Using a VPN on Synology NAS

NordVPN is the best VPN for Synology NAS for most users, particularly when the NAS needs an outbound VPN connection for Download Station, containers, or other DSM traffic. ProtonVPN is the more interesting option when port forwarding or inbound connectivity through the commercial VPN is important, while Private Internet Access is especially useful when you want downloadable OpenVPN profiles and more control over the remote endpoint.

The important distinction is that a commercial VPN connected through DSM and Synology’s own VPN Server package solve opposite problems. DSM can establish an outbound VPN tunnel to a provider so NAS traffic exits through that provider. VPN Server turns the NAS itself into an OpenVPN, L2TP/IPsec, or PPTP server so you can connect back into your home network remotely. Installing a commercial VPN does not automatically make your Synology NAS remotely accessible through that VPN.

Best VPNs for Synology NAS compared

Why a Synology NAS behaves differently from a normal VPN device

A desktop VPN application controls routing itself. On a Synology NAS, the VPN provider normally does not supply a native DSM application. Instead, DSM establishes the connection through Control Panel → Network → Network Interface using a manually configured VPN profile.

That introduces several Synology-specific variables:

• DSM protocol support: a provider must expose a protocol and configuration format DSM can actually use.
• OpenVPN configuration: DSM can import an .ovpn profile, but provider-specific authentication and certificate files may also be required.
• Default gateway: DSM determines whether NAS traffic is sent through the remote VPN gateway.
• Inbound services: a VPN tunnel can interfere with connections coming into Plex, WebDAV, Synology Drive, Docker containers, or other NAS services.
• Port forwarding: forwarding a port on your home router does not automatically forward the same port through a commercial VPN provider.
• Reconnect behavior: an unattended NAS needs to recover cleanly after the VPN endpoint, WAN connection, router, or NAS restarts.

This is why the best Synology VPN is not necessarily the provider with the fastest desktop application. Native apps, browser extensions, GPS spoofing, and most desktop-only features are irrelevant when DSM itself is the VPN client.

1. NordVPN – best VPN for Synology NAS overall

Visit NordVPN

NordVPN takes first place because its manual OpenVPN support maps cleanly to the VPN client already built into DSM. You do not need a NordVPN package installed through Synology Package Center.

The practical setup is to download an OpenVPN configuration for the NordVPN endpoint you want, create a new VPN profile under DSM’s Network Interface settings, import the configuration, and authenticate with the service credentials intended for manual VPN connections.

For a NAS, this is more important than NordLynx. NordLynx is NordVPN’s WireGuard-derived protocol and is preferable on many desktop and mobile devices, but stock DSM’s VPN-profile workflow is built around protocols such as OpenVPN rather than NordLynx. Selecting NordVPN specifically because NordLynx benchmarks well on Windows therefore misses the Synology use case.

Another Synology-specific consideration is the default gateway option. If Use default gateway on remote network is enabled, outbound NAS traffic can follow NordVPN. That can be desirable for Download Station or container traffic, but it can also change how remotely exposed NAS applications behave.

If you run Synology Drive, Plex, WebDAV, a reverse proxy, or another externally reachable application, test those services after changing the default route rather than assuming the existing router port-forwarding rules will continue to behave identically.

Best fit: Synology owners who want a straightforward outbound OpenVPN tunnel for NAS traffic without maintaining an unofficial VPN application inside DSM.

2. ProtonVPN – best when NAS port forwarding matters

Visit ProtonVPN

ProtonVPN is particularly interesting for Synology users whose NAS workload needs more than a simple outbound IP change.

DSM can use ProtonVPN through manually generated OpenVPN configurations. Proton also supports WireGuard configurations, but that distinction matters because WireGuard is not exposed as a normal native DSM VPN-profile type on a standard installation. Using WireGuard directly on the NAS generally requires a containerized or otherwise custom deployment rather than the basic Network Interface workflow.

The more NAS-specific issue is port forwarding. Applications such as BitTorrent clients running in Docker or Container Manager may need an incoming port to obtain the connectivity model the user expects. A port forwarded by the commercial VPN must be treated separately from a port forwarded by your home router.

This is where NAS VPN configurations frequently become confusing. Suppose DSM sends container traffic through ProtonVPN. Opening TCP or UDP port 50000 on your router does not mean unsolicited traffic arriving at Proton’s VPN endpoint will be forwarded through the tunnel to that container. The VPN-side forwarding mechanism has to support that path as well.

If you use ProtonVPN for a Synology-hosted downloader, verify the forwarded port inside the application rather than assuming that establishing the tunnel is sufficient.

Best fit: users running network services or containers on their Synology where VPN-side inbound connectivity matters in addition to outbound encryption.

3. Private Internet Access – best for DSM OpenVPN configuration control

Visit Private Internet Access

Private Internet Access is a strong Synology option because its manual OpenVPN ecosystem gives you considerably more control than a normal one-click NAS setup.

For DSM, downloadable OpenVPN profiles are especially valuable because the NAS does not need the polished Windows or macOS client supplied by the VPN company. DSM only needs a compatible endpoint, configuration, certificates where required, and valid authentication credentials.

This also makes PIA useful when you maintain more than one NAS VPN profile. You can, for example, create configurations for different server regions and keep them available under Network Interface rather than replacing the same connection every time.

The drawback is that DSM does not reproduce all of PIA’s desktop-client routing controls. Split tunneling configured inside the PIA Windows application does not magically appear when DSM imports an OpenVPN file.

If only one Synology workload should use PIA while DSM management, Plex, Synology Drive, or other services should retain the ordinary WAN route, a container-level VPN architecture can be cleaner than making PIA the NAS-wide default gateway.

Best fit: users who want several manually controlled OpenVPN endpoints or who expect to experiment with the VPN route rather than configure it once and forget it.

4. Surfshark – good for a Synology NAS in a larger device setup

Visit Surfshark

Surfshark makes sense when the Synology NAS is only one component of a larger VPN deployment.

For DSM itself, the important feature is not Surfshark’s consumer application. It is access to manual OpenVPN configurations that can be imported into DSM. That allows the NAS to establish its own tunnel independently of Surfshark running on PCs, phones, TVs, or other devices.

The unlimited-device model can be attractive in this specific scenario because the NAS does not have to replace another active VPN client. The same account can cover the permanently connected NAS alongside the devices that leave the network.

As with NordVPN, Surfshark’s WireGuard support should not be confused with native DSM WireGuard support. If you want DSM’s ordinary graphical VPN interface rather than Docker or third-party packages, OpenVPN is the more straightforward route.

We would also avoid routing the entire NAS through Surfshark solely because the NAS hosts one downloader. If the system also runs externally accessed applications, isolating the VPN-dependent workload in Container Manager can avoid routing conflicts.

Best fit: users who already want Surfshark across many devices and also need the Synology NAS to maintain its own independent VPN connection.

5. ExpressVPN – best for a relatively simple Synology tunnel

Visit ExpressVPN

ExpressVPN is most suitable when the Synology requirement is simply to send outbound traffic through a manually configured VPN endpoint.

The distinction between ExpressVPN on a computer and ExpressVPN on DSM is significant. Lightway is one of the provider’s defining protocols on supported applications, but a conventional Synology configuration does not run the ExpressVPN desktop application. DSM instead works with the manual configuration that can be imported into its own VPN client.

That means you should judge ExpressVPN here by the stability of the manual connection rather than features exposed inside its native apps.

A common Synology deployment is to enable the VPN as the remote default gateway and then discover that an externally accessed NAS service behaves differently. If that happens, verify DSM’s routing first. Reinstalling Synology Drive, Plex, or the ExpressVPN profile is unlikely to solve a return-path problem caused by the NAS sending replies through a different gateway.

Best fit: Synology users who need a conventional outbound tunnel and do not require unusual DSM-side routing or VPN port-forwarding features.

6. CyberGhost – useful when you want a dedicated NAS OpenVPN profile

Visit Cyberghost

CyberGhost is a reasonable Synology choice when you want to generate a manual VPN configuration and leave the NAS attached to a particular VPN location.

That is more relevant here than CyberGhost’s streaming-oriented application features. DSM is not selecting one of CyberGhost’s desktop presets; it is establishing an OpenVPN tunnel from a stored network profile.

For an always-running NAS, endpoint choice should also be more conservative than it might be on a laptop. A nearby server generally reduces the additional latency and routing distance affecting package downloads, container image pulls, cloud synchronization, metadata requests, and other NAS operations that may use the default route.

If CyberGhost is only required for a downloader running on the NAS, consider whether that application can be isolated behind its own VPN container. Sending DSM update checks, backup jobs, Synology account traffic, reverse-proxy connections, and every other NAS service through the same tunnel may create more routing complexity than the original workload requires.

Best fit: users who want a relatively static OpenVPN configuration for selected NAS traffic rather than advanced DSM networking.

7. IPVanish – suitable for basic OpenVPN tunneling on Synology

Visit IPVanish

IPVanish fits the conventional Synology deployment: download an OpenVPN configuration, create the corresponding DSM VPN profile, and let the NAS establish the tunnel itself.

This is sufficient when the goal is to give outbound NAS traffic a VPN route, but it does not turn IPVanish’s desktop client features into DSM features.

That difference becomes particularly important when troubleshooting. If an application running on the NAS works over the normal WAN connection but stops communicating after IPVanish becomes the default gateway, the correct diagnostic path is DSM networking and routing. Changing settings inside the IPVanish Windows application on another computer cannot affect a tunnel established independently by the NAS.

We would rank IPVanish lower for more elaborate Synology deployments where inbound VPN port mapping, container-specific routing, or sophisticated policy routing is part of the requirement.

Best fit: users who primarily need a standard OpenVPN exit connection from the NAS without building a more complicated VPN gateway architecture.

Commercial VPN client vs Synology VPN Server

These configurations are frequently confused, but the direction of the connection is completely different.

Synology’s VPN Server package can turn supported NAS models into a VPN server providing remote access to the private network. Synology documents support for OpenVPN, L2TP/IPsec, and PPTP in VPN Server. That functionality is independent of connecting DSM to NordVPN, ProtonVPN, PIA, or another commercial provider.

If your objective is to connect a laptop back to your NAS while traveling, you probably need VPN Server on the Synology, not a commercial VPN client on the Synology.

If your objective is for Download Station or another NAS-hosted process to appear on the internet using a commercial VPN address, you need the outbound VPN client configuration.

How OpenVPN works on a Synology NAS

DSM can create an OpenVPN client profile under its network-interface settings. The normal workflow is:

1. Download the appropriate .ovpn configuration from the VPN provider.
2. Open DSM and go to Control Panel → Network → Network Interface.
3. Create a new VPN profile.
4. Select OpenVPN and import the provider’s configuration.
5. Supply the VPN credentials and any additional certificate or key files required by that provider.
6. Choose whether DSM should use the VPN connection as the default gateway.
7. Connect the profile and verify the NAS’s outbound IP address.

The final step matters. Seeing “Connected” in DSM verifies that DSM established a tunnel, but you should still verify that the specific application you care about is actually using that route.

For example, if Download Station is the reason you installed the VPN, test its effective outbound connectivity. If a Docker container is the target, verify traffic from inside that container rather than testing only DSM itself.

Why WireGuard is more complicated on Synology DSM

WireGuard creates an important compatibility trap when comparing VPN providers for a Synology NAS.

Many commercial VPNs now promote WireGuard or a WireGuard-derived protocol:

• NordVPN uses NordLynx;
• Surfshark supports WireGuard;
• ProtonVPN supports WireGuard;
• PIA supports WireGuard.

That does not mean DSM’s normal VPN-profile interface can use those protocols directly.

A provider can therefore be excellent over WireGuard on Windows or Linux while its OpenVPN implementation remains the part that matters for a stock Synology installation.

Advanced Synology users can run WireGuard through containers or community-developed solutions on compatible hardware and DSM versions. Once you do that, however, you have moved beyond the standard DSM VPN-client configuration and need to manage routing, persistence, permissions, container networking, and updates yourself.

For most users, OpenVPN remains the less complicated Synology route even when the same provider would use WireGuard on other devices.

Should the entire Synology NAS use the VPN?

Not necessarily.

Suppose your NAS simultaneously runs:

• Download Station;
• Plex Media Server;
• Synology Drive;
• Hyper Backup;
• Container Manager;
• a reverse proxy;
• remote DSM administration.

Making the VPN connection DSM’s default gateway can affect all outbound connections originating from the NAS. That is substantially different from enabling a VPN only for one downloader.

If only one container requires the commercial VPN, a common architecture is:

internet → VPN container → application container

while DSM and unrelated Synology applications continue using the normal LAN gateway.

This keeps the VPN dependency isolated. If the VPN endpoint fails, the affected workload can be stopped without also changing the route used by DSM, Synology Drive, backup applications, and other services.

Why Plex, Synology Drive or remote DSM access may break after enabling a VPN

The problem is frequently asymmetric routing rather than a failed VPN connection.

Consider a NAS with a normal home IP route:

remote client → home router → Synology NAS

The NAS receives the incoming packet through the router. If the commercial VPN has subsequently become DSM’s default outbound gateway, the reply may attempt to leave through:

Synology NAS → VPN tunnel → VPN provider

instead of returning through the connection that received the request.

The remote client can then see a failed connection even though both the VPN and the Synology service are individually working.

This is why enabling Use default gateway on remote network should be treated as a routing change, not merely as a privacy switch.

Why router port forwarding may stop working through a Synology VPN

Your router controls the public IP address supplied by your ISP. A commercial VPN supplies a different public IP at the VPN exit server.

Those are two separate NAT boundaries.

A router rule such as:

WAN TCP 32400 → Synology TCP 32400

can forward traffic arriving at your ISP address to Plex on the NAS.

It does not tell NordVPN, ProtonVPN, PIA, or another provider to forward TCP 32400 from the VPN provider’s public address through the tunnel.

If an application must accept unsolicited inbound connections through the VPN address, the provider needs a compatible port-forwarding mechanism and the application has to listen on the assigned port.

What to do if your Synology loses internet access after connecting the VPN

DSM says the VPN is connected but packages cannot reach the internet

Check whether the imported profile successfully provides a usable route and DNS resolution. Disconnect the VPN temporarily. If connectivity immediately returns, you have isolated the problem to the VPN profile or its routing rather than the NAS’s physical Ethernet connection.

The VPN stopped connecting after the provider changed its servers

Download a current OpenVPN configuration from the provider and create or update the DSM profile. A NAS may keep using the same imported configuration for months, so endpoint or certificate changes can affect an unattended installation long after the original setup.

Download Station works without the VPN but not with it

First verify that the selected VPN server is reachable and that DSM itself can access the internet through the tunnel. If DSM works but Download Station does not, investigate the application’s ports and routing rather than repeatedly replacing the VPN profile.

Plex remote access disappears when the VPN connects

Check whether the VPN has become DSM’s default gateway. Plex may still receive traffic through the home router while the NAS attempts to return that traffic over the VPN interface.

A Docker container uses the normal ISP IP instead of the VPN IP

Do not assume DSM’s active VPN profile automatically establishes the container routing architecture you intended. Verify the container’s own network namespace and effective outbound IP. For strict isolation, route the application through a dedicated VPN container instead.

The NAS reconnects to the VPN but an application remains offline

Long-running TCP sessions do not necessarily survive a tunnel failure and reconnection. Restart or reconnect the affected application after the VPN interface has returned, particularly when the VPN reconnects with a different endpoint or public IP.

Which VPN should you choose for Synology NAS?

For most DSM installations, NordVPN is the strongest overall choice because its manual OpenVPN configuration fits the standard Synology VPN-client workflow without requiring an unofficial native DSM application.

Choose ProtonVPN when your Synology workload makes VPN-side port forwarding particularly important, especially for applications running inside Container Manager.

Private Internet Access is a strong alternative when you want several OpenVPN configurations and greater control over the endpoints stored in DSM, while Surfshark makes sense when the NAS is one of many devices that will use the same VPN subscription.

The most important design decision comes before the provider choice: decide whether you actually want the entire NAS behind the VPN or only a specific Synology application or container. That choice determines the routing architecture and can have a much larger effect on reliability than switching between two reputable VPN providers.

Frequently asked questions

Can I install NordVPN directly on a Synology NAS?

You normally do not need a native NordVPN DSM application. A standard approach is to download a compatible NordVPN OpenVPN configuration and import it into the VPN client available under DSM’s Network Interface settings.

Does Synology DSM support OpenVPN?

Yes. DSM can create an outbound OpenVPN client profile, and Synology’s separate VPN Server package can also provide OpenVPN-based remote access. These are different configurations: one connects the NAS outward to a VPN server, while the other allows remote clients to connect inward to the NAS network.

Does Synology DSM support WireGuard?

WireGuard is not normally presented as a standard VPN-client profile alongside OpenVPN and L2TP/IPsec in DSM’s graphical Network Interface workflow. WireGuard deployments on a Synology NAS therefore commonly use containers or other custom solutions rather than the basic DSM VPN-profile setup.

Can I use a VPN only for Download Station on Synology?

It is possible to design the network so only the desired workload uses the VPN, but making DSM’s VPN connection the default gateway can affect other NAS traffic as well. If strict separation is important, running the downloader in a container routed through a dedicated VPN container gives you more explicit control.

Why can’t I access my Synology remotely after connecting a VPN?

The VPN may have changed the NAS’s default route. An incoming connection can arrive through your router while the NAS tries to send the reply through the VPN tunnel, creating asymmetric routing. Test remote services after enabling the VPN as the default gateway.

Does QuickConnect require the commercial VPN on my Synology?

No. QuickConnect is Synology’s own remote-access mechanism. Connecting DSM to a commercial VPN serves a different purpose and is not required for QuickConnect.

Can a Synology NAS be both a VPN client and VPN server?

The concepts are separate. The NAS can use a VPN client profile for outbound traffic while Synology’s VPN Server package provides remote access, but running both increases routing complexity. You need to make sure remote VPN clients, LAN subnets, the commercial VPN route, and DSM’s default gateway do not conflict.

Should I enable “Use default gateway on remote network” in DSM?

Enable it when you actually want outbound NAS traffic to use the commercial VPN as its default route. Do not enable it automatically just because you created a VPN profile. On a NAS hosting remotely accessible services, changing the default gateway can alter Plex, Synology Drive, reverse-proxy, container, backup, and remote-management connectivity.

Do I still need Synology VPN Server if I use NordVPN, ProtonVPN or PIA?

Possibly, because they solve different problems. NordVPN, ProtonVPN, PIA, and similar providers can give the NAS an outbound VPN connection. Synology VPN Server is used when you want a remote laptop or phone to establish a VPN connection back into the network containing your NAS.