VPN on Synology and QNAP NAS: complete 2026 guide (WireGuard + OpenVPN)

A Synology NAS can run a WireGuard server (via Docker), and modern QNAP units offer native WireGuard in QTS 5.1 - no Docker required. This guide covers both paths, with realistic throughput expectations and the mistakes to avoid.

For a broader overview of self-hosted VPN options, start with our complete guide to the best self-hosted VPN solutions 2026.

Why run a VPN on your NAS

A home NAS runs 24/7. Its CPU is idle 90% of the time - might as well put it to work.

Four concrete use cases that justify the setup:

Remote LAN access: from a café or hotel, you access your drives as if you were home. File sharing, Surveillance Station, backup access - without exposing a single NAS port directly to the internet.

NAS data integration: if you have 20 TB of media on your NAS, a local VPN avoids going through the Synology/QNAP cloud relay (paid, limited, potentially slow). You access the LAN directly.

Single device: one device serves as NAS + VPN server + Plex + Pi-hole. No additional Raspberry Pi to manage.

Available idle CPU: the NAS is powered on around the clock anyway, and WireGuard encryption is light, so adding it should not noticeably change the electricity bill or slow other services.

The honest limitation: unlike a cloud VPS, a power or internet outage at home cuts your VPN. For critical business travel use, keep a Contabo VPS as backup - see our self-hosted VPN on Contabo guide.

Check first: can the internet reach your NAS?

A VPN server on a NAS only works if a packet from outside can reach your router's public IP and be forwarded to the NAS. Many home lines no longer allow that. Behind carrier-grade NAT (CGNAT, addresses in 100.64.0.0/10) or DS-Lite (common on cable and fibre in Germany), your router has no public IPv4 of its own, so no port forward will ever work, whatever you configure in DSM or QTS. 4G/5G home routers are almost always in this case.

Two-minute test: compare the WAN address shown in your router's status page with your public IP. Our free WireGuard port checker makes the comparison for you and tells you whether you are behind CGNAT or double NAT, before you spend an evening on the steps below.

If you are behind CGNAT, three ways out:

1. Ask your ISP for a public IPv4. Some give one free on request, others charge for it or refuse.
2. Use a mesh service that traverses NAT. Tailscale is available in the Synology Package Center and the QNAP App Center and is free for personal use; the trade-off is that its coordination servers belong to a company.
3. Put a small VPS in front. WireGuard runs on the VPS, which has a public IP. The NAS connects to it as a client (an outbound connection, so CGNAT no longer matters) with PersistentKeepalive = 25, and your phone or laptop connect to the VPS. Speed is still capped by your home upload, as with any home VPN. Our WireGuard behind CGNAT guide gives the exact configs for both ends.

Synology vs QNAP: VPN setup comparison

Here's how the two platforms compare for VPN setup:

Verdict: If you already own a QNAP on QTS 5.1+, native WireGuard is a clear advantage - no Docker to manage. If you're on Synology, Docker WireGuard is a well-established, stable setup once configured.

Setting up VPN Server on Synology (OpenVPN/L2TP)

The simplest path to get started on DSM 7.2 without Docker.

Installation:

1. Package Center → Search "VPN Server" → Install
2. Open VPN Server → Choose OpenVPN or L2TP/IPSec
3. Enable the protocol and check "Allow VPN clients to access the server's local network"

OpenVPN configuration:

In VPN Server > OpenVPN > Advanced Settings:

• Network interface: eth0 (NAS Ethernet)
• Port: 1194 UDP
• Encryption: AES-256-CBC
• Check "Enable compression"

Port forwarding: on your router, forward UDP 1194 to the NAS local IP.

Dynamic DNS: Control Panel > External Access > DDNS. Choose "Synology" as provider - your-nas.synology.me is free. This will be the Endpoint in the client .ovpn config file.

Generating the client file: VPN Server > OpenVPN > Export Configuration. The .ovpn file is ready to import into OpenVPN Connect on iOS/Android/Windows.

OpenVPN throughput limitation on NAS: OpenVPN is usually slower than WireGuard on NAS CPUs: it runs in userspace and, on models whose CPU has no AES hardware acceleration, its AES encryption is done in software. WireGuard uses ChaCha20-Poly1305, which does not depend on AES-NI. Expect OpenVPN to deliver a fraction of WireGuard's throughput on the same NAS. If throughput matters, move to the WireGuard Docker section.

Setting up WireGuard on Synology via Docker

This is a widely documented configuration. More performant than OpenVPN, slightly more technical to set up.

Prerequisites: DSM 7.2, Container Manager installed, at least 4 GB RAM on the NAS.

Step 1 - Create the config folder:

In File Station, create /volume1/docker/wireguard/.

Step 2 - Pull the image:

Container Manager > Registry > Search linuxserver/wireguard > Download (latest).

Step 3 - Create the container:

Container Manager > Container > Create > Use image linuxserver/wireguard.

Critical settings:

• Network mode: Host (required - allows the container to listen on the NAS network interface directly)
• Capabilities: NET_ADMIN, SYS_MODULE (add manually in advanced settings)

Environment variables:

PUID=1000
PGID=1000
TZ=Europe/London
SERVERURL=your-nas.synology.me
SERVERPORT=51820
PEERS=3
PEERDNS=auto
INTERNAL_SUBNET=10.13.13.0

Volumes:

/volume1/docker/wireguard → /config

Step 4 - Port forwarding:

DSM > Control Panel > Security > Firewall: allow UDP 51820 inbound. Router: UDP 51820 → NAS local IP.

Step 5 - Retrieve client configs:

After the container starts (30-60 seconds), in Container Manager > Container Logs, peer QR codes appear. Scan from the WireGuard mobile app. Client config files are also available at /volume1/docker/wireguard/peer1/peer1.conf.

What to expect: on a J4125-class CPU, WireGuard in Docker comfortably saturates a typical home fiber upload while leaving the CPU well below saturation, so other NAS services keep running smoothly.

For ready-to-use WireGuard templates adapted to different scenarios, check our WireGuard configuration templates 2026.

Setting up QVPN Service on QNAP (native WireGuard QTS 5.1+)

On a QNAP TS-464 (N5095, QTS 5.1.6), WireGuard is native - no Docker needed.

Installation:

App Center > Search "QVPN Service" > Install (free). Open QVPN Service from the main menu.

WireGuard configuration:

QVPN Service > VPN Server > WireGuard > Enable WireGuard Server.

Settings:

• Listening port: 51820 UDP
• Tunnel IP address: 10.6.0.1/24
• DNS: 1.1.1.1 (or NAS IP for local QNAP DNS)

Adding clients:

QVPN > Connection Accounts > Add VPN Account. Each account automatically generates a WireGuard key pair. Click the QR Code button to display the scannable QR from the WireGuard mobile app.

Port forwarding:

On your router, forward UDP 51820 to the QNAP IP. Use QNAP Cloud for free DDNS (*.myqnapcloud.com): App Center > myQNAPcloud > Enable.

Throughput note: the N5095 is a more capable CPU than the Celeron J4125 and handles WireGuard encryption with more headroom, so a TS-464 will generally sustain higher throughput at lower CPU usage than a J4125-class Synology unit.

For Tailscale exit node strategies on NAS, also see our Tailscale exit node complete guide 2026 - complementary to self-hosted VPN.

Outbound routing: sending NAS traffic through an external VPN

Different use case: you want the NAS itself to route internet traffic via NordVPN / Surfshark (affiliate links) (to access geo-blocked content from Plex, or have Sonarr/Radarr exit from a different IP).

On Synology via Docker (NordVPN):

Use the ghcr.io/bubuntux/nordvpn image:

version: "3"
services:
  nordvpn:
    image: ghcr.io/bubuntux/nordvpn
    cap_add:
      - NET_ADMIN
    environment:
      - USER=your@email.com
      - PASS=your_password
      - CONNECT=France
      - TECHNOLOGY=NordLynx
      - NETWORK=192.168.1.0/24
    ports:
      - 8080:8080

Sonarr/Radarr containers placed in the same Docker network then use this connection.

Plex + outbound VPN use case: if you access Plex from a geo-restricted region (e.g. French content from Canada), routing through this tunnel bypasses the restriction. Note this doesn't exempt you from a valid Plex subscription.

On QNAP via QVPN: QVPN Service > VPN Client > Add Connection > WireGuard or OpenVPN (import the .ovpn file downloaded from NordVPN/Surfshark's website). Enable the connection. Verify the QNAP's outbound IP with curl ifconfig.me via SSH.

For advanced routing strategies with custom routing tables, see our self-hosted VPN on Raspberry Pi 5 guide - the IP forwarding principles apply to NAS as well.

Performance and security: benchmarks and hardening

WireGuard throughput depends primarily on the NAS CPU. Lower-end dual-core Celerons (J4025) are the slowest; quad-core J4125 units sit in the middle; newer Jasper Lake (N5095/N5105) and Ryzen (R1600) chips are the fastest. Below is a rough relative guide - your actual numbers depend on your CPU, fiber upload speed and concurrent NAS load, so benchmark your own setup with iperf3:

Security hardening (mandatory before exposing any port to the internet):

1. Admin MFA on DSM/QTS

Synology: Control Panel > User Account > 2-Step Verification → enable TOTP (Google Authenticator or Authy). QNAP: myQNAPcloud > Security Center > 2-Step Verification → TOTP. Never expose the DSM admin port (5000/5001) directly - only via VPN or reverse proxy.

2. Fail2ban and IP blocking

Synology DSM natively includes an auto-block system: Control Panel > Security > Protection > Automatically block IP addresses after X failed login attempts. Configure: 5 attempts, 24h block.

3. Firewall geo-block

Synology: Control Panel > Security > Firewall > Create rule > Allow only expected source countries (your home country + travel destinations). Block everything else. QNAP: QuFirewall (available in App Center) offers the same geo-blocking.

4. Minimal exposed ports

Only expose the WireGuard UDP port (51820). No DSM/QTS admin ports, no direct Plex port (use QuickConnect or via VPN only), no exposed SSH (use the VPN as a jump host).

CPU impact: WireGuard encryption is lightweight. On a quad-core J4125-class NAS, a sustained WireGuard transfer leaves plenty of CPU headroom for other services (such as Plex transcoding 1080p H.265 → H.264). WireGuard is light enough not to compromise typical NAS workloads.

For deeper coverage of VPN security strategies, see our complete guide to the best self-hosted VPN solutions 2026.