View original (French)

Synology NAS VPN Server

BRRG Posted messages 1129 Registration date   Status Member Last intervention   -  
brupala Posted messages 111142 Registration date   Status Member Last intervention   -

Hello,

I want to set up a VPN between my NAS server and my computer when I am not at home.

I followed the tutorial on the tech2tech website. I set up the VPN server using OpenVPN. I confirmed the settings to make the VPN operate in full tunneling mode.

I can "mount" the network locations using the local IP address of the server and the VPN IP address, but I cannot use the name of the NAS directly with the VPN to mount the drive on my PC. Also, I cannot ping the NAS by name, nor with the local IP address of the NAS, even though I can mount the drive on my PC. Finally, I cannot access the DSM interface of the NAS.

I'm lost, can someone please help me?

1 answer

  1.
    avion-f16 Posted messages 19182 Registration date   Status Contributor Last intervention   4 511
     

    Hello,

    Accessing the NAS by its name is likely based on mDNS, which requires multicast. Therefore, OpenVPN should operate in bridge mode (TAP) so that your computer is part of the same broadcast domain as your NAS.

    For the ping and DSM access, it should work. If it doesn't, I would suspect a firewall issue (the one on the OpenVPN server) rather than an OpenVPN problem.

    0
    1. BRRG Posted messages 1129 Registration date   Status Member Last intervention   4
       

      Hello,

      In order for OpenVPN to work in bridge mode (TAP), do I need to modify the .ovpn configuration file? For hardware, I only have a NAS, a Livebox, and a computer.

      In the NAS firewall, I have set the following rules:

                - Allowed: VPN Server: 10.8.0.0/255.255.240.0 (my addresses range from 10.8.0.1 to 10.8.0.10)

                - Allowed: VPN Server: 192.168.1.10 to 192.168.1.100/255.255.255.0

                - Allowed: VPN Server: FRANCE

      For ping and DSM access, in the NAS firewall, I have set the following rules:

                - Allowed: DSM (HTTPS): 10.8.0.0/255.255.240.0 (my addresses range from 10.8.0.1 to 10.8.0.10)

                - Allowed: DSM (HTTPS): 192.168.1.10 to 192.168.1.100/255.255.255.0

                - Allowed: DSM (HTTPS): FRANCE

      0
    2. avion-f16 Posted messages 19182 Registration date   Status Contributor Last intervention   4 511 > BRRG Posted messages 1129 Registration date   Status Member Last intervention  
       

      Hello,

      This is defined in the server-side configuration file.
      See here: https://openvpn.net/community-resources/ethernet-bridging/

      However, it is possible that the OpenVPN module for Synology does not allow this level of customization.

      Alternatively, you can also write the name of the NAS in your computer's "hosts" file, which will allow you to keep the VPN in router mode.

      Have you enabled the "Allow clients to access the LAN server" function?

      For the firewall rules, please provide them in full; otherwise, it is impossible to verify them. There should be a rule applied to the "VPN Server" interface that allows packets from 10.8.0.0/24 to 10.8.0.1 and to the management interface port.

      0
    3. BRRG Posted messages 1129 Registration date   Status Member Last intervention   4 > avion-f16 Posted messages 19182 Registration date   Status Contributor Last intervention  
       

      Yes, I knew about the host file but I didn’t want to modify anything on the PC.

      To be sure, is it only possible for the box to convert hardware_ip_address to hardware_name because we are in the VPN tunnel?

      What I don't understand is why the NAS is "translated" locally?

      Yes, on the NAS VPN Server I enabled "Allow clients to access the LAN server".

      In the NAS firewall, I set the common rules:

                - Allowed IP addresses range from 10.8.0.1 to 10.8.0.10 for VPN Server port 5100 and DSM (HTTPS) port 5001

                - Allowed IP addresses range from 1192.168.1.10 to 192.168.1.100 for VPN Server port 5100 and DSM (HTTPS) port 5001

                - Allowed IP addresses for France for VPN Server port 5100 and DSM (HTTPS) port 5001

      0
    4. brupala Posted messages 111142 Registration date   Status Member Last intervention   14 442 > BRRG Posted messages 1129 Registration date   Status Member Last intervention  
       

      Hello,

      I don't see what France has to do with this, how can you detect that the client connecting (I suppose that's what we're talking about) is in France?

      Especially if we're basing it on private IPs.

      It's silly, and what’s the point?

      Not very serious all this.

      Also,

      I think it's not a tunnel that needs to be created, you're connecting a machine to a network, not two networks to each other, but rather a road warrior setup, for an individual machine.

      Lastly, OpenVPN in bridge mode would probably be preferable for accessing the local network.

      0
    5. BRRG Posted messages 1129 Registration date   Status Member Last intervention   4 > brupala Posted messages 111142 Registration date   Status Member Last intervention  
       

      Hello, I had put that in for safety, like in case of using a phone.

      I have already received alerts from people located in the USA.

      0