# Synology VPN Server Setup Guide

This document outlines the architecture, security implications, and exact steps required to set up a traditional OpenVPN server on a Synology NAS. This method replaces third-party SaaS VPNs (like Tailscale) with a 100% self-hosted and self-controlled infrastructure.

---

## 1. The Architecture (How the Flow Works)

When an employee works from home and needs to access the office network, here is the exact path their data takes:

1. **The Employee's Laptop** runs the OpenVPN Client software.
2. The laptop sends heavily encrypted traffic across the public internet to your office's **Public Internet IP Address** (or your DDNS name, like `office.synology.me`).
3. The traffic hits your office's physical **Internet Router** (your ISP modem/router).
4. Because you set up a **Port Forwarding Rule**, the router catches that traffic and says, *"Ah, this is VPN traffic! I will pass this directly to the Synology NAS."*
5. The **Synology NAS** receives the traffic, verifies the cryptographic certificate, decrypts the request, and grants the employee access to the office files and servers.

---

## 2. What Exactly Are We Exposing? (Security Implications)

**You are exposing exactly ONE port on your office router: `UDP 1194`.**

Is this safe? Yes, if configured correctly.
* When a hacker scans the internet and hits port `1194` on your router, the Synology VPN server will not even respond unless the hacker presents a highly complex, pre-generated cryptographic Certificate. 
* To hackers, the port appears "dead" or invisible unless they have the exact `.ovpn` configuration file that you exported.
* **Warning:** The only risk is if the Synology NAS software itself has an unpatched security flaw. Because of this, it is critical that you keep your Synology DSM software updated at all times.

---

## 3. Step-by-Step Setup Guide

### Phase 1: Establish a Permanent Address (DDNS)
Most office internet connections change their Public IP address periodically. To ensure employees can always find the office, you need a name that auto-updates.
1. Log into your Synology NAS.
2. Go to **Control Panel** -> **External Access** -> **DDNS**.
3. Click **Add**.
4. Service Provider: Select **Synology**.
5. Hostname: Pick a name (e.g., `seekright.synology.me`).
6. Click **Test Connection** and then **OK**.
*Now, employees will connect to `seekright.synology.me` instead of a random string of numbers.*

### Phase 2: Install and Configure the VPN Server
1. Open the Synology **Package Center**.
2. Search for and install **VPN Server**.
3. Open the VPN Server app. On the left menu, click **OpenVPN**.
4. Check the box to **Enable OpenVPN server**.
5. Set the following:
   * **Dynamic IP address:** `10.8.0.0` (This is the virtual IP range for connected laptops).
   * **Max concurrent connections:** Pick a number (e.g., 20).
   * **Port:** `1194`
   * **Protocol:** `UDP`
   * **Encryption:** `AES-256-CBC` (High security).
   * Check the box: **Allow clients to access server's LAN** (Crucial: This lets them see printers and other office servers, not just the NAS).
6. Click **Apply**.

### Phase 3: Export the Client Configuration
1. Still on the OpenVPN screen in Synology, click the button that says **Export Configuration**.
2. This downloads a `.zip` file to your computer. Extract it.
3. Open the file named `VPNConfig.ovpn` using a text editor (like Notepad).
4. Find the line that says `remote YOUR_SERVER_IP 1194`.
5. Change `YOUR_SERVER_IP` to the DDNS name you created in Phase 1 (e.g., `remote seekright.synology.me 1194`).
6. Save the file. *This file is the "key" that you will securely email to your employees.*

### Phase 4: Office Router Port Forwarding (The Critical Step)
You must physically (or remotely) log into the main internet router for your office. Every router is different (Cisco, Unifi, Netgear, ISP Router), but the concept is identical:
1. Find the local IP address of your Synology NAS (e.g., `192.168.1.50`).
2. Log into the Office Router's admin page.
3. Find the **Port Forwarding** or **NAT** settings.
4. Create a new rule:
   * **External Port:** `1194`
   * **Internal Port:** `1194`
   * **Protocol:** `UDP`
   * **Internal IP / Target:** `192.168.1.50` (Your Synology's local IP).
5. Save and apply.

### Phase 5: Connect the Client
1. On the employee's laptop, download and install the official **OpenVPN Connect** client (available for Windows, Mac, iOS, Android).
2. Open the app and click the **+** or **Import Profile** button.
3. Upload the `VPNConfig.ovpn` file you created in Phase 3.
4. The employee enters their Synology Username and Password.
5. Click **Connect**. 

They are now securely inside the office network.