SRM VPN Plus webpage not accessible remotely

[itsjasper]

I've setup VPN Plus on my RT2600ac using the Synology SSL VPN. This enables the URL https://<hostname>.synology.me:443/ for VPN Plus, which is viewable on the local subnet, but not remotely - it just refuses to display in the browser.

Firewall rules for VPN Plus are enabled in SRM, and a port scan on both the internal LAN IP and the external WAN IP shows that 443 is open. I can remotely connect to SRM on https://<hostname>.synology.me:8001 so I know DDNS resolution is good, and the LE certificates also appear fine. At this point, I'm out of ideas, or probably overlooking something obvious. I've gone through the Synology tutorial for the setup, so I'm at a loss to figure this one out.

Alternately, can anyone recommend a better option for a Mac to SRM VPN config? I'd prefer one that can use built-in VPN client (I guess that means L2TP), though if there's a better way, I'm open to alternatives (openVPN?). By 'better', I mean something that is more secure whilst still being fairly light on the client side.

The use case is a single user (me) having the ability to remote-in to fix other computers on the network, whilst travelling for work.

 

[Rusty]

I can remotely connect to SRM on https://<hostname>.synology.me:8001

Be sure to not allow access to your router main UI access over the internet. Ok for testing, but be sure to close this down.

Alternately, can anyone recommend a better option for a Mac to SRM VPN config? I'd prefer one that can use built-in VPN client (I guess that means L2TP), though if there's a better way, I'm open to alternatives (openVPN?). By 'better', I mean something that is more secure whilst still being fairly light on the client side.

OpenVPN user here. Using Viscosity mac client on all my machines to get into my lan. 0 problem for years. Once you configure the client-side it's as simple as a single click to get connected (icon sits on the main menu bar).

 

[itsjasper]

Be sure to not allow access to your router main UI access over the internet. Ok for testing, but be sure to close this down.

Is this open because of QuickConnect being enabled? I don’t recall explicitly allowing it.

But certainly, a hardening of the setup needs to occur, so definitely will be looking to close non-essential ports currently open.

 

[Rusty]

Is this open because of QuickConnect being enabled? I don’t recall explicitly allowing it.

Not necessarily. Check this setting:

"Allow external access to SRM" inside system > SRM settings

 

[itsjasper]

That is unchecked on my system.

However, there is a firewall rule to allow the SRM app, which was set to source Any / Any, I’ve now tightened that up to local subnet. I don’t recall creating this rule.

 

[akahan]

Try switching to port 444, since 443 is used for other things (https) from the outside world:
In VPN Plus Server, change the port for SSL VPN to 444.
Make sure that you DO have the firewall rule set to allow all ports from all IP addresses to go to port 444 on SRM.
Set the VPN Plus client to connect to port 444.
Should be done.

 

[itsjasper]

We have a winner, thanks akahan !

 

[akahan]

We have a winner, thanks akahan !

Glad it worked out for you!