VPN on Synology and QNAP NAS: complete 2026 guide (WireGuard + OpenVPN)

A Synology NAS can run a WireGuard server (via Docker), and modern QNAP units offer native WireGuard in QTS 5.1 - no Docker required. This guide covers both paths, with realistic throughput expectations and the mistakes to avoid.

For a broader overview of self-hosted VPN options, start with our complete guide to the best self-hosted VPN solutions 2026.

Why run a VPN on your NAS

A home NAS runs 24/7. Its CPU is idle 90% of the time - might as well put it to work.

Four concrete use cases that justify the setup:

Remote LAN access: from a café or hotel, you access your drives as if you were home. File sharing, Surveillance Station, backup access - without exposing a single NAS port directly to the internet.

NAS data integration: if you have 20 TB of media on your NAS, a local VPN avoids going through the Synology/QNAP cloud relay (paid, limited, potentially slow). You access the LAN directly.

Single device: one device serves as NAS + VPN server + Plex + Pi-hole. No additional Raspberry Pi to manage.

Available idle CPU: a DS920+ consumes 15-20W idle. Adding WireGuard doesn't significantly change the electricity bill - the J4125 CPU encrypts in kernel mode with <5% impact on other services.

The honest limitation: unlike a cloud VPS, a power or internet outage at home cuts your VPN. For critical business travel use, keep a Contabo VPS as backup - see our self-hosted VPN on Contabo guide.

Synology vs QNAP: VPN setup comparison

Here's how the two platforms compare for VPN setup:

Verdict: If you already own a QNAP on QTS 5.1+, native WireGuard is a clear advantage - no Docker to manage. If you're on Synology, Docker WireGuard is a well-established, stable setup once configured.

Setting up VPN Server on Synology (OpenVPN/L2TP)

The simplest path to get started on DSM 7.2 without Docker.

Installation:

1. Package Center → Search "VPN Server" → Install
2. Open VPN Server → Choose OpenVPN or L2TP/IPSec
3. Enable the protocol and check "Allow VPN clients to access the server's local network"

OpenVPN configuration:

In VPN Server > OpenVPN > Advanced Settings:

• Network interface: eth0 (NAS Ethernet)
• Port: 1194 UDP
• Encryption: AES-256-CBC
• Check "Enable compression"

Port forwarding: on your router, forward UDP 1194 to the NAS local IP.

Dynamic DNS: Control Panel > External Access > DDNS. Choose "Synology" as provider - your-nas.synology.me is free. This will be the Endpoint in the client .ovpn config file.

Generating the client file: VPN Server > OpenVPN > Export Configuration. The .ovpn file is ready to import into OpenVPN Connect on iOS/Android/Windows.

OpenVPN throughput limitation on NAS: OpenVPN is notably slower than WireGuard on these CPUs, since AES encryption runs on a CPU without hardware AES-NI. Expect OpenVPN to deliver a fraction of WireGuard's throughput on the same NAS. If throughput matters, move to the WireGuard Docker section.

Setting up WireGuard on Synology via Docker

This is a well-proven production configuration. More performant than OpenVPN, slightly more technical to set up.

Prerequisites: DSM 7.2, Container Manager installed, at least 4 GB RAM on the NAS.

Step 1 - Create the config folder:

In File Station, create /volume1/docker/wireguard/.

Step 2 - Pull the image:

Container Manager > Registry > Search linuxserver/wireguard > Download (latest).

Step 3 - Create the container:

Container Manager > Container > Create > Use image linuxserver/wireguard.

Critical settings:

• Network mode: Host (required - allows the container to listen on the NAS network interface directly)
• Capabilities: NET_ADMIN, SYS_MODULE (add manually in advanced settings)

Environment variables:

PUID=1000
PGID=1000
TZ=Europe/London
SERVERURL=your-nas.synology.me
SERVERPORT=51820
PEERS=3
PEERDNS=auto
INTERNAL_SUBNET=10.13.13.0

Volumes:

/volume1/docker/wireguard → /config

Step 4 - Port forwarding:

DSM > Control Panel > Security > Firewall: allow UDP 51820 inbound. Router: UDP 51820 → NAS local IP.

Step 5 - Retrieve client configs:

After the container starts (30-60 seconds), in Container Manager > Container Logs, peer QR codes appear. Scan from the WireGuard mobile app. Client config files are also available at /volume1/docker/wireguard/peer1/peer1.conf.

What to expect: on a J4125-class CPU, WireGuard in Docker comfortably saturates a typical home fiber upload while leaving the CPU well below saturation, so other NAS services keep running smoothly.

For ready-to-use WireGuard templates adapted to different scenarios, check our WireGuard configuration templates 2026.

Setting up QVPN Service on QNAP (native WireGuard QTS 5.1+)

On a QNAP TS-464 (N5095, QTS 5.1.6), WireGuard is native - no Docker needed.

Installation:

App Center > Search "QVPN Service" > Install (free). Open QVPN Service from the main menu.

WireGuard configuration:

QVPN Service > VPN Server > WireGuard > Enable WireGuard Server.

Settings:

• Listening port: 51820 UDP
• Tunnel IP address: 10.6.0.1/24
• DNS: 1.1.1.1 (or NAS IP for local QNAP DNS)

Adding clients:

QVPN > Connection Accounts > Add VPN Account. Each account automatically generates a WireGuard key pair. Click the QR Code button to display the scannable QR from the WireGuard mobile app.

Port forwarding:

On your router, forward UDP 51820 to the QNAP IP. Use QNAP Cloud for free DDNS (*.myqnapcloud.com): App Center > myQNAPcloud > Enable.

Throughput note: the N5095 is a more capable CPU than the Celeron J4125 and handles WireGuard encryption with more headroom, so a TS-464 will generally sustain higher throughput at lower CPU usage than a J4125-class Synology unit.

For Tailscale exit node strategies on NAS, also see our Tailscale exit node complete guide 2026 - complementary to self-hosted VPN.

Outbound routing: sending NAS traffic through an external VPN

Different use case: you want the NAS itself to route internet traffic via NordVPN/Surfshark (to access geo-blocked content from Plex, or have Sonarr/Radarr exit from a different IP).

On Synology via Docker (NordVPN):

Use the ghcr.io/bubuntux/nordvpn image:

version: "3"
services:
  nordvpn:
    image: ghcr.io/bubuntux/nordvpn
    cap_add:
      - NET_ADMIN
    environment:
      - USER=your@email.com
      - PASS=your_password
      - CONNECT=France
      - TECHNOLOGY=NordLynx
      - NETWORK=192.168.1.0/24
    ports:
      - 8080:8080

Sonarr/Radarr containers placed in the same Docker network then use this connection.

Plex + outbound VPN use case: if you access Plex from a geo-restricted region (e.g. French content from Canada), routing through this tunnel bypasses the restriction. Note this doesn't exempt you from a valid Plex subscription.

On QNAP via QVPN: QVPN Service > VPN Client > Add Connection > WireGuard or OpenVPN (import the .ovpn file downloaded from NordVPN/Surfshark's website). Enable the connection. Verify the QNAP's outbound IP with curl ifconfig.me via SSH.

For advanced routing strategies with custom routing tables, see our self-hosted VPN on Raspberry Pi 5 guide - the IP forwarding principles apply to NAS as well.

Performance and security: benchmarks and hardening

WireGuard throughput depends primarily on the NAS CPU. Lower-end dual-core Celerons (J4025) are the slowest; quad-core J4125 units sit in the middle; newer Jasper Lake (N5095/N5105) and Ryzen (R1600) chips are the fastest. Below is a rough relative guide - your actual numbers depend on your CPU, fiber upload speed and concurrent NAS load, so benchmark your own setup with iperf3:

Security hardening (mandatory before exposing any port to the internet):

1. Admin MFA on DSM/QTS

Synology: Control Panel > User Account > 2-Step Verification → enable TOTP (Google Authenticator or Authy). QNAP: myQNAPcloud > Security Center > 2-Step Verification → TOTP. Never expose the DSM admin port (5000/5001) directly - only via VPN or reverse proxy.

2. Fail2ban and IP blocking

Synology DSM natively includes an auto-block system: Control Panel > Security > Protection > Automatically block IP addresses after X failed login attempts. Configure: 5 attempts, 24h block.

3. Firewall geo-block

Synology: Control Panel > Security > Firewall > Create rule > Allow only expected source countries (your home country + travel destinations). Block everything else. QNAP: QuFirewall (available in App Center) offers the same geo-blocking.

4. Minimal exposed ports

Only expose the WireGuard UDP port (51820). No DSM/QTS admin ports, no direct Plex port (use QuickConnect or via VPN only), no exposed SSH (use the VPN as a jump host).

Production CPU impact: WireGuard encryption is lightweight. On a quad-core J4125-class NAS, a sustained WireGuard transfer leaves plenty of CPU headroom for other services (such as Plex transcoding 1080p H.265 → H.264). WireGuard is light enough not to compromise typical NAS workloads.

For deeper coverage of VPN security strategies, see our complete guide to the best self-hosted VPN solutions 2026.