A practical DSM guide for routing Synology internet traffic through NordVPN without confusing outbound privacy with remote NAS access.
Does NordVPN work on Synology NAS?
Yes. NordVPN documents a manual OpenVPN setup for Synology NAS. The reliable approach is to download a current NordVPN .ovpn profile, use the separate NordVPN service username and password, import the profile in DSM, then verify both internet routing and local access before you make the tunnel part of normal operation.
Use this setup when you want Synology-originated internet traffic to leave through a NordVPN server. Do not treat the commercial VPN tunnel as a replacement for Tailscale, WireGuard, QuickConnect, or another private remote-access design.
NordVPN on Synology: Which Setup Fits Your Goal?
| Goal | Recommended approach | Why |
|---|---|---|
| Protect most outbound DSM traffic | DSM OpenVPN client profile | Simple host-level setup using NordVPN’s documented Synology method. |
| Protect one download/container workload | Container-level VPN gateway where supported | Keeps Plex, DSM management, backups and unrelated apps on their normal route. |
| Reach DSM securely from outside home | Tailscale, WireGuard or another private-access method | Remote access is an inbound connectivity problem, not the same job as a commercial exit VPN. |
| Keep Plex remote access predictable | Leave Plex on the normal route unless you have a tested inbound design | Ordinary shared NordVPN servers do not create an inbound Plex path. |
Choose your Synology VPN goal
Select the job you actually need the VPN to do before changing DSM routing.
What NordVPN changes on a Synology NAS
Installing a NordVPN profile in DSM changes the path used by traffic that the NAS sends to the public internet. Instead of the ISP-facing public IP appearing to remote websites or services, traffic selected for the tunnel exits through the chosen NordVPN server. That can be useful for a download client, cloud-facing automation, API calls, web retrieval, or another workload where the public source address should be the VPN server rather than the home connection. The tunnel does not make the NAS “more private” in every possible sense; it changes network routing and encrypts the connection between the NAS and the VPN endpoint.
Local storage access is a different path. SMB copies from a desktop on the same LAN, NFS mounts inside the house, backup jobs between local devices, and DSM administration should normally remain local. If those local flows suddenly become slow or unreachable after the VPN is enabled, that is a routing problem to fix rather than an expected cost of using NordVPN. A good Synology configuration protects the internet-bound traffic you intended to protect while preserving the fast local network that makes a NAS useful.
Use NordVPN service credentials, not your normal account password
NordVPN’s current Synology instructions use manual-setup service credentials. These are a separate username and password shown in the Nord Account manual setup area. They are intentionally different from the email address and password used to sign in to the NordVPN website or native application. This detail matters because a profile can look perfectly correct in DSM and still fail immediately with an authentication error if the wrong credentials are entered.
Before touching DSM, sign in to Nord Account, open the manual setup area, copy the service username and password, and download the current OpenVPN configuration for the server you want. Avoid relying on an old .ovpn file saved years ago just because it once worked. VPN server names, certificates, recommendations, and configuration details can change. Keeping the profile and credentials current removes two common failure variables before you start diagnosing DSM itself.
How to set up the OpenVPN profile in DSM safely
In DSM, open Control Panel, go to Network and Network Interface, then create a VPN profile and choose OpenVPN by importing an .ovpn file. Give the profile a clear name such as “NordVPN UDP,” enter the service credentials, attach the downloaded configuration, and complete the profile. NordVPN supports both OpenVPN UDP and TCP. UDP is usually the first choice for throughput, while TCP can be useful when a network blocks or mishandles UDP. The goal is not to collect many profiles at once; start with one known-good nearby server so troubleshooting remains simple.
Before connecting, write down the NAS’s normal IP, default gateway, DNS settings and any static routes. Make sure another local device can reach DSM and that you have a recovery path if the default route changes unexpectedly. After connecting, confirm the VPN status in DSM, then test an outbound IP check from a workload on the NAS. Finally, test DSM, file shares and local applications from another LAN device. Treat the first connection as a controlled network change, not as a “click connect and hope” step.
Keep local LAN traffic out of the VPN tunnel
A Synology NAS often has a faster local network than its internet connection, especially on 2.5GbE or 10GbE systems. Routing local file copies through an internet VPN would add latency, reduce throughput and create a needless dependency on the VPN endpoint. Your target architecture should keep private subnets local while sending only the intended public destinations through NordVPN. In practical terms, a workstation copying a large video file to the NAS should still talk directly to the NAS’s LAN address even while a download client uses the VPN for its internet sessions.
If enabling the VPN causes DSM to disappear from the LAN, SMB mappings to fail, or local application URLs to stop loading, check route priority and the profile’s network options before blaming the storage service. Do not change RAID, volumes or application data while diagnosing a network-route issue. The safest recovery path is normally to disconnect the VPN profile, verify the NAS returns to its known-good network state, then change one routing option at a time and retest.
NordVPN, Synology Plex and remote access are separate decisions
Plex is where many NAS owners first discover the difference between outbound VPN routing and inbound reachability. A shared NordVPN server can carry outbound Plex traffic, but it does not automatically provide an inbound port that the public internet can use to reach your Plex server. If Plex Remote Access is working before the whole NAS is sent through a commercial VPN, the VPN can disrupt that working return path. The result may be local playback that still works while remote clients report indirect, unavailable or inconsistent access.
For most mixed-use Synology systems, keep Plex on the normal route unless there is a specific, tested reason to tunnel it. If only a downloader needs privacy, route the downloader rather than the entire NAS. If the real objective is to reach Synology Photos, DSM or private files from outside the house, use a private remote-access solution. This separation makes the network easier to reason about: NordVPN for outbound privacy, a remote-access VPN for private inbound access, and explicit publishing only for services you intentionally expose.
When container-level NordVPN is better than whole-NAS routing
Whole-host VPN routing is easy to understand, but it can be unnecessarily broad. On a Synology model and DSM setup where the relevant application can run in containers, a VPN gateway container such as Gluetun can isolate the privacy requirement. The downloader, indexer or other selected container shares the VPN gateway’s network namespace, while DSM, backup services, local storage and Plex continue using their normal routes. NordVPN now publishes a Gluetun OpenVPN guide, which makes this pattern easier to document and maintain than older improvised container setups.
Selective routing also improves failure behavior. If the VPN gateway goes down, the dependent container can be designed to lose internet access instead of silently falling back to the household WAN. At the same time, the NAS management plane stays available on the LAN. The tradeoff is more Docker networking complexity, especially around published ports and communication between containers. Use it when the isolation benefit is worth that complexity; do not add containers merely because they sound more advanced than DSM’s native VPN profile.
How to verify that Synology traffic is really using NordVPN
A green “connected” indicator only proves that DSM believes the tunnel is established. Verification should answer three separate questions: does the intended workload have internet access, does its observed public IP belong to the VPN route, and can local users still reach the NAS normally? Test from the actual application or container when possible. A browser on your laptop tells you nothing about the route used by a downloader running on the NAS unless the laptop itself is traversing that same tunnel.
Also verify DNS behavior. A tunnel can be up while name resolution follows a different or broken path, producing failures that look like “NordVPN connects but nothing loads.” If a service is important, test it before and after the tunnel, record the expected public IP behavior, and repeat the check after DSM upgrades or VPN profile changes. A short verification checklist is more reliable than assuming the profile will behave identically forever.
Best-practice Synology deployment checklist
Use a current NordVPN OpenVPN profile, the correct service credentials, a nearby server for lower latency, and a change window where losing the route temporarily will not interrupt backups. Preserve the NAS’s local address and management access, and avoid combining multiple unrelated changes such as DNS, firewall, reverse proxy and VPN routing in the same maintenance session. If you need a VPN only for one service, seriously consider selective routing rather than forcing the whole NAS through a tunnel.
Finally, document what the VPN is supposed to accomplish. “Make the NAS secure” is too vague to test. “Route this downloader’s outbound internet traffic through NordVPN while DSM, SMB and Plex remain on the normal LAN/WAN path” is specific enough to verify. That kind of architecture is easier to troubleshoot, easier to explain to another administrator and less likely to break when DSM, a container image or a VPN configuration changes.
Frequently asked questions
Does NordVPN work on Synology NAS?
Yes. NordVPN documents a manual OpenVPN profile setup for Synology NAS.
Which NordVPN password do I use on Synology?
Use the NordVPN service username and service password from manual setup, not your normal Nord Account login.
Should I use UDP or TCP on Synology?
UDP is generally the first choice for performance. TCP is a useful alternative on networks where UDP is blocked or unreliable.
Can NordVPN give me remote access to DSM?
A normal commercial NordVPN tunnel is not the same as private remote access. Use Tailscale, WireGuard or another appropriate remote-access design.
Will NordVPN break Plex on Synology?
It can disrupt Plex remote access if the whole NAS route changes. Keep Plex routing deliberate and test local and remote playback separately.
Can I route only one Synology container through NordVPN?
Yes, on a suitable container setup you can use a VPN gateway pattern such as Gluetun so only selected workloads use the tunnel.
Research references and methodology
Cloudzat separates vendor-documented capabilities from deployment advice. Configuration screens, firmware behavior, applications and offers can change, so verify the current vendor instructions before changing a production NAS or exposing a service to the public internet.
Last meaningfully reviewed: August 25, 2026.