Disable VPN client NAT

[-Dave-]

Hi, I have a DS3018xs running DSM 6.2.4-25556 Update 6 behind an Untangle firewall/router. The router performs basic NAT from the internet to my LAN. Nothing fancy or complicated.

The NAS has OpenVPN enabled and when VPN clients connect, they are given an IP by the NAS and they can access everything they need to on my LAN. I have a static route setup on my router to allow traffic from my LAN subnet reach IPs on the OpenVPN subnet and that works fine. The problem is, as far as any devices on my LAN are concerned, all OpenVPN clients appear to be sharing the NAS LAN IP. This is causing me issues with some LAN services that block IPs. All VPN clients are getting blocked rather than just the one that should be.

Other OpenVPN server implementations that I've used have an option to enable or disable NAT for VPN clients. Ideally I need to disable it on my NAS so that VPN clients reach the LAN with their IP allocated by the NAS. But I can't find that option anywhere in the GUI.

So does anyone know if it's possible to achieve this somehow?

Thanks,

Dave.

 

[Rusty]

When your vpn clients connect, do they list in the vpn server section as separate connections using the designated vpn subnet listed in the server settings?

 

[-Dave-]

Hi. Yes, in the "Connection List" section, each VPN client has a unique dynamic IP from the subnet set in the OpenVPN section. So it seems that the NAS is performing NAT on the OpenVPN subnet to route it to the LAN, rather than just routing it directly.

 

[Rusty]

Hi. Yes, in the "Connection List" section, each VPN client has a unique dynamic IP from the subnet set in the OpenVPN section. So it seems that the NAS is performing NAT on the OpenVPN subnet to route it to the LAN, rather than just routing it directly.

That is the default behavior, yes.

 

[-Dave-]

I understand that is the default but it's not suitable for my needs. So as other OpenVPN solutions allow NAT to be disabled, is it possible to do this on a Synology NAS?

 

[Rusty]

If there will be, you will have to deploy them using Docker as 3rd party apps/services.