Diagnose NordVPN on Synology by symptom instead of repeatedly rebuilding the profile or changing unrelated DSM settings.
Why is NordVPN not working on Synology?
The most common failure classes are wrong manual-service credentials, an outdated or incorrect OpenVPN profile, a tunnel that connects but does not own the expected route, DNS failure, or local-routing changes that make DSM and other services appear unreachable. Start by identifying which symptom you actually have.
Do not reinstall DSM, alter a storage pool, or delete application data to solve a VPN problem. Disconnect the VPN, confirm the NAS returns to a known-good network state, then troubleshoot authentication, profile, routing and DNS in that order.
NordVPN Synology Error Symptoms and First Fixes
| Symptom | Likely area | First action |
|---|---|---|
| AUTH_FAILED / authorization error | Manual service credentials | Re-copy the NordVPN service username/password from the manual setup area. |
| VPN shows connected but apps have no internet | Route or DNS | Check the default route and test DNS separately from raw IP connectivity. |
| DSM or SMB disappears from LAN | Local routing/interface priority | Disconnect the VPN, confirm LAN recovery, then correct route behavior. |
| Plex local works but remote access fails | Inbound return path | Keep Plex off the commercial tunnel or build an explicit supported inbound design. |
What exactly is failing on your Synology?
Choose the symptom that best matches what you see after enabling NordVPN.
Start with the failure state, not with random fixes
“NordVPN does not work on Synology” can describe several completely different problems. A profile that refuses to authenticate is not the same failure as a profile that connects successfully but has no DNS. A NAS that still has internet access but disappears from the local network has a routing problem, not necessarily a VPN-server problem. Plex that becomes unreachable from outside the house is an inbound-path problem even if every outbound request from the NAS is correctly leaving through NordVPN.
Write down the exact symptom and the last known-good state. Can you still open DSM from the LAN? Can the NAS ping or reach a public IP address? Can it resolve a hostname? Does only one package fail? Does disconnecting NordVPN restore everything immediately? Those observations narrow the problem much faster than deleting and re-creating multiple profiles. They also prevent unrelated changes from turning one routing issue into several new problems.
AUTH_FAILED usually points to NordVPN service credentials
NordVPN’s current Synology setup uses service credentials for manual OpenVPN connections. The normal Nord Account email address and password are not the credentials DSM should send to the VPN endpoint. If DSM reports an authorization or authentication failure, re-open Nord Account, go to the manual setup area and copy the service username and service password again. Avoid typing them from memory or using password-manager fields saved for the website login.
Next, download a fresh .ovpn profile for the intended server. Old configuration files can outlive the environment for which they were downloaded. If a fresh profile and the correct service credentials still fail, try another recommended NordVPN server and test UDP versus TCP rather than changing DSM storage or application settings. Keep the test matrix small: one profile, one credential set, one protocol. Once authentication succeeds, move on to routing and DNS only if those layers actually fail.
When NordVPN connects but the Synology has no internet
A connected tunnel with no usable internet usually means the tunnel exists but traffic cannot complete the route you expect. First test whether the NAS can reach a public IP address. If raw IP connectivity works but hostnames fail, focus on DNS. If neither works, inspect the default gateway, route priority and VPN-profile options. The important distinction is whether packets cannot leave at all or whether they leave but names cannot be resolved.
Do not diagnose this from a laptop browser unless the laptop’s traffic is genuinely passing through the NAS tunnel. Test from a NAS package, container or shell context that uses the affected route. If disconnecting NordVPN immediately restores internet access, record the before-and-after route state. That is stronger evidence than an application error message, because many applications report a generic “network unavailable” message for both routing and DNS failures.
Fix DSM or SMB access that disappears after connecting
If DSM becomes unreachable from another machine on the same network when NordVPN connects, the VPN likely changed route selection or local-subnet handling. The quickest safe recovery step is to disconnect the VPN profile locally or from an alternate management path, then verify the known LAN address becomes reachable again. If it does, storage is not the problem. Focus on the network interface and route table.
The local subnet should remain directly reachable through the NAS’s Ethernet interface. A 10GbE SMB copy should not be sent toward an internet VPN. Check whether the VPN profile is forcing all traffic in a way that captures local destinations, whether a static route is missing, or whether interface priority changed. Make one change and retest DSM plus SMB before reconnecting the tunnel. Avoid enabling several network options at once because you will not know which one actually restored local reachability.
Diagnose DNS separately from VPN routing
DNS failures are deceptive because the VPN status can look healthy while applications behave as if the internet is offline. Test an IP destination and a hostname separately. If the IP works and the hostname does not, inspect the DNS servers and resolver path used after the VPN connects. If both fail, the issue is broader than DNS. This simple split prevents hours of adjusting DNS settings when the default route is actually broken.
Also remember that containers may have their own resolver configuration. A DSM-level test can succeed while a Docker workload still cannot resolve names, or the opposite. If one application fails, inspect that application’s network namespace rather than assuming the whole NAS is affected. VPN troubleshooting is most reliable when each layer is tested where the traffic originates: host, container, package and remote client are not interchangeable viewpoints.
Why Plex remote access can fail while NordVPN is working perfectly
Plex Remote Access needs an inbound path from a remote client back to the Plex server. A normal shared NordVPN exit is designed primarily for outbound VPN traffic and does not automatically provide an inbound port for your Synology. That means NordVPN can be doing its job correctly while Plex becomes unreachable from outside. The symptom is especially confusing when local playback continues to work because local traffic never needed the public inbound path.
The clean fix is architectural. If Plex does not need the VPN, keep Plex on the normal route and tunnel only the application that does. If you need private remote viewing rather than public Plex exposure, consider a private-access solution such as Tailscale. NordVPN’s newer Dedicated Server product is a separate add-on that supports port forwarding, but that is a different architecture and should not be confused with ordinary shared NordVPN servers or Dedicated IP.
Rebuild the profile only after you have evidence it is stale
Deleting and recreating a VPN profile can help when the configuration file is outdated or corrupted, but it should not be the first response to every symptom. If DSM says AUTH_FAILED, fix credentials first. If the tunnel connects and raw IP traffic works, the profile has already passed several important tests. Rebuilding it repeatedly can erase useful evidence and introduce a new server, protocol or option while you are still trying to understand the original failure.
When you do rebuild, use a freshly downloaded NordVPN profile and name it clearly with protocol and purpose. Keep the old profile disabled until the new one is verified so rollback is easy. After DSM or OpenVPN-related updates, compare behavior with the current NordVPN instructions rather than a screenshot guide from an older DSM generation. Network menus evolve even when the basic OpenVPN model stays familiar.
A repeatable NordVPN Synology troubleshooting order
Use the same order every time: verify local NAS access without the VPN, verify current service credentials, use a current .ovpn file, connect one profile, test raw IP connectivity, test DNS, test the intended application, then test local LAN services and remote services separately. Record the result of each step. That process turns a vague “VPN broken” report into a specific failure layer that can be corrected without disturbing storage.
If the problem began immediately after a DSM update, a NordVPN configuration refresh, a router change or a DNS change, treat that event as a clue rather than proof. Roll back only the network component you can safely reverse. When the system is working again, document the final profile, protocol, route assumptions and which services are intentionally outside the VPN. Good documentation is especially valuable months later when a package update makes a familiar symptom return.
Frequently asked questions
Why does Synology say NordVPN authentication failed?
The first thing to check is whether you used NordVPN service credentials rather than your normal Nord Account login.
Why does NordVPN connect but Synology has no internet?
Check the default route and DNS separately. A tunnel can be connected while routing or name resolution is wrong.
Why can I not reach DSM after connecting NordVPN?
The VPN may have changed route priority or local-subnet handling. Disconnect, confirm LAN recovery, then correct the route.
Why did Plex Remote Access stop after enabling NordVPN?
Plex needs an inbound path. Ordinary shared NordVPN servers do not automatically provide one.
Should I delete and recreate the VPN profile?
Only after checking credentials, current configuration files, route behavior and DNS. Rebuilding too early can hide the real cause.
Does a NordVPN Dedicated IP fix Synology port forwarding?
No. Dedicated IP is not the same as NordVPN Dedicated Server; the newer Dedicated Server add-on is the product that supports port forwarding.
Research references and methodology
Cloudzat separates vendor-documented capabilities from deployment advice. Configuration screens, firmware behavior, applications and offers can change, so verify the current vendor instructions before changing a production NAS or exposing a service to the public internet.
Last meaningfully reviewed: August 25, 2026.