How to Set Up a Synology VPN Server: Synology vs UniFi for Remote Network Access

Use UniFi for most remote network access; use Synology VPN Server when your NAS is the only reliable device you control. UniFi is usually cleaner for whole-network VPN access because the gateway sits at the edge of the network. Synology works well too, especially for small offices and home labs, but it needs tighter firewall rules and more care because the NAS often stores the data you are trying to protect.

TLDR: If you already run a UniFi Dream Machine, Cloud Gateway, or UniFi gateway, set up WireGuard or Teleport there first. If your router has poor VPN support, Synology VPN Server is a practical fallback using OpenVPN or L2TP/IPSec. For example, a 10-person office with two remote staff may see 80–150 Mbps over WireGuard on UniFi, while OpenVPN on an older NAS may sit closer to 20–60 Mbps depending on CPU load. Pick the device that can stay patched, monitored, and separated from critical files.

Synology vs UniFi: the short decision

Choose UniFi if you want remote access to multiple devices: cameras, printers, servers, desktops, and VLANs. A VPN gateway belongs close to the internet connection. UniFi also makes user VPN profiles, firewall rules, and client routing fairly direct.

Choose Synology VPN Server if your main goal is secure access to NAS files, Synology Drive, backup tasks, or a few internal services. It is also useful when your ISP router is locked down and you cannot replace it. The catch is that Synology VPN Server has a dated feel in places. Expect to waste time on certificate exports, port forwarding, and client config files if you are doing this for the first time.

What you need before setup

• A public IP address or a working DDNS hostname.
• Router admin access for port forwarding if using Synology.
• A strong user account policy, including unique passwords and MFA where supported.
• Updated firmware on DSM, UniFi OS, routers, and VPN clients.
• A subnet plan so your home network does not conflict with hotel, office, or mobile hotspot networks.

Avoid common subnets when possible. Using 192.168.1.0/24 at home sounds harmless, until you connect from another network using the same range. Use something less common, such as 10.44.20.0/24, to reduce routing headaches.

How to set up Synology VPN Server

Start in Package Center on DSM. Install VPN Server. Open it and choose your protocol. For most users, OpenVPN is the best option on Synology. It is mature, widely supported, and safer than PPTP. Do not use PPTP unless you have a legacy device and no serious security requirement.

1. Open VPN Server in DSM.
2. Select OpenVPN.
3. Enable the OpenVPN server.
4. Set the VPN subnet, such as 10.8.0.0/24.
5. Enable Allow clients to access server LAN if remote users need internal devices, not just the NAS.
6. Export the configuration file.
7. Edit the exported client profile and replace the local address with your DDNS name or public IP.
8. Forward the OpenVPN port on your router, commonly UDP 1194, to the Synology NAS.
9. Install an OpenVPN client on the remote laptop or phone.
10. Import the profile and test from a mobile hotspot, not from the same Wi-Fi.

That last step matters. Testing from inside the same network can give false results. Use cellular data or another internet connection. It drives me crazy that many guides skip this and leave users thinking their VPN is broken.

If OpenVPN connects but internal resources do not load, check three things first: the Synology firewall, your router firewall, and the VPN route settings. Also verify that the NAS has a fixed local IP address. A port forward to a changing NAS address will fail later, usually at the worst possible time.

How to set up UniFi remote VPN access

UniFi setup depends on your gateway model and UniFi OS version, but the usual path is simple. Go to the UniFi Network application, open Settings, then find VPN or Teleport & VPN. Newer UniFi gateways often support WireGuard, Teleport, and sometimes L2TP.

For most teams, WireGuard is the strongest choice. It is fast, efficient, and easier to audit than older options. Teleport is convenient for less technical users, especially if they use the WiFiman app, but WireGuard gives administrators more control.

1. Open UniFi Network.
2. Go to Settings and select the VPN section.
3. Create a WireGuard server.
4. Set the client address range.
5. Add users or peers.
6. Define which LANs or VLANs remote users can reach.
7. Export the peer configuration or QR code.
8. Import it into the WireGuard app on the remote device.
9. Connect from an outside network and test access by IP address first.

UniFi is better when you need role-based access. For example, a contractor may need access only to a camera VLAN, while staff may need the file server and printer subnet. Do not give everyone full LAN access by habit. That is how small problems become wide ones.

Security settings you should not skip

• Disable unused VPN protocols. Fewer exposed services means fewer risks.
• Use long passwords. A 16-character random password should be a minimum for VPN users.
• Turn on auto-block features on Synology when available.
• Limit VPN users to the systems they actually need.
• Patch monthly, or faster when a security advisory is released.
• Do not expose DSM login to the internet unless there is a clear reason.

On Synology, the NAS is both the VPN endpoint and a storage target. That adds risk. If the same account can connect by VPN, open DSM, and access shared folders, one stolen password can do real damage. Use separate accounts where practical, and restrict admin rights.

Performance and reliability

UniFi usually wins on speed. WireGuard is light and modern. A gateway built for routing tends to handle encrypted traffic better than an older NAS with a low-power CPU. Synology can still perform well, but OpenVPN is more CPU-heavy. On a newer Plus-series NAS, performance may be acceptable for file access and remote admin. On an older entry-level model, large transfers may feel slow.

Reliability also favors UniFi. If your NAS reboots for a storage update, your VPN drops. If your UniFi gateway reboots, the whole network is down anyway, so the failure point is more expected. For business use, that distinction matters.

Which one should you use?

Use UniFi if remote access is a network service. That includes access to several VLANs, site resources, admin tools, or multiple users. It is the cleaner design.

Use Synology VPN Server if remote access is mainly for NAS services and you do not have a capable gateway. It is also fine for a home user who wants to reach documents, backups, or a lab server without opening many ports.

The safest setup is simple: expose only the VPN port, keep software current, and grant the smallest access that still lets people work. For most serious remote access plans, UniFi should handle the VPN. Synology remains a solid fallback, but treat it with care because it often holds your most valuable data.