Technical Anshu
Tutorials Blog
🚪 Router Guide

Port Forwarding for Synology VPN The One Door That Must Open on Your Router

Nine out of ten 'VPN will not connect' problems live here, in one missing router rule. Set it once, by hand, and write it down.

✍️ Technical Anshu🌐 Router Setup⏱️ 10 minute fix
🎥 Watch the full Synology VPN setup in the video, step by step

The NAS can be perfectly configured and still invisible from the internet, because the router never agreed to pass the traffic on. This page explains what the forward actually does, creates the single rule OpenVPN needs, and ends with the only test that counts — a connection made from outside your house.

Router · Port Forwarding Rule
External port1194 UDP
Forward to192.168.1.10
Internal port1194
DescriptionSynology OpenVPN
One rule, written down. Every other port on this router stays closed.
1

Understand What the Router Is Blocking

Your router is a wall with one public address. When your phone knocks from the internet, the router has no idea the knock is meant for the NAS unless you leave a written instruction. That instruction is the port forward.

  1. Nothing reaches the NAS from outside until this rule exists — not even a login page
  2. The rule names three things: the outside port, the NAS address, the inside port
  3. This is why the NAS needed a fixed LAN address first. A forward to an address the NAS no longer holds points at empty space
2

Create the Rule for OpenVPN

  1. Log in to your router (its address is usually printed on the sticker, often 192.168.1.1)
  2. Find Port Forwarding — sometimes under WAN, NAT or Advanced
  3. Add a rule: external port 1194, protocol UDP, internal address = your NAS fixed address, internal port 1194
  4. Save, and note the rule in a document with your other network records

Using L2TP/IPSec instead? Forward UDP 500, 1701 and 4500 to the same address. OpenVPN stays the recommended choice — one port is easier to keep an eye on than three.

3

Allow the Same Traffic in the DSM Firewall

The router is only the outer wall. DSM has its own firewall, and it must agree.

  1. Open Control Panel → Security → Firewall and enable it if it is off
  2. Add or confirm a rule allowing the VPN Server (OpenVPN) application on UDP port 1194
  3. Keep the final deny rule at the bottom — allow rules must sit above it
4

Do Not Use UPnP as the Shortcut

DSM offers to open router ports automatically through UPnP (External Access → Router Configuration). It works, and that is the problem: any device or program on your network can also ask the router to open doors, silently. Create the one rule by hand, keep UPnP off on the router, and your network has exactly the openings you chose.

5

Test the Door From Truly Outside

  1. On your phone, switch Wi-Fi off so you are on mobile data
  2. Try the VPN connection. Connected means the rule, the firewall and the server all agree
  3. Still failing? Check for double NAT: if your ISP's modem is also a router and your own router sits behind it, the forward must exist on the outer box too, or that box must be set to bridge mode
  4. If the outer box belongs to the ISP and you cannot change it, read the CGNAT guide — the problem may be bigger than a missing rule

🎥 Watch the Complete Process in the Video

The video covers the NAS side of the setup; this page is the router half to keep beside it.

▶️ Watch Full Video
❓ Frequently Asked Questions

Which ports does Synology VPN Server need?

OpenVPN needs UDP 1194 by default. L2TP/IPSec needs UDP 500, 1701 and 4500. PPTP would need TCP 1723, but its encryption is broken and it should stay disabled.

I forwarded the port but the VPN still does not connect. Why?

Check in order: the NAS has a fixed LAN address and the rule points at it, the DSM firewall allows VPN Server, and your phone is testing on mobile data, not home Wi-Fi. Then check double NAT and CGNAT.

Is port forwarding dangerous?

A forward exposes exactly the service behind that port. Forwarding 1194 exposes your VPN server, which demands a valid username and password before anything else — that is the designed use. Forwarding DSM's admin ports (5000/5001) is the risky shortcut to avoid.

This guide is based on the Technical Anshu Synology NAS VPN video • Stuck on any step? Ask in the video comments — you will get a reply there 🙏