great option.
In summary, if you're cool with QuickConnect, nothing wrong with using it!
Great and clear video. Question. If I set up Synology Drive Client & Server and then a VPN as show in this video does that allow me to mount my NAS drives on my NON local machine and also use those same mounted drives when I AM local or is only accessible thorugh the vpn software?
If I understand your question right, yes, you can mount them AS LONG as you're connected to the VPN. If you're not connected to the VPN, you won't be able to access the drive(s).
Nice man! How can i use the certificate that OpenVPN generates for me? I want to use it to add more security to the connection.
Did the configuration and it works. But it is much slower than Wireguard which I have set up on a raspberry Pi zero w. Is there any way to install Wireguard server on Synology NAS?
OpenVPN is slower than WireGuard for most. As of right now, there's no great way to set up WireGuard on a Synology NAS. The best way that I've heard people do it is by using a virtual machine, but it's not native NAS functionality.
Hi, I watched your video on running a reverse proxy. Can I run both the reverse proxy and openvpn? Trying to figure out how or if I can set up both. Also, you helped me identify a double NAT situation on my NAS which I was able to fix. Thank you. Your videos are great.
Thanks! Absolutely! They serve different purposes, so there's no issue using both.
Awesome tutorial! Thanks. I did everything exactly here and I still cannot get a connection. However, I'm using my ISP's router in bridge mode and then using an Amplifi HD for NAT. Does this change things? Do I have to do some port forwarding on my ISP's router as well? If so, what do I specify for ports and IP addresses there?
Yeah, that is most likely going to be a problem. You will have to try and get UDP port 1194 opened in order to get this working (either on the ISP router or both, depending on your configuration).
Thanks for the informative session. Your setup is probably the closest to my scenario as I’m using Netgear Orbi RBR50 mesh router. However, I’ve struggled a little because my current apartment requires me to setup my routers in Access Point (AP) mode and it is disabling the port forwarding feature. I can only gain access to port forwarding if it is set to Router mode. Any other option to setup port forward if I maintain at AP mode? Thanks for your advice in advance.
If the router is setup in AP mode, are you connecting to a centrally managed internet/router? If so, I don't think there will be a way use port forwarding since it will be managed on that specific router as opposed to your AP.
Great info. Is there a way to configure "site to site" with OpenVPN on the synology?
Thanks! Not that I'm aware of, unfortunately.
This was great, thanks. Can you clarify the DNS server option at 6:40 and how to set that up?
In summary, most people connect to PC's/servers on their local network by using the PC/server name. Without having a local DNS server configured, those names will not work - you'll have to use their IP address.
Per 9:00 in your video I'd appreciate a quick intro that includes an explanation of what it is this does and why it's important. This is really great info! For example my question is do I need Synology NAS VPN Server or Client or both and in what scenarios? I hear some people trying to configure both to run at the same time.
I have started to do that in some of my recent videos, but will continue to do so!
You can use any VPN server that you'd like, it doesn't necessarily have to be Synology's, but Synology does have a relatively easy application to use so a lot of people like it. As for the VPN, you set up the server (on your NAS), and then you export the certificate and set up the clients (using the mobile application or Windows/Mac application). The client will then connect to the server and be able to access all of the local resources. Hopefully this makes sense, but let me know if I can clarify anything.
@@WunderTechTutorials Thanks; very helpful! I've installed the VPN Server following your instructions on my local NAS. I believe I successfully tested it by installing OpenVPN on a mobile phone not connected to my LAN. Now I'd like to install the OpenVPN client on the remote NAS (which I have admin privileges to and can log-in to remotely) so that I have a private tunnel to send files via Hyper Backup to the remote NAS. Do you have a tutorial for how to install and configure the OpenVPN client on a Synology NAS?
@@bdubbin16 I believe that this video is exactly what you're looking for! Let me know if it isn't: ua-cam.com/video/FAIcfV3J1DQ/v-deo.html
Perfekt 🖐🖐🖐🖐🖐🖐🖐🖐
Frank, dumb question(s). First, how do i find the documents you mentioned in your videos? Second, When I export the config file it creates a folder with an openvpn file that is only 5kb in size, It has an ovpn extension. What do you use to edit this file (Mac)? BTW, love your videos! Best I've seen
Thanks so much! When you say documents, do you mean the written instructions? If so, here they are: www.wundertech.net/synology-nas-openvpn-server-setup-configuration/
That is the correct file, the .ovpn extension. As for the editor, you can use anything you want! I don't have a Mac so I unfortunately can't comment on the best Mac editor, but any text editor will do!
In this method, will you be able to access your NAS like a local network drive like it's connected via a lan cable? Thank you in advance for your response. And thanks for this video.
Yes, when you're away and connect to the VPN, you'll access your NAS over its local IP address.
Absolutely superb video. Thank you. Only one problem - if I have configured full vpn, I am unable to reach the web when I have openvpn connected…. I am sure I have followed the instructions to a tee, but for some reason, no internet. If I disconnect vpn, bingo, I get internet again… Weird.
When you say that you have no internet, did you specify a DNS server? If you did (and it's local), can you try and change it to something like Google (8.8.8.8) to see if it works?
Is port forwarding the VPN port secure ? I thought it was always best to not port forward anything. Could I put this port behind Kemp Load Balancer for layer 7?
Excellent tutorial, thank you :)) Now I have VpN set up :) But how can I share files with friends, without having to configure a VPN for everyone ? Kind regards
Thanks! Unfortunately with a VPN, you must share a config file with them and they'll have to connect. If you'd rather not do that, you can utilize Synology's QuickConnect (easiest thing to configure).
Great video as always! You mention in your blog that there are potential man in the middle vulnerabilities when using the Synology OpenVPN setup. Have you done a blog or video post which expands upon these so we know what the issue is? Would running an Ubuntu virtual machine on the Synology with OpenVPN Server be as secure as running a raspberry pi OpenVPN Server? Thanks
The MITM attack is something that can be remedied, but not something I plan on creating a video for because I cannot guarantee that the solution will stick between DSM updates as you need to create/change a few files through SSH. I also would want to give proper credit to the author, which could be hard due to the nature of where it was posted. This is a good explanation on the vulnerability: community.synology.com/enu/forum/17/post/113967
This is a page that can be translated on the "fix": www.synology-forum.nl/vpn-server/beter-beveiligde-openvpn/
Ultimately, whether you use it or not is going to be personal preference, but I added it to the blog post as an FYI. Personally, I wouldn't shy away from using it for this reason, but if you wanted to run it on a Raspberry Pi (I have a tutorial on that too), it would alleviate any of these concerns. Granted, you need to have a RPi in your possession because they're hard to get right now.
Hi, thank you for all the great videos you make! They are absolutely great and helpful! If you have a Synology router and a Synology NAS, both capable of being an OpenVPN server, on which one of those two devices would you setup the Synology OpenVPN server? Would you setup the OpenVPN server in combination with Cloudflare as an additional security or would Synology OpenVPN server be enough to have a secure connection? What OpenVPN app would you recommend for IOS devices? Thanks again for all the great job you do! Kind regards,
Thank you! I would personally run it on my router if the option was available. Not that the Synology package is bad, it's just offloading it to the router (which is a better fit for a VPN server) is probably a better option.
As for Cloudflare, I don't personally use it for my VPN server but I also don't think there are any downsides to it if you wanted to. You still would need the certificate/username and password with or without Cloudflare, so you have a few layers of security by default.
I generally use the default OpenVPN application, so that's what I'd recommend!
@@WunderTechTutorials Thank you for your reply!
Excellent video! Straight to the point with practical examples.
However, even I did managed to set up a VPN connection back to my DSM, the browser is showing the connection is not safe, should I worried about that? Is the connection really safe?
Thanks! As long as you're connected to the VPN and using the HTTPS port, all traffic will be encrypted.
@@WunderTechTutorials Wow i didn't expect i can still get response from a 2-year-old video. You are a really kind person. I hope your channel can blow up one day.
@@referencechat5127 Thanks so much! Really appreciate the kind words!
Howdy! I'd like to add the following information in case somebody else is in the same situation: My ISP uses a DS-Lite Tunnel for IPv4, therefore VPN access over IPv4 is impossible - no error message says so and it took me ten days to figure out this problem. In order to get around this DS-Lite tunnel, PCP is necessary. Alternatively, I'll see if Tailscale works. WebDAV might be another option because of the ports it uses.
If you're on a Fritz!Box Router, then you can tell you have this setup from your ISP by verifying that DS-Lite Tunnel is shown under "Internet, IPv4" under INTERNET->ONLINE-MONITOR.
Thanks for sharing!
Your videos about Synology have been very useful and are much appreciated. My problem is that I'm not sure what comes next, especially with the VPN.
I have successfully followed your video and have OpenVPN installed on the NAS and the client on Windows 11 (and connected successfully to the NAS).
What comes next? I have tried to use this to connect to the DSM (as I would with QuickConnect), and to try to connect to Synology Drive server, however, in both cases I cannot connect. I have the user account permission set to allow for both of these applications.
Any help will be appreciated.
Thanks! You will have to make sure you're on an external network first, and if you are and connected to the VPN, you should be able to access the NAS by its local IP address.
Great video. I've just recently purchased synology and finding your videos really helpful. Just have a quick question. I basically will be interacting with my NAS outside of my home using my phone through the use of synology apps like photo station. Currently I have quick connect set up, so when I take pictures those photos get auto backed up the nas even when outside the network. If I go down the VPN route, would you have to toggle the vpn and off all the time when you want to connect and backup photos? As I don't really need to use a vpn when using cellular network. Or is this where you would use split tunnel vpn so you leave it on when your out and then turn off and reconnect to home wifi when you return home? Quick connect seems really seamless in this respect, I just wondered if a VPN solution could be that seamless as well.
You hit the nail on the head, if you want to use the VPN and have it running 24/7, you most likely want to just keep the split-tunnel VPN enabled. As long as you have the split-tunnel VPN set up properly, it should be as seamless as QuickConnect, though more difficult to implement initially.
Great tutorial, but I am finding this error: --client-cert-not-required and --verify-client-cert require --mode server
yet if I change the mode then I have to remove pull option and change configs... What shall I do then?
Where can I find the initial setup video you mentioned at 1:29? Trying to figure out how to set up this firewall rule.
Here's the video! ua-cam.com/video/G3BJo4B1GgU/v-deo.html&ab_channel=WunderTech
Great guide. Could I technically register a domain name and use that instead of DuckDNS?
Also - video files seem to load forever when I try to view them remotely. Is there any way to speed that up?
Absolutely, just need to set up DDNS with the domain name.
As for the video files, if it's local video files, they'll be limited by your local upload speed. If they're remote videos, use a split-tunnel VPN to avoid that issue.
Hi, this video is great. I have one question, when you were configuring the VPN file you inserted a line that says no certificate required. As I understand, having a certificate would be even more secure right? Is it possible to do this in synology NAS?
That is correct, however, Synology's implementation doesn't utilize that (though it is possible to set it up from what I know through the terminal), which is why I added the line.
Hello! Thanks for the tutorial. everything works for me ( for info i have 2 nas and one router synology) BUT when i activate de vpn , I can only access in the dsm syno 1and pages internet, but i can't acces to the syno 2 and router on internet + I don't see my different network devices in my finder. Is it normal? thanks a lot
Are you using a firewall on the second Synology? If you are, can you disable it and see if it works? If it does, you will have to update the firewall rules.
Hi! The new settings in DSM 7.1 syn. VPN, ”verify CN” and ”TLS”, what do they do?
As far as I know (I haven't had a chance to test it), it strengthens the security of OpenVPN (which is very desirable).
I have a question in your write up. It says if I don't have a local DNS, I don't have to comment out anything and "This means that you won’t be able to access any of your local network resources by hostname, only IP address." For this line, I am not sure what it means and how it can affect me. I am still new to this, so having a hard time to understand this. Does this means I can't access other local address like if I have a locally run website, it can't open it?
Anyway having issue with still getting the following? error message: ssl_context_error: OpenSSLContext: CA not defined. Followed the written instructions and watched the video but can't seem to get pass this problem.
Excellent video ... super helpful. I've got a quick question - When i export the configuration and open the zip file, it doesn't contain the ca.crt file? Any ideas why that wouldn't be created, or if it's needed? When testing remotely as is, I get an error: Peer certificate verification failure - any thoughts on why that would occur would be appreciated.
Thanks so much! In summary, the Synology implementation of OpenVPN isn't particularly great. There are ways to strengthen it (and use certificates), but it's not standard functionality. That's why it's not generating.
@@albie1 Yes, you definitely need to keep that. You'll just want to paste the info above that (should be somewhere at the top).
Great tutorial. I have a question to clarify something. When OpenVPN setup is complete and is running, I am still able to connect from external network to my DSM, DS audio, DS file etc.
Port forwarding rules were deleted for everything except VPN and firewall rule is configured for VPN and Management services (5000 and 5001, Source IP allow all). How is possible if I don't have port forwarding for anything except VPN?
The way that a VPN works is that you are basically creating a secure tunnel back to your local network. So when you connect to that VPN, it's like you're sitting at your house (or wherever that VPN server is setup). With that in mind, the goal is to strictly be able to connect to that VPN (which is why one port is the only thing you need open). From there, you can navigate to local devices.
This is why it's the "safest" approach. You're opening one port, connecting with a certificate/username & password, then able to connect to any services that you'd like on that local network. Hope that this helps!
How about access remote for a mounted NAS on mac? Using smb is only for internal and if we outside the network the mounted NAS will be disconnected.
It should work if you're using a VPN. Connect to the VPN and then the mount should be accessible.
Up until recently, I had this package in my package centre. While watching this video I discovered that it's no longer there. Maybe that could be because of the Geographic location I'm currently living in, not sure. I'm hoping that it will be available again once DSM 7.2 is made available an I can install. I guess I'll need to put this video in my watch later folder.
It is possible that it's because of your location - I have seen that with other users before, but I'd check if Tailscale is blocked too. If it's not, it's a great alternative.
So, is not possibile to do a open vpn and open a port on the router if i have a dynamic ip with ddns? I’m searching info ‘cause i just boutht a synology and i have to set it this weekend
Are you behind a CGNAT? If it's just a Dynamic IP, you can use DDNS in the OpenVPN config file.
I've been following your guides to setup my Synology NAS. I've hit a bump. Everything went smoothly until I came to the part where it says "Export Configuration". The export file I get is not in the "zip" format you shown in your video. I get a ".json" file format. I found it to be really odd. Any ideas why that is and how that can be fixed?
Hi, this video is great!
I actually had my open VPN setup running from my Synology NAS perfectly in my office. I don't have a router that can do Static IP assignments, so as a workaround I used to login to the VPN from the network the VPN was connecting to so that I could remote into the machine that was accessing my network. However, I moved and switched ISP and now I can't do that anymore. If I'm on my network I can't login to the VPN. I had to redo the VPN configuration when I had the network up and running, but I changed nothing.
Do you happen to have any idea of what the issue might be?
If the IP address changes, have you considered using DDNS? Unless you're talking about local IP addresses and if you are, can you set it as static in the Network settings?
@@WunderTechTutorials Hey, I am using DDNS. After a lot of back and forth, I just decided to get a router that can do static IP tables to add the VPN subnet into the main network.
Curiously, with the new router I was able to log into the VPN from inside the network, so it must have been some weird firewall issue with the cheapo ISP router/modem
Yes Please explanation
I have got two Synology NAS servers in two different networks (locations). I have established openVPN connection between them (one of NAS is VPN host ,and the second is client). My aim is to connect/marge two LANs in one LAN. I just want to see all devices inside remote LAN as one with my current LAN.
What do I need to do that?
You would need to configure a site-to-site VPN which I don't think you'll be able to do with Synology devices.
thanks for this tutorial. Will I be able to stream media from my Jellyfin server hosted in Docker on DSM through this VPN to my android phones? I don't know what app to use on my android or how to import that config file. thx!
Yes! It should work as expected by using the same Jellyfin application that works on your local network.
@@WunderTechTutorials i followed the instructions and now I cant access the internet on ANY app on my phone... I am using split tunnel. I am wondering what I did wrong.
@@adamlewis3729 When you say you can't access anything, are you talking about external websites? Can you access your NAS? What do you have set as the DNS server?
so when you say remove the 'pound sign' to have it as a full-tunnel, is that # or £ ??
I'm from the UK and '£' is a 'pound sign'
Sorry! That would be the # sign!
I've got the exact same setup, which works fine for accessing stuff on my NAS (docker containers, DSM, etc.), but I wish to go a step further and access files on a running PC that shares the same local network as my Synology NAS (the one running VPN Server). Hoping that's possible without installing OpenVPN on Windows.
It should function the way it would function for other local devices on your network. Meaning if you're sharing something, you should be able to access it by local IP.
Concern: while traveling and using public Wi-Fi on my iPad I cannot connect to my NAS while on VPN (NORD in my case). If I switch over to OpenVPN (Tailscale for me) I can access my NAS but fear the public Wi-Fi IP is exposed since you can be connected via NORD and Tailscale. I had a terrible experience with public Wi-Fi and no VPN awhile back and just prefer to not access without VPN. Suggestions?
You will not be able to use Nord and Tailscale at the same time. I'm not too familiar with Tailscale (yet), but OpenVPN lets you set up full-tunnel VPN's. Full-tunnel VPN's route ALL traffic through the VPN tunnel which can be used for security purposes when on public Wi-Fi.
Very good tutorial, but i do want to understand what is happening, because without that knowledge i have less control over what i want, and what i am doing. Being a copy cat is not the way i want to make my connections more secure. I want to know that my files are safe, without that, i won't have the ease of mind even if i have the best possible security set up, because i don't know what exactly i just did.
All in all your tutorials are very good if you just want to set up all the things, and by giving a little explanation about the works of the things you are showing, you actually make it possible to go research. I have yet to read your written instructions, but if they have more explanation then ignore my previous comment on how i want more detailed tutorials.
Thanks for the feedback! I generally shy away from a lot of detail because the video would be 20-30 minutes as opposed to 10-15, but I completely understand why implementing something you don't understand isn't helpful. I'll keep it in mind for future videos!
This is a really great explanation! Very well detailed! I followed trough 3 or 4 times step by steps but I couldn't manage to make this work unfortunately...
I'm using Tunnelblick as a VPN client on a Mac and when I try to connect I get this error "TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)" and then "TLS handshake failed".
I must say Tunnelblick does not allow the addition of the line "client-cert-not-required". I mean that if I try and add it it gives me another error saying it need to be removed. Can this be the issue?
I wish I had advice on TunnelBlick, but is there any way that you can download the official OpenVPN app and see if that works? Then you can determine if it's a server (NAS) issue or client (Mac)?
@@WunderTechTutorials wow! Thank you for the quick reply! I tried with openVPN client too (added the line you indicated and no errors appeared), but it can't get through... it seems it can't reach the network... I must add that my NAS is connected to a 4G mobile network, can it be a double natting issue? Can it be so even considering I'm using a DDNS host?
@@SigCervelloCongelato It can definitely be a double-NAT issue. Can you try and find out if it is?
You can also use a port checker to see if the port is open from outside of your network. If it is in your router but NOT when checking, it could be double-NAT. In that case, Tailscale will probably be your best bet.
@@WunderTechTutorials great! Tailscale works like a charm! Thank you very much!
Great Video.. Thanks a lot. This video helped me . But I need one more favor..
I can connect my mobile with this open vpn.. but PC is not connecting
When you say that the PC is not connecting, are you testing from a separate network?
@@WunderTechTutorials yes.. i connected my pc with mobile network and then tried to connect vpn. Not connecting
@@bhairavtraders5530 Are you using the same exact configuration file? Assuming it is, there shouldn't be difference between mobile phone or PC.
@@WunderTechTutorials so its my kind request .. plz make a video and explain how we can connect pc ..
I am a bit confused and new to the Synology ecosystem. Should I use OpenVPN to access my Synology-NAS from a public network? Or can I just use my synology quickconnect id?
And can I use Open VPN in addition with Synology Drive to securely access my files? I appreciate any helpful feedback!
OpenVPN is an alternative to QuickConnect for accessing your NAS that a lot of people prefer (myself included). You can use both, but OpenVPN will allow you to access all of your local network devices as opposed to only the Synology services. Hope this helps, but let me know if I can answer anything else!
@@WunderTechTutorials thank you very much for the fast response! It definitely cleared up some confusions I had.
In fact, there is one more question that comes to my mind.
My Synology has automatically set up a S.M.A.R.T-Test that I run every three months. Is this the same test that runs when using "Data Scrubbing" on a Storage Pool?
I am currently watching pretty much every video you have on Synology to learn as much as I can. So it may well be that I still leave a comment under one or the other video. I find your videos very helpful, thanks for the great work!
@@schlicht. No, SMART tests run to check the health of your hard drive. Data scrubbing will actually fix issues on the data that exists on those hard drives if there are errors. Both are important, but do different things so keep both!
Hey, why do you have there *.crt file? Never seen it in my exported config on DSM 7 or 7.0.1. Do i even need that file for OpenVPN Connect? It only accepts PKCS#12 certificates. Thx
You can ignore those, you should only need the .ovpn file as that's all the Synology VPN server uses.
Clear and succinct video. Easy to follow as usual. However, there is more to this than a quick video. Like al your videos you emphasise safety and security. If the 'home' network is secured with a separate local DHCP server, a simple OpenVPN installation could give intermittent behaviour. Something very difficult to fault find. Addresses issued by the OpenVPN server are unlikely to correlate with any separate DHCP server you have set up. More so if you have taken steps to create subnets, then there wil be many attempts at reaching the devices on the home' network before you have success. Only to find that the next attempt(s) might fail. There is no way to point to a local DHCP server in the configuration supplied by Synology's dialog. For a solution you need to look into the configuration files of the OpenVPN server. This is a step that needs careful attention.
Totally agree! This is just the foundation of setting up OpenVPN.
@@WunderTechTutorials As you say in your notes, the Synology presentation of the OpenVPN server in itself is basic, whereas there is much more power to be leveraged from OpenVPN. I should add this was not a criticism but an observation based on my experience after following this install - it took about as long as your video to accomplish - beautifully tuned video! But then I was floored for an hour or so before I worked out the above behaviour pattern. Thanks for all your great work. It has been an eye opener on truly refined presentation skills!
@@grahamlambert5747 Couldn't agree more! OpenVPN is significantly more complex than Synology's implementation. I am hoping that it's enhanced in the future.
Great video - thank you so much, but I'm having an issue. I run PiHole on my Synology inside a docker container. When I edit the VPNConfig.ovpn file, I am adding the IP address of my NAS as the DNS server, but I am getting a 'looking up DNS name' which then fails. Any ideas?
Since you're using it on your NAS, you will have to use the bridge network interface. Did you follow my guide? If so, use the ph_bridge IP address and it will work. If you didn't follow my guide, you will have to go in and create a bridge network interface and use that IP as the DNS server IP and it should work!
@@WunderTechTutorials Amazing - thank you sir!