OpenVPN L2TP or PPTP on Synology VPN Server Which Protocol Should You Choose
The VPN Server package offers three protocols and no hint about which one deserves your trust. Here is the honest ranking, and the one you should simply never switch on.
✍️ Technical Anshu🗄️ Synology DSM⏱️ 5 minute read
🎥 Watch the full Synology VPN setup in the video, step by step
All three protocols will connect you. That is exactly the problem — a working connection tells you nothing about whether the road is private. This page grades the three doors on encryption, phone support and upkeep, so you enable the right one first and skip the experiment stage entirely.
VPN Server · Three Protocols Compared
OpenVPN · UDP 1194Recommended
L2TP/IPSec · UDP 500, 1701, 4500Backup
PPTP · TCP 1723Do not use
One package, three doors. They are not equal, and the difference is mostly about safety and phone support.
1
OpenVPN Is the Right Default
OpenVPN uses modern encryption, is open source, and is still actively developed. Synology's package lets you export one .ovpn file that works in the free OpenVPN Connect app on Windows, macOS, Android and iPhone.
One port to forward: 1194 UDP
Login is your DSM username and password, checked by the NAS itself
It keeps working even where a network blocks unusual traffic, because you can also move it to a different port later
For a home or small-office NAS, start here and you will rarely need the other two.
2
L2TP/IPSec Is the Built-In Backup
L2TP/IPSec needs no extra app on Windows or iPhone, which makes it a useful second door. But know its two honest limits before choosing it:
Android 12 and later removed native L2TP/IPSec support. On a current Android phone there is simply no L2TP option in the VPN settings
It uses a pre-shared key — one shared secret for every user. If that key leaks, anyone holding it plus any password can try the door
It needs three ports forwarded (UDP 500, 1701, 4500) and some hotels and offices block it
Use L2TP when a device cannot run the OpenVPN app. Use a long random pre-shared key, and never reuse it anywhere else.
3
PPTP Should Stay Switched Off
PPTP is in the list because very old devices support nothing else. Its encryption was broken many years ago and security researchers treat a PPTP connection as readable by a determined attacker.
There is no home situation in 2026 where PPTP is the only choice — the OpenVPN app runs on almost everything
Enabling it adds one more open door (TCP 1723) with the weakest lock of the three
If a guide tells you to start with PPTP because it is "easiest", that guide is saving you two minutes at the cost of the entire point of a VPN
🟡 The simple verdict. Enable OpenVPN only. Add L2TP/IPSec later only if a specific device forces you to. Leave PPTP off, permanently.
🎥 Watch the Complete Process in the Video
The video walks through enabling the server on the NAS — watch it once, then use this page to decide your protocol.
OpenVPN. It uses current, well-tested encryption and is still maintained. L2TP/IPSec is acceptable as a backup with a strong pre-shared key. PPTP's encryption is considered broken and should not be used.
Why does my Android phone have no L2TP option?
Google removed native L2TP/IPSec support from Android 12 onwards. On a modern Android phone, use the OpenVPN Connect app with the .ovpn file exported from your NAS instead.
Can I run OpenVPN and L2TP at the same time?
Yes. VPN Server lets you enable more than one protocol, and each needs its own ports forwarded on the router. Run both only if you genuinely have devices for each — every enabled protocol is one more door to look after.
This guide is based on the Technical Anshu Synology NAS VPN video • Stuck on any step? Ask in the video comments — you will get a reply there 🙏