NAS VPN Server - Works part way

[RickOShay]

Hi,

I have a Synology NAS that has a VPN server using OpenVPN. I can connect with no issues; however, it only works part way and I am stumped trying to figure out the last part.

If I open a browser and go to my router's IP address on the VPN, I can access my home router just fine, which tells me that that VPN is working. BUT:

If I open file explorer and try to go to the IP address of my NAS to access files, Windows finds nothing. I also cannot see any local printers.

My guess is that there is some setting on the NAS that I need to adjust in order for this to work, but I am not seeing anything.

Any ideas?

Thanks,

 

[Rusty]

Could it be that you are using split DNS configuration with your VPN?

Have you tried to ping a printer for example while connected over vpn? Any response using the CMD line?

Any active firewall rules on the NAS side? On the Windows side?

 

[RickOShay]

So, not entirely sure what you mean, but with my local router I am on the 192.168.1.x IP range and the VPN range is the 10.8.0.x IP range, so that's probably why, but I find it odd that I can open a browser and get to my local devices through that channel. I can reach my router login page and my network printer admin page just fine by url, but not through shares.

I see no settings in Synology NAS VPN Server to get issued IP's on the same IP range or really how that would work. My default gateway in my NAS is my router, so it seems as through it could issue out local IP's after a VPN connection, but I don't know, I haven't done much with VPN stuff.

I have an active firewall on the NAS, but nothing that I can think of that would block.

 

[Gerard]

If you have NAS firewall on, you need to add the vpn subnet 10.8.0.x with an allow rule to get access to the NAS.

 

[RickOShay]

Ah DUDE! That did the trick! Thank you! I totally forgot I had to add that to my firewall rules.

 

[RickOShay]

One last question on this. I have these in my firewall settings as exceptions which is great, but I have strict policies in place to ban anyone who gets 1 login attempt wrong on my NAS because if they are on allowable IP addresses, then they would never be banned if they get a wrong attempt.

I would have thought that: allowing the IP range of 10.8.0.x - 10.8.0.x in the firewall AND in the allow list in auto block of the NAS, that I would be good. I just did a test where I was on my VPN with an IP of 10.8.0.6 tried to login incorrectly on purpose and the NAS banned my external WAN IP address of my location.

Why wouldn't the NAS see me as logging in from 10.8.0.x and know I am allowed and try unlimited login attempts?

 

[fredbert]

Blocking the external IP address of the VPN client does sound odd. Maybe raise a ticket with Synology?

 

[LillianGarcia]

One last question on this. I have these in my firewall settings as exceptions which is great, but I have strict policies in place to ban anyone who gets 1 login attempt wrong on my NAS because if they are on allowable IP addresses, then they would never be banned if they get a wrong attempt.

I would have thought that: allowing the IP range of 10.8.0.x - 10.8.0.x in the firewall AND in the allow list in auto block of the NAS, that I would be good. I just did a test where I was on my VPN with an IP of 10.8.0.6 tried to login incorrectly on purpose and the NAS banned my external WAN IP address of my location.

Why wouldn't the NAS see me as logging in from 10.8.0.x and know I am allowed and try unlimited login attempts?

All good now?