How-to: AirVPN on Synology DSM6 and DSM7 complete guide

[OWild 8]

On 8/30/2026 at 9:09 PM, lexsilico said:

Hi,
my syno config used to work for months without issue after following this guide.
But since a few weeks, it does not work anymore.
So I tried to delete my config on synology, generate a new one, and recreate a vpn profile on the syno.
But I get the same error as Rhorho above : autorization required.
Moreover, I see my connections in the VPN Sessions on the AIRVPN site.
Each time I try to connect on the syno, a new session is created. When clicking to diconnect, it takes several hours to disappear.
Any help appreciated.
Thanks

which DSM version do you use ?

[lexsilico 2]

14 hours ago, OWild said:

which DSM version do you use ?

I use DSM 6.2.4 which is the latest avail for my hardware.

Also I get some more logs trying to connect from command line : 

Sat Sep  5 11:00:03 2026 OpenVPN 2.3.17 powerpc-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar  2 2021
Sat Sep  5 11:00:03 2026 library versions: OpenSSL 1.0.2u-fips  20 Dec 2019, LZO 2.09
Sat Sep  5 11:00:03 2026 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Sep  5 11:00:03 2026 PLUGIN_INIT: POST /lib/openvpn/openvpn-down-root.so '[/lib/openvpn/openvpn-down-root.so] [/usr/syno/etc.defaults/synovpnclient/scripts/ip-down]' intercepted=PLUGIN_UP|PLUGIN_DOWN
Sat Sep  5 11:00:03 2026 WARNING: file 'client_key_o1788116283.key' is group or others accessible
Sat Sep  5 11:00:03 2026 WARNING: file 'ta_o1788116283.key' is group or others accessible
Sat Sep  5 11:00:03 2026 Control Channel Authentication: using 'ta_o1788116283.key' as a OpenVPN static key file
Sat Sep  5 11:00:03 2026 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep  5 11:00:03 2026 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep  5 11:00:03 2026 Socket Buffers: R=[112640->112640] S=[112640->112640]
Sat Sep  5 11:00:03 2026 UDPv4 link local: [undef]
Sat Sep  5 11:00:03 2026 UDPv4 link remote: [AF_INET]37.46.199.83:443
Sat Sep  5 11:00:03 2026 TLS: Initial packet from [AF_INET]37.46.199.83:443, sid=e7d2db9f d9647ba7
Sat Sep  5 11:00:03 2026 VERIFY OK: depth=1, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=airvpn.org CA, emailAddress=info@airvpn.org
Sat Sep  5 11:00:03 2026 Validating certificate key usage
Sat Sep  5 11:00:03 2026 ++ Certificate has key usage  00a0, expects 00a0
Sat Sep  5 11:00:03 2026 VERIFY KU OK
Sat Sep  5 11:00:03 2026 Validating certificate extended key usage
Sat Sep  5 11:00:03 2026 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Sep  5 11:00:03 2026 VERIFY EKU OK
Sat Sep  5 11:00:03 2026 VERIFY OK: depth=0, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=Fuyue, emailAddress=info@airvpn.org
Sat Sep  5 11:00:06 2026 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1550'
Sat Sep  5 11:00:06 2026 WARNING: 'cipher' is used inconsistently, local='cipher AES-256-CBC', remote='cipher AES-256-GCM'
Sat Sep  5 11:00:06 2026 WARNING: 'auth' is used inconsistently, local='auth SHA1', remote='auth [null-digest]'
Sat Sep  5 11:00:06 2026 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Sep  5 11:00:06 2026 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep  5 11:00:06 2026 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Sep  5 11:00:06 2026 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep  5 11:00:06 2026 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Sat Sep  5 11:00:06 2026 [Fuyue] Peer Connection Initiated with [AF_INET]37.46.199.83:443
Sat Sep  5 11:00:08 2026 SENT CONTROL [Fuyue]: 'PUSH_REQUEST' (status=1)
Sat Sep  5 11:00:08 2026 SYNO_ERR_AUTH
Sat Sep  5 11:00:08 2026 AUTH: Received control message: AUTH_FAILED,Data channel cipher negotiation failed (no shared cipher)
Sat Sep  5 11:00:08 2026 SIGTERM received, sending exit notification to peer
Sat Sep  5 11:00:13 2026 SENT CONTROL [Fuyue]: 'PUSH_REQUEST' (status=1)
Sat Sep  5 11:00:13 2026 PLUGIN_CLOSE: /lib/openvpn/openvpn-down-root.so
Sat Sep  5 11:00:13 2026 SIGTERM[soft,exit-with-notification] received, process exiting

Seems to be a pb with cipher but don't know where exactly

[Staff 10687]

38 minutes ago, lexsilico said:

Seems to be a pb with cipher but don't know where exactly

Hello!

Please upgrade to OpenVPN 2.4 or higher version, or switch to WireGuard alternatively. The OpenVPN version you're running doesn't support AES-GCM (or CHACHA20) on the Data Channel. Due to remarkable demand for DCO (Data Channel Offload kernel module to speed up OpenVPN throughput and make it more scalable through multiple threads) AirVPN servers, ever since migration to DCO was completed, do not support AES-CBC because its activation, even as a fallback cipher only, would cause global OpenVPN daemon Data Channel Offload de-activation. 

Kind regards
 

[lexsilico 2]

Thank you. However, I think it is not possible to upgrade to OpenVPN 2.4 on DSM6 which can only stick to OpenVPN 2.3.
Also I'm not able to install Wireguard client as tailscape package is not compatible with my Synology model DS413 because of CPU restriction.
So it seems I don't have any solution anymore to connect my DS413 

[OWild 8]

On 9/5/2026 at 12:10 PM, lexsilico said:

Thank you. However, I think it is not possible to upgrade to OpenVPN 2.4 on DSM6 which can only stick to OpenVPN 2.3.
Also I'm not able to install Wireguard client as tailscape package is not compatible with my Synology model DS413 because of CPU restriction.
So it seems I don't have any solution anymore to connect my DS413 

@lexsilico Did you try the tip I send the 01/26/2026 (the last sentence) ?
 

Quote

I have synology DSM6

1. Synology quickconnect seems to have issue (message = error, check network or DNS) with UDP now, so i have to generate .ovpn file with TCP instead. And now quickconnect works. Who knows ?!?!

2. I have never toggled "Separate keys/certs from .ovpn file" button in the past but just the .ovpn file. Everything went fine as long as i specify "tls-auth, for 2.3" (not tls-crypt or >2.3). But now the config generator generate different .ovpn file  and I have the message ".ovpn files contains invalid parameters". So I have to replace lines with data-ciphers and data-ciphers-fallback by one single line with "cipher AES-256-CBC".
It's the same result than to do "set the "OpenVPN profile" combo box to "2.4"" but it's not natural to choose 2.3 on the left side and 2.4 on right side of the page...

My two cents