Search the Community

Hello everyone, I’m facing an issue with my current setup and would appreciate your help. Here’s my configuration: • NAS Synology, DSM 7.2.2 • OpenVPN profile set up in the network interface • I followed this tutorial for the setup: (How-to: AirVPN on Synology DSM6 and DSM7 complete guide) • Port forwarding works fine with Download Station For several weeks now, I’ve been experiencing frequent VPN disconnections without any clear explanation. For over a year, I didn’t have any issues—my sessions were stable for weeks or even months. However, recently, my connections keep dropping, and I lose port forwarding. Oddly, on the AirVPN “Session” page, the connection still appears active. On the port forwarding page, I get the error “Connection timed out 110.” In DSM, the default gateway switches to LAN when the connection drops, even though the network interface shows that I’m still connected. I’ve tried changing servers and updating everything, but the problem persists. This is quite frustrating because when the connection drops, port forwarding with Download Station becomes ineffective, leaving me unprotected. If anyone has any ideas or solutions, I’d greatly appreciate your input. Thanks in advance for your help!

I have installed WireGuard on my Synology. Does anyoe know if there is a way to connect? My configuration looks like this, but no connection is being established, and I am getting an error message.

Hello all, This is collection from different tutorials which I will refer here, but usually changed since some things changed. Setting up VPN on Synology is modified neolefort tutorial from here and reconnect script if from sundi which you can find here, which probably modified this script, plus my iptables for blocking Synology on router level when VPN fails. Other contributions: foobar666 - you no longer need to enter variables manually _sinnerman_ - fixed script for DS 6.1 I'm doing this mostly because I usually forget things I managed to solve after year or two, so this is way to have constant reminder how it was solved and also help others. 1. Get your certificates from AirVPN. Go to the https://airvpn.org/generator/ page to generate the configuration file. (1) SELECT the Advanced Mode (under "Config generator" title ) (2) SELECT LINUX OS (3) Under "Protocols" section select one with protocol UDP, port 443 and tls-auth in the right column (at the time of writing, it was in middle of the list). You can choose any combination of protocol/port, but then also change iptables accordingly if you are using failsafe script. Don't choose any combination which has tls-crypt in the right column. (4) Under "Advanced - OpenVPN only" section (right part of page), toggle "Separate keys/certs from .ovpn file" button and change/leave OpenVPN version to 2.5 (This works in DSM 7.2.1. For older versions you will maybe have to select OpenVPN version 2.4). (5) SELECT 1 SERVER (refer to section "by single servers") OR COUNTRY OR ANYTHING ELSE YOU WANT In original tutorial, neolefort said to choose 1 server, because in that case you will get IP instead of xxx.airvpn.org domain. Choosing 1 server is safe because it doesn't need working DNS when you want to connect to VPN. If you choose anything else, you need working DNS on your router when establishing VPN connection. (6) Click "GENERATE" at the bottom. (7) Page will reload with links on top to your files, save them to you computer. Following files will be generated: -AirVPN_XXXXX_UDP-443.ovpn -ca.crt -user.crt -user.key -ta.key 2. Setup AirVPN on Synology. - Login as admin or with user from Administrator group. - Open Control panel. - Go "Network" and click on tab "Network Interface" - Click on button "Create" - "Create VPN profile" - Choose "OpenVPN (via importing .ovpn file)" - Click "Advanced options" so it shows all options - Profile name: anything you want, but please keep is short and if you can without spaces " ", for example "AirVPN". - User name: LEAVE EMPTY (for DSM 7+ just put anything here) - Password: LEAVE EMPTY (for DSM 7+ just put anything here) - Import .ovpn file: click button and import your AirVPN_XXXXX_UDP-443.ovpn - CA certificate: click button and import your ca.crt - Client certificate: click button and import your user.crt - Client key: click button and import your user.key - Certificate revocation: LEAVE EMPTY - TLS-auth key: click button and import your ta.key - Click "Next" - Select all options and click "Done" Now you have working OpenVPN link on your Synology. You just need to start it from "Control panel" - "Network" - "Network Interface". If you want to make your connection faster, you can remove some ciphers. Look for this line in .ovpn file: data-ciphers AES-256-GCM:AES-256-CBC:AES-192-GCM:AES-192-CBC:AES-128-GCM:AES-128-CBC And change it to this: data-ciphers AES-128-GCM Then save file and create new connection with it. After some testing I found out AES-128-GCM is fastest from all other mentioned in settings. You can also test other ciphers your self and leave one you find fastest. EXTRAS!!! 3. Setting up external access to your Synology. First what you will notice is, "I CAN'T ACCESS MY SYNOLOGY FROM OUTSIDE OF MY LAN!!!!!!! OMG OMG OMG!!!!" I will not explain port fowards on your router here, if you don't know how to make one, learn! (1) You can port forward trough AirVPN webpage and access your Syno via VPN exit IP. This sometimes works, most of times it doesn't since Syno has some ports you cannot change. Anyway, change your default HTTP / HTTPS port on Syno to your forwarded AirVPN port and you should be fine. But forget about Cloudstation and similliar things. (2) If you want to access Syno via you ISP IP (WAN), then problem is, your Syno is receiving your connection, but it's replying trough VPN. That's a security risk and those connections get droped. But there is solution! - Access "Control panel" - "Network" - "General" - Click "Advanced Settings" button - Mark "Enable multiple gateways" and click "OK" and then "Apply" You're done! It's working now (if you forwarded good ports on your router). 4. Prevent leaks when VPN connection on Synology fails. There will be time, when you VPN will fail, drop, disconnect, and your ISP IP will become visible to world. This is one of ways you can prevent it, on router level. For this you need Tomato, Merlin, DD-WRT or OpenWRT firmware on your router. I will tell you steps for Tomato router. If you are using different firmware, then you need to learn alone how to input this code into your router. Since Shibby version 129 for ARM routers, syntax of iptables changed and depending on which version of iptables you are using, apply that code. - Login to your router (usually just by entering 192.168.1.1 into your browser, if your IP is different, find out which is your gateway IP). - Click on "Administration" - Click on "Scripts" - Choose tab "Firewall" For Shibby v129 for ARM and later (iptables 1.4.x) us this: #Use this order of commands because it executes in reverse order. #This command will execute last, it kills all UDP requests. iptables -I FORWARD -p udp -s 192.168.1.100 -j REJECT #This command will execute second and will block all TCP source ports except those needed for web access or services iptables -I FORWARD -p tcp -s 192.168.1.100 -m multiport ! --sports 5000,5001,6690 -j REJECT #This command will execute first and will ACCEPT connection to your VPN on destination port 443 UDP iptables -I FORWARD -p udp -s 192.168.1.100 -m multiport --dports 443 -j ACCEPT For earlier Shibby versions and later for MIPS routers: #Use this order of commands because it executes in reverse order. #This command will execute last, it kills all UDP requests. iptables -I FORWARD -p udp -s 192.168.1.100 -j REJECT #This command will execute second and will block all TCP source ports except those needed for web access or services iptables -I FORWARD -p tcp -s 192.168.1.100 -m multiport --sports ! 5000,5001,6690 -j REJECT #This command will execute first and will ACCEPT connection to your VPN on destination port 443 UDP iptables -I FORWARD -p udp -s 192.168.1.100 -m multiport --dports 443 -j ACCEPT Port TCP 5000 = HTTP for for Synology web access (change to your if it's not default) Port TCP 5001 = HTTPS for for Synology web access (change to your it's not default) Port TCP 6690 = Cloud Station port Port UDP 443 = AirVPN connection port which you defined in step 1 of this tutorial. If you are using TCP port, then you need to change "-p udp" to "-p tcp" in that line. If you need more ports, just add them separated by comma ",". If you want port range, for example 123,124,125,126,127, you can add it like this 123:127. Change IP 192.168.1.100 to your Synology LAN IP. Be careful NOT TO assign those ports to your Download Station on Synology. This isn't perfect, you can still leak your IP through UDP 443, but since torrent uses mostly TCP, those chances are minimal. If you use TCP port for VPN, then those chances increase. If you really want to be sure nothing leaks even on UDP 443 (or your custom port), you need to choose 1 (ONE) AirVPN server. You need to find that server entry IP and change last IPTABLES rule to something like this: iptables -I FORWARD -p udp -s 192.168.1.100 -d 123.456.789.123 -m multiport --dports 443 -j ACCEPT Where 123.456.789.123 is AirVPN server entry IP. This will allow UDP 443 only for that server, rest will be rejected by router. These are all my opinions, from my very limited knowledge, which may be right and may be wrong. 5. Auto reconnection when VPN is down. Since when you made your VPN connection on your Synology, you checked "Reconnect" option, Syno will try to reconnect automaticly when connection fails. But in some cases, your network will be offline long enough and Syno will stop trying to reconnect, or will hang with VPN connection established, but not working. In those cases you can use this auto reconnect script. This is reconnect script. Just select all script text and copy it. #VPN Check script modified Sep 11, 2016 #Script checks if VPN is up, and if it is, it checks if it's working or not. It provides details like VPN is up since, data #received/sent, VPN IP & WAN IP. #If VPN is not up it will report it in the log file and start it #Change LogFile path to your own location. #Save this script to file of your choosing (for example "synovpn_reconnect"). Store it in one of your Synology shared folders and chmod it: "chmod +x /volume1/shared_folder_name/your_path/synovpn_reconnect" #Edit "/etc/crontab" and add this line without quotes for starting script every 10 minutes: "*/10 * * * * root /volume1/shared_folder_name/your_path/synovpn_reconnect" #After that restart cron with: "/usr/syno/sbin/synoservicectl --restart crond" #!/bin/sh DATE=$(date +"%F") TIME=$(date +"%T") VPNID=$(grep "\[.*\]" /usr/syno/etc/synovpnclient/openvpn/ovpnclient.conf | cut -f 2 -d "[" | cut -f 1 -d "]") VPNNAME=$(grep conf_name /usr/syno/etc/synovpnclient/openvpn/ovpnclient.conf | cut -f 2 -d "=") LogFile="/volume1/filmovi/Backup/airvpn/check_airvpn_$DATE.log" PUBIP=$(curl -s -m 5 icanhazip.com) #PUBIP=$(curl -s -m 5 ipinfo.io/ip) #PUBIP=$(curl -s -m 5 ifconfig.me) CHECKIP=$(echo $PUBIP | grep -c ".") start_vpn() { echo "VPN is down. Attempting to (re)start now." >> $LogFile # /usr/syno/bin/synovpnc kill_client --protocol=openvpn --name=$VPNNAME /usr/syno/bin/synovpnc kill_client /bin/kill `cat /var/run/ovpn_client.pid` 2>/dev/null sleep 35 echo 1 > /usr/syno/etc/synovpnclient/vpnc_connecting echo conf_id=$VPNID > /usr/syno/etc/synovpnclient/vpnc_connecting echo conf_name=$VPNNAME >> /usr/syno/etc/synovpnclient/vpnc_connecting echo proto=openvpn >> /usr/syno/etc/synovpnclient/vpnc_connecting /usr/syno/bin/synovpnc reconnect --protocol=openvpn --name=$VPNNAME >> $LogFile } sleep 6 echo "======================================" >> $LogFile echo "$DATE $TIME" >> $LogFile if ifconfig tun0 | grep -q "00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00" then if [ "$CHECKIP" == 1 ] then IPADDR=$(/sbin/ifconfig tun0 | grep 'inet addr' | cut -d: -f2 | awk '{print $1}') RXDATA=$(/sbin/ifconfig tun0 | grep "bytes:" | cut -d: -f2 | awk '{print $1,$2,$3}') TXDATA=$(/sbin/ifconfig tun0 | grep "bytes:" | cut -d: -f3 | awk '{print $1,$2,$3}') UPTIME=$(cat /var/log/messages | grep "$IPADDR" | awk '{print $1}' | tail -1) UPTIME=$(date -d"$UPTIME" +"%Y/%m/%d %H:%M:%S") echo "VPN is up since: $UPTIME" >> $LogFile echo "Session Data RX: $RXDATA" >> $LogFile echo "Session Data TX: $TXDATA" >> $LogFile echo "VPN IP is: $IPADDR" >> $LogFile echo "WAN IP is: $PUBIP" >> $LogFile else start_vpn fi else start_vpn fi exit 0 (1) Login to you Synology DSM web interface as admin. - As admin go to "Control panel" - "Task Scheduler" (you need to enable advanced mode in top right corner of control panel for this) - Click "Create" button near top of page, then select "Scheduled Task" and then "User-defined script" (2) New popup window will open. - under "Task:" enter task name - under "User:" select "root" if it's not already selected - switch to "Schedule" tab and select how often you want this task to run, my settings are: - "Run of following days" - "Daily" - "First run time" - 00:00 - "Frequency" - "Every 10 minutes" - "Last run time" - 23:50 - switch to "Task settings" tab - paste script you copied into empty box under "User-defined script" title - press OK and you're done I tested this on DSM 6.2.2 and it works without problems for now. Still, I'm keeping old instructions in next post, if someone wants to do it like that. Tip: If you don't want logfile, you can comment out those lines, or remove ">> $LogFile" code from whole script. That's all. If you entered everything correctly, you should be fine and ready to go! Comments are welcome. If you find mistakes, please correct me.

Good morning, Here is my config: Nas Synology DS215J - Orbi RBR350 router which replaces a Bbox ( Bouygues Telecome Fiber ) - AirVPN I want to use a VPN for the Download Station software which is on my Synology, the VPN works well on my Synology but I cannot use the port which is given by AirVPN, when I do the test it says "Connection Refused (111)" I do not have a firewall activated on the NAS, and in my Orbi I do not see anywhere a blockage concerning the selected port Can someone help me. THANKS Translate by google, I'm French

Hello, I have a problem that I can not understand. I explain you my infra Router sysnology with the VPN airvpn configured on it in openVPN In my LAN, a synology with several services like plex or bitwarden I configured ports from my client interface with airvpn with dyndns and it works well for example toto.airdns.org: 123456 goes well on my DSM service on my synology on the port 5001 so the routes are good. Now I have a domain name of my own that I would like to use to connect to my synology without having to put the airvpn address, so I can make a CNAM alias toto.airdns.org => toto.mydomain.com but I can't put the port. So it doesn't work. I tried to change the port configuration on the airvpn platform in "internal ports" to port 443 (ports used in https) and I did the same route as for port 123456 but it does not work, the service always responds on port 123456 but not on port 443 A good soul could help me? Thank you in advance. Yop

I have built a docker container using the https://registry.hub.docker.com/r/markusmcnugen/qbittorrentvpn image containing qbittorrent. The container is running on a DS1019+ Synology NAS DSM 6.2.4.-25556. The connection is supposed to be made using the files generated by the OpenVPN Config Generator. For some reason the container makes no attempt to establish the VPN connection, doileak.com indicates that qb is leaking the router's WAN ip address. Any thoughts appreciated.

Please tell me how to connect with synology nas.

Hi I am trying to setup the Air VPN with download station on Synology NAS 6.x, but it's failing to start torrents when connected. I have to solve this before one month sub runs out, as there’s a little point extending it if DS doesn’t work. Findings: 1 The NAS is making the connection alright, but besides that nothing happen, ie no torrent activity after checking, wating at 0% 2 I am able to use the Utorrent client while connected to Air, works fine. 3 Restart does not help. The moment I disconnect from Air the torrent is activated. I tried various combinations of options in the generator (Open vpn v< and > 2.4, TCP, 1 server, the hole country). Any ideas how to fix this? I have run out of options myself.

Let me start by saying I am not that confident with networking but have some limited experience. I was having problems connecting to my Synology DS1817+ from the internet. I am running OpenVPN on a ddwrt router on which I have made no changes. I did forward 2 ports to 5000 and 5001 in the AIRVPN Client Area but nothing was working. I read everything I could find within the AIR VPN forums ,Synology's , and beyond. In the end my problem was solved when I changed my DDNS address in Synology -Control Panel - External Access - DDNS to something like 8.8.8.8. Sorry to just now get to the point. 1. Did I create a security vulnerability? 2. Is this the correct method to setup external access to my N.A.S.? 3. Should I consider entering an ip table into the ddwrt that only forwards those ports to my N.A.S.? Thank you in advance for any advice/information here. Ryan

Hi, I exactly followed all steps for creating a VPN on Synology. I have established a successful VPN connection - which is visible on in my AirVPN client area > overview page. The thing is that I cannot access the internet (Download Manager) - even ping (using putty) is not responding after having made the VPN connection.Btw - I deliberatly did not (yet) make any portforwarding changes, as I wanted to see if something as simple as this would work.Because I thought it might be a firewall issue, I temporary disabled my router firewall - no luck. Hope you could get me in the right direction... Netstat before and after making VPN connection. DiskStation> netstat -nrKernel IP routing tableDestination Gateway Genmask Flags MSS Window irtt Iface0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 eth0192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0DiskStation> netstat -nrKernel IP routing tableDestination Gateway Genmask Flags MSS Window irtt Iface0.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun00.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 eth010.8.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tun0128.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun0192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0213.152.161.73 192.168.0.1 255.255.255.255 UGH 0 0 0 eth0213.152.161.73 192.168.0.1 255.255.255.255 UGH 0 0 0 eth0

Oh boy, not sure what I did. So recently I switched from PIA (Private Internet Access) to AirVPN because I needed the ability to access my PLEX server remotely when my VPN was enabled. I was able to set this up correctly however for some reason, I am unable to access my media library now. My files are sitting on a synology NAS connected to my network. Are there any other settings I need to do so that when I access PLEX and AirVPN is enabled, it will be able to browse my network storage? Also, I enabled network lock after reading what it is used for. Soon after, I ran into some issues so I disabled it to perform some debugging. Unfortunately, even though it is disabled, when I close AirVPN, I am unable to access the internet from my server. As soon as I turn on AirVPN, my connection restores. I tried to restart to flush the setting but no luck. I bit off more than I can chew apparently. Any advice would be greatly appreciated. I attached some screenshots I thought would be helpful. If there are any other details needed, please let me know. Thank you in advance!

Hello, I'm a newly subscriber to AirVPN, I followed the guide to connect to AirVPN server with my Synology, so far so good My question is the following, is it normal to have reduced speed when using AirVPN ? I mean without AirVPN : 2.7 MB/s on Newsgroup With AIrVPN, after trying different servers , max I could get was 2.3 MB/s My upload is limited to 120KB/s in any case. So it's not a drastic fall in download speed but still is it a normal speed with vpn ? I have another VPN and I get just a bit more about 2.4 MB/s Any one with experience on synology noticed the same ? (The worst is when i activate some cloud sync while downloading without VPN it is 2.4 MB/s down and 120 KB/s up and with VPN 1.5 MB/s down and 120 KB/s up)

Hello, I installed successfully an AirVPN connexion on my synology station using those instructions The goal is to redirect all the torrent traffic (Download Station application) through the VPN tunnel. The thing is that I have other services on this synology server, like cloud station etc.. To use those services I use a dynamic DNS name (currently at no-ip.org). Problem is that when I am connected through the VPN tunnel, those services don't work anymore. What is the best approach to this problem ? In my mind, the best would be to be able to split the traffic on my synology server i.e. to redirect only the traffic of the Download Station application through the VPN but not the rest. I have not been able to find a clear "How to do this" and I don't even know if it is possible. Other possibilities would be to open some ports on the vpn servers I am using if I have understood correctly. Thanks in advance if you have more detailed instructions or ideas on how to achieve this goal.

How do I prevent an IP leak when I use AIRVPN with my Synology NAS download manager and my VPN connection drops and reverts to my home IP. How would I be able to prevent the download station from downloading if the VPN drops connection? I've done it on the PC just dont know how I would do it on the DiskStation. Thanks In Advance

Just wanted to know how fast everyone is getting on their download and upload on their synology NAS while on the VPN downloading torrents. What is the optimal port and protocal to use TCP or UDP. When i tried the download station behind the VPN is was only getting less then 400 KB DL. On my computer I get about 1.2 MB max. I have a 60 Mb connection.