Related guides
Routing a Synology or QNAP NAS
Updated
The NAS is the device at home that needs the route most and gets the least attention: the downloader reaches overseas sources, Docker pulls images, Cloud Sync talks to overseas drives, Plex fetches metadata. A NAS cannot run Hiddify, but Synology and QNAP both ship an OpenVPN client — download one .ovpn from this site’s OpenVPN page, import it, and it reconnects at every boot. This guide covers where to import on each brand, the crucial “use default gateway” option, what to do after a password change, and why reaching the NAS from outside is a different job that belongs to the private network.
Two different jobs
Making the NAS itself take the route (downloads, image pulls, syncing overseas drives): OpenVPN, covered here.
Reaching the NAS from outside (opening shares on a trip, watching cameras): the private network (Tailscale), which puts the NAS and your phone in one private network — see the home-camera guide. The two do different jobs: OpenVPN connects the NAS to our routes, and the private network connects you to your home.
Synology
- Log in to the site, click a region flag on the OpenVPN page and download that region’s .ovpn file.
- Control Panel → Network → Network Interface → Create → Create VPN profile → OpenVPN (via importing a .ovpn file); enter your site email and password.
- “Use default gateway on remote network”: tick it so all outbound NAS traffic takes the route (downloads, Docker and Cloud Sync all benefit); untick it and only the tunnel exists while outbound traffic stays local. Nearly every scenario wants it ticked.
- Tick “Reconnect when the VPN connection is lost” so it recovers after reboots and route hiccups. Connect, then test a pull from a package.
QNAP
- Download the .ovpn the same way.
- QVPN Service → VPN Client → Add → OpenVPN, import the file, enter the credentials.
- In the connection settings tick “Use VPN as the NAS default gateway” and auto-reconnect, then connect.
What takes the route and what does not
- Takes the route: Download Station BT and HTTP tasks, Docker image pulls, Cloud Sync to Google Drive / Dropbox / OneDrive, Plex and Emby metadata, Package Center updates.
- Does not: your own LAN access to the NAS — it never leaves the LAN and is unaffected.
- Inside China, wanting Chinese sites direct: all outbound traffic from the NAS takes the route once OpenVPN is connected. For Chinese download tasks, use domestic mirror addresses, or connect only when needed.
Things to know
- The profile carries your credentials, and the password stored on the NAS stops working after a password change: download the .ovpn again and replace it, or edit only the password in the VPN profile.
- At account expiry the NAS disconnects; after renewing it reconnects on its own with the same profile.
- The NAS counts as one device within your tier’s online-device allowance (2 Personal, 4 Family, 8 Enterprise), shared with your other devices.
- The route uses UDP; a NAS on home broadband almost never meets UDP restrictions.
FAQ
With the default gateway ticked, can the LAN still reach the NAS?
Yes. LAN traffic does not pass through the gateway; shares, Plex playback and the admin page are unaffected.
Plex remote playback got slower after routing the NAS?
Remote playback uses the NAS’s outbound path, which now detours through the route. For remote playback, reach the NAS over the private network instead, or connect OpenVPN only when downloading.
Can only Download Station use the route?
Synology and QNAP have no per-application routing. For fine control, run a download container with its own OpenVPN in Docker (for example qbittorrent with gluetun) so only it takes the route.
What about a Linux-based NAS (TrueNAS, Unraid)?
Treat it as Linux: the openvpn package with the profile in /etc/openvpn/client/ — see the Linux server guide.