VPN on a NAS: Server vs Client (Synology & More, 2026)

A NAS can play two completely different VPN roles, and confusing them causes most of the trouble. A VPN Server turns the NAS into something you dial *into* from outside for remote access; a VPN Client makes the NAS route its own traffic *out* through a commercial VPN. They solve opposite problems, and on Synology's DSM they're separate features (kb.synology.com; wundertech, read 2026-09-10).

VPN Server: dialling into your home

A NAS VPN Server lets you securely reach your home network from anywhere. Synology's VPN Server package supports OpenVPN, L2TP/IPSec and PPTP, and once it's running you connect from a laptop or phone on the road as if you were at home — reaching files and devices on your LAN. This is remote access; it does not send your NAS's own traffic out through a third-party VPN.

Use this when your goal is getting *in*: accessing your own files while travelling, or reaching home devices securely. Avoid PPTP, which is obsolete and insecure; prefer OpenVPN.

VPN Client: sending the NAS's traffic out

A NAS VPN Client does the opposite: it connects the NAS to a commercial VPN so the NAS's own traffic leaves through the provider. On Synology, you add the provider's connection and enable "Use default gateway on remote network" to route the NAS's traffic through the VPN server. There's also an option to "Allow other network devices to connect through this Synology server's Internet connection," which can share that tunnel to the LAN — though for whole-home coverage a router VPN is usually cleaner (kb.synology.com, read 2026-09-10).

Use this when your goal is getting the NAS itself *out* through a VPN — for example so a download client or an app on the NAS uses the VPN rather than your bare connection.

Which one do you actually want?

Match the feature to the goal. If you want to reach your NAS from outside, set up the VPN Server. If you want the NAS's traffic to go out through a provider, set up the VPN Client. If you want *every* device in the house covered — including consoles and TVs — a router VPN is the better tool than routing everything through the NAS, and it's what our guide to what a VPN router is and how to set one up is built around.

Full-tunnel vs split-tunnel on the client

When the NAS runs as a VPN client, you choose how much of its traffic uses the tunnel. A full tunnel sends everything through the VPN; a split tunnel sends only some traffic (for instance, only traffic bound for the internet, while local network access stays direct). Synology's default-gateway setting is the switch that decides this, so set it deliberately based on whether you want all of the NAS's traffic protected or only some.

Setting up a Synology VPN client, in outline

If your goal is to send the NAS's traffic out through a commercial VPN, the Synology VPN Client is the tool. The steps are short, but the gateway setting is the one that actually decides the behaviour.

1. In DSM, open Control Panel then Network, and go to the Network Interface tab.
2. Create a new VPN profile and import your provider's OpenVPN configuration (or enter L2TP details).
3. Enable "Use default gateway on remote network" if you want the NAS's traffic to leave through the VPN.
4. Optionally enable sharing so LAN devices can use the connection — though a router VPN is usually better for that.
5. Connect, then verify the NAS's outbound IP shows the VPN server, not your ISP.

Common NAS VPN mistakes

A few mistakes come up again and again. The biggest is setting up a VPN *server* when you actually wanted the NAS's traffic to go *out* through a provider — the server is for dialling in, not routing out. Another is leaving PPTP enabled because it's the easiest option; it's insecure and should be avoided. And a third is expecting the NAS to cover the whole house: sharing its client connection to the LAN can work, but it's more fragile than simply running the VPN on the router.

QNAP, TrueNAS and the general rule

The same server-versus-client distinction applies beyond Synology. QNAP and TrueNAS can also act as a VPN server for remote access or run a VPN client for outbound traffic, sometimes via WireGuard, though the menus differ. Wherever you are, ask the one question that cuts through it: do you want to get *into* the NAS (server) or send the NAS *out* through a VPN (client)? For covering the rest of your hardware, pair this with the router approach and see router VPN vs app.

Why route a NAS through a VPN at all?

Running the NAS as a VPN client is a niche need, so it's worth being clear about when it makes sense. The typical reasons are wanting the NAS's own outbound traffic — a download client, a sync job, an app running on the NAS — to leave through a VPN rather than your bare connection, or wanting an app on the NAS to appear in another region. If that's not you, you probably don't need the client at all; you want the server for remote access, or nothing on the NAS and a router VPN for the network.

There's a legal-and-terms note here too, in keeping with our house rules: a VPN on a NAS is about privacy and legitimate access, not a licence to do anything you couldn't otherwise. It shifts the NAS's trust to the VPN provider rather than your ISP; it doesn't make the NAS anonymous, and a "no-logs" provider only counts if that claim is independently audited and dated.

For most people, the honest recommendation is the simplest split: use the NAS's VPN *server* if you need remote access into your home, and a router VPN if you want your devices' traffic — the NAS included — going out through a provider. Reserve the NAS VPN *client* for the specific case where only the NAS's own traffic needs to be tunnelled.

The whole topic gets simpler once you hold the server-versus-client distinction in your head: server to get in, client to send the NAS out, and a router VPN when you actually meant the whole network. Decide which of those three you want before you open a single menu, and the setup stops being confusing.