If you already have a Synology NAS running around the clock at home, it’s a natural place to host a personal VPN server, no extra hardware, no additional power draw beyond what the NAS already uses. The catch: Synology’s own VPN Server package supports OpenVPN, L2TP, and PPTP, but not WireGuard. To get WireGuard’s speed and simplicity, you need to route around the native package using Docker.
This guide covers that Docker-based setup, so your phone or laptop can tunnel back into your home network from anywhere, reaching your NAS shares, Plex library, or Home Assistant instance without exposing them directly to the internet.
What this actually gives you
This builds a personal WireGuard server on your NAS, not a commercial VPN. It doesn’t change your apparent location or anonymize your traffic among other users, since the exit point is your own home connection. What it does give you: encrypted, authenticated remote access to everything on your home network, for free, without a subscription, controlled entirely by you.
That’s a different tool from a service like NordVPN, which routes your traffic out through a third-party server to change your location or hide your traffic from your ISP. The two solve different problems and work well run side by side, one for reaching home, the other for everything else.
What you need before starting
A Synology NAS that supports Docker (rebranded Container Manager on DSM 7.2+), which covers most Plus-series and several Value-series models released in the last several years, check your specific model’s package center to confirm. You’ll also need administrator access to your home router for the port forwarding step, and ideally a DDNS hostname, which Synology provides for free through its own QuickConnect or Synology DDNS service if your ISP doesn’t give you a static public IP.
Step 1: enable Docker (Container Manager)
Open Package Center in DSM, search for Container Manager (called Docker on older DSM 6.x systems), and install it. On DSM 7.2 and later, this is the built-in container platform; no separate download is needed beyond the Package Center install.
Step 2: pull and configure the wg-easy container
The most straightforward WireGuard implementation for Synology is wg-easy, a Docker image that bundles the WireGuard server with a clean web interface for managing client devices, removing the need to hand-edit configuration files.
In Container Manager, go to Registry, search for wg-easy, and download the image. Once downloaded, create a new container from it and configure these environment variables before starting it:
WG_HOST: your DDNS hostname or static public IP, this is what client devices will connect to from outsidePASSWORD: a strong password protecting the wg-easy web admin interfaceWG_PORT: leave at the default 51820 unless you have a specific reason to change it
Map the container’s ports: UDP 51820 for the actual WireGuard tunnel, and TCP 51821 for the web admin interface. Set the container to restart automatically if the NAS reboots, so the VPN survives a power outage or scheduled restart without manual intervention.
Step 3: set up port forwarding on your router
Your router blocks unsolicited inbound connections by default, so a port forwarding rule is required to let WireGuard traffic reach the NAS from outside your network:
- Log into your router’s admin interface.
- Find the port forwarding, virtual server, or NAT section, naming varies by router brand.
- Create a rule forwarding external UDP port 51820 to your NAS’s local IP address, internal port 51820.
- Save and, if prompted, restart the router.
Give your NAS a fixed local IP first, either through a DHCP reservation in your router or a static IP set in DSM’s network settings, so this port forward doesn’t break the next time your router reassigns addresses.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Step 4: create client profiles
Open the wg-easy web interface at https://your-ddns-hostname:51821 and log in with the password set in Step 2. Click “New Client” for each device that needs access, phone, laptop, tablet, one profile per device rather than sharing a single config across devices, which lets you revoke access individually if a device is lost.
Each client gets a QR code you can scan directly in the WireGuard mobile app, and a downloadable .conf file for desktop clients. Import either into the WireGuard app (available for Windows, macOS, Linux, iOS, and Android) to complete the setup on that device.
Step 5: confirm it actually works
Before trusting this setup, test it properly. Turn off your phone’s Wi-Fi, switch to mobile data to get genuinely outside your home network, activate the WireGuard connection, and confirm you can reach a NAS service (File Station, Plex, or the DSM admin panel itself) using its local address. Run an IP leak test while connected; the IP shown should belong to your home connection, not your mobile carrier.
Locking down what the VPN exposes
Because this VPN server runs on the same device holding your files, a few security basics matter more than usual. Only expose the WireGuard UDP port itself through your router, never DSM’s admin port, Plex’s default port, or SSH directly to the internet, all of those should only be reachable once you’re already connected through the tunnel. Enable two-factor authentication on your Synology account regardless of the VPN, since the tunnel protects the network path but not a compromised password. Keep DSM and the wg-easy container both updated, security patches for NAS operating systems specifically target exposed services like this one.
Troubleshooting the common failures
| Symptom | Likely cause | Fix |
|---|---|---|
| Client can’t connect at all | Port forwarding rule missing or misconfigured | Recheck the router rule, confirm the NAS’s local IP hasn’t changed |
| Connects on home Wi-Fi, fails on mobile data | Port forward or DDNS issue, only visible from outside the LAN | Test the DDNS hostname resolves to your current public IP |
| Connected, but can’t reach NAS services | Firewall on DSM blocking internal access | Check DSM’s Security > Firewall rules aren’t blocking traffic from the VPN’s internal subnet |
| Works, then stops after a router restart | NAS lost its fixed local IP | Set a DHCP reservation for the NAS’s MAC address |
| Slow throughput compared to your normal connection | Older/entry-level NAS model with limited CPU power | Check your model’s WireGuard throughput in Synology’s own hardware specs |
Running WireGuard on a Synology NAS through Docker takes about 30 minutes for someone comfortable with Container Manager and router settings, and it turns hardware you already own into a permanent, free way to reach your home network from anywhere. It's the right project if you already run NAS-hosted services (Plex, Photos, Home Assistant) you want to reach securely. It's not a substitute for a commercial VPN if what you actually want is a different apparent location or ISP-level privacy on the open internet, those remain separate problems this setup doesn't solve.
For the Raspberry Pi equivalent of this same project, see our WireGuard on Raspberry Pi guide, and for connecting a commercial VPN provider at the router level instead, our OpenWrt VPN guide covers that alternative approach.
Keep reading: VPN on a Raspberry Pi: Build Your Own VPN Router for the Price of a Pizza and How to Check for a VPN IP Leak.