Scott Hanselman

Setting up a VPN and Remote Desktop back into your home with a Synology (from an iPhone)

April 2, '15 Comments [27] Posted in Hardware | Open Source | Win8
Sponsored By

It's amazing that I can basically be my own IT Department. The kinds of things we can do in our homes as individuals with off-the-shelf hardware would have needed an IT Dept of a dozen just 10 years ago, ya know? Amazing.

I wanted to be able to VPN into my home and remotely access my machines and files. I do very much realize there are a lot of different options to do this, and have been for years. From GoToMyPc to Hamachi, again, there's dozens of ways. I wanted a VPN solution I could use on my iPhone/iPad and Surface. I wanted it to be standards-based and not require any additional software installations.

I have a a Synology 1511+ NAS appliance and I love it. It's not just a file server, it's an everything server, in my house. I use it for Plex, it hosts my files and photos, it manages my surveillance cameras and acts as a camera DVR, it runs a Minecraft Server, it's a Git server, it even runs Docker.

The Synology will act as my VPN server as well.

Here's how I set up four things. The Synology, my Router, my iOS device, and my Windows PC/Surface.

The result is I can now remote into my home and manage things from any device I own.

Setting up a Synology for L2TP VPN

First, in the Synology Package Manager, ensure that you've got the Synology VPN Server package installed and running.

Adding VPN Server on Synology

You should give some though as to which VPN technique you want to use. I decided on L2TP, although there is some concern the NSA has weakened it. Benefits are that it's on all major platform, it's generally considered secure, and it's easy to setup.

Select L2TP (or whatever you want), and Enable it. Notice also that I selected my INTERNAL DNS server. I found this worked best for me when trying to access internal resources. You can also setup a hosts file if you want to just hit a few things inside your house.

L2TP in Synology

Now click on Privilege. Just give the minimum privileges to the user that needs them. NO need to give VPN access to users who won't use it.

VPN Server in Synology

Setup your Router for VPN (L2TP)

My router is a Linksys WRT1900ac that I like very much. It supports port forwarding, and the Synology can often talk directly to a router and request open ports. However, there's something to be said for handling things yourself. It lets you know exactly what's going on, and it can be less of a "black box."

Login to your router and in this case of L2TP, forward UDP ports 1701, 500, and 4500. On my Linksys, it's under Security, Apps and Gaming.

The Device IP is the internal IP address of your Synology. It's best to have your Synology use a Static IP address, or at least have a DHCP reservation so this IP doesn't change and things stop lining up.

Port Forwarding in a Router

Also, ensure that your Router is passing L2TP traffic as well. I changed this under Security.

L2TP Passthrough

At this point, you should be able to at least try to connect to your house via VPN. I did this as a quick test by taking my iPhone off the wireless networking (thereby being on the open internet) and VPN'ing back in.

If you succeed, you should be able to see yourself in the VPN Server | Connection List area on our Synology.

VPN Server

Here's what I did on my iDevice to setup VPN.

Setting up iOS/iPhone/IPad for VPN

From the iOS Settings app, go General | VPN. Touch Add VPN Configuration. I selected L2TP and put in my Server name or IP and named the account "home."

NOTE: If you don't want to use your IP address, you can use the Synology.me dynamic DNS feature built into your Synology, or any one of many dynamic DNS systems that will give you a nice domain like "myhanselmanhouse.foofoo.com" or whatever. You can also, if you like, setup a CNAME with your own domain and point it to that dynamic domain. So vpn.hanselman.com could be your server, if you wanted.

With L2TP you'll need your username and password, as well as a Shared Secret. That's like another password. Specifically the Secret text box in iOS is the "pre-shared key" from your Synology L2TP VPN setup.

Add VPN in iOS

At this point you'll get a nice VPN option on your Settings app under Personal Hotspot that wasn't there before. You can turn it on and off now, easily.

VPN Connecting in Settings

Once I'm VPN'ed in I can see a [VPN] indicator in the top status bar. I've installed the FREE Microsoft Remote Desktop Client for iOS.

RD Client on an iPhone - Remote Desktop

And here's me VPN'ed into my home PC from my iPhone. This of course, can be done on Android and Windows Phone as well.

Remoted into my desktop at home with RDP

It looks small, but in reality it's very usable, especially from an iPad with a Bluetooth Keyboard.

Setting up L2TP VPN on Windows 8.1

Now I'll setup VPN back to home on my Windows 8.1 machine. For some reason this was super easy in Windows 7, but in Windows 8.1 there isn't a clear way to just add a L2TP VPN. You can add other simpler (or Vendor) VPNs in a straightforward manner, but not L2TP.

Just hit the Windows key (or Start Menu) and type "Add VPN." When you get to the VPN management screen, you'll see this and can fill it out.

Adding VPN

But L2TP VPN setup with a pre-shared key requires some more work. If you know of a simpler way, let me know. I can see about three different ways to get to the same result.

Go ahead and create a new VPN connection with the menu above. Select Microsoft as the VPN type and put in your server address and optionally name and password. This will create the VPN connection.

Pay attention now. Go back to the Start Menu and type "Network Connection." You want the first item called "View Network Connection" (a classic control panel, not a fullscreen 'metro' one).

Opening Network Connections

From there, you'll open a classic control panel and see your VPN connection. Right click and click Properties.

Network Connections with VPN

Click Security, make sure L2TP is set, then click Advanced Settings.

L2TP VPN in Windows 8'

Put your pre-shared key there.

Setting a preshared key

Connect to your home VPN and have fun

Of course, please do remember to use strong passwords, strong pre-shared keys, and change them. Don't be lazy.

At this point you can connect to your home/office and work to your heart's content.

VPN Connection in Windows 8

For some of you this is "duh" or old hat, but for me it was something I just never got around to doing. Mostly laziness prevented. But just last week I had to drive 30 miles back to my house from a dinner in order to move a file from my Desktop into Dropbox. I'm pretty sure I'm not the only reasonably smart techie with a story like that. This VPN setup would have meant I could do that from my phone and it would have saved me a big hassle and over an hour of my time.

RELATED LINKS

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Sponsored By
Hosting By
Dedicated Windows Server Hosting by SherWeb
Thursday, 02 April 2015 22:02:20 UTC
I tried an L2TP VPN a couple years ago on my home network, but found that lots of public hotpots were blocking the ports for it. So, instead I landed on OpenVPN because I can run it on TCP/443, which no one really has blocked. For not so techy people I often recommend TeamViewer as they have iOS, Anddroid, and PC clients and it is super easy to setup.
Davin Studer
Thursday, 02 April 2015 23:00:57 UTC
I've been very happy with Chrome Remote Desktop for PC-to-PC connection. It's the closest thing to the old (discontinued) Windows Live Mesh remote desktop. A few months back I installed the Android app on a Nexus 7, and that works very well connecting to the PCs. As of this year there is an iOS app so I can even more easily connect with my work or home PCs. The screen sizing and navigation are especially good, even dual monitor<->single monitor (the way Live Mesh was). A Google Gmail account controls it all, with individual PINs for each device. The iOS version is optimized for iPhone 5, 6, and 6 Plus, but it works on my iPhone 4S and works very well on an iPad.
David Shirley
Thursday, 02 April 2015 23:50:53 UTC
I'll take your word on

"so vpn.hanselman.com could be your server, if you wanted"

is it first come first first serve? :P
Francisco N
Friday, 03 April 2015 01:21:42 UTC
Synology is overpriced.
Cheaper is an odroid c1 (35$) with ARM Linux + SoftEther VPN Server or OpenVPN.
SoftEther has a nice GUI and supports OpenVPN clients, L2TP, SSTP etc.
roman
Friday, 03 April 2015 10:41:03 UTC
Why not just setup remote desktop on your PC just remote into that - is a VPN really needed?
Scott
Friday, 03 April 2015 11:52:24 UTC
Please take note, that if you do not run DHCP using the Synology NAS, the VPN clients will get a subnet IP instead of an inhouse IP..

eg: My LAN has 192.168.1.x
Synolgy VPN clients get 10.0.0.x
they are therefor cut out of the LAN.

however, if the Synology runs DHCP it's able to distribute an internal IP: 192.168.1.x
Friday, 03 April 2015 17:10:31 UTC
Mix the above Chrome Remote suggestion with Tonido Free and you have full remote desktop and files all from browser and no configuration hassle.
I'm using Tonido since they removed the necessities to pay for personal use
Regis Bittencourt
Friday, 03 April 2015 18:37:03 UTC
Still using an iPhone?
Scott Herrmann
Friday, 03 April 2015 18:55:03 UTC
Roman - There will always be small and cheap little appliances. Certainly cheaper than the Synology for single tasks. But I doubt you're implying that that little $35 ARM machine can stream and transcode HD video, host a 5 TB RAID array, run my network of cameras and DVR them, host minecraft servers, and a dozen other thing ALL THAT THE SAME TIME.

Martin, that's true, BUT change the IP address range and have perhaps, 200 IPs for home in one range and 10 or so for VPN, and they can all be on the same network. Mine are 10.2.x.x, and it works fine.

Chrome Remote Desktop is fine for machine access, but I want/wanted complete network access to multiple machines.
Scott Hanselman
Friday, 03 April 2015 22:13:02 UTC
I may be paranoid, but I'm always very reluctant opening up public ports to my internal NAS (with my entire life on it from 1999 onwards). There are people out there hijacking these devices and encrypting all the contents and asking for a ransom. Do you take this into consideration and what is your opinion on the danger of exposing your data to the big bad internet?
Jan Willem B
Friday, 03 April 2015 22:54:23 UTC
Love my Synology 1513+. If anything it's under priced. I run Hybrid RAID with 5 x 4tb drives giving me 20tb minus parity. Just set up the Git server service myself which auto provides offsite backups of my repos to Google Drive using the cloud sync service. I run 3 web cams via surveillance station. The DS video service is simply superb. I bounce any movie via my phone or iPad to any smart TV in the house. Streams perfectly and the native iOS apps are brilliant. Audio station also very good. Cloud station yet another winner. File station on iOS is also handy as I keep everything on my NAS anyway. iOS Photo station is excellent for archiving my phone pics straight to storage. Might explore Docker next!
Saturday, 04 April 2015 02:45:27 UTC
Hm, though I think VPNing into your home network is convenient, it's not necessary for me right now because I have all my files in Dropbox. VPN is surely more than just accessing your own files on your own machine, but I'm content 99% of the time. I work from home pretty much 99% of the time anyway, so using a cloud solution is practically my VPN solution.
Saturday, 04 April 2015 08:05:23 UTC
Hmm.. Last time i used my Synology was with version 4.3 and then, it wasn't allowed to use the same range.
Martin Kirk
Saturday, 04 April 2015 08:07:58 UTC
There's another point in connecting to your VPN at home. When you're connected to an unsecure open hotspot somewhere, and establish a VPN connection, all Internet traffic is routed through that secure tunnel. So all traffic is encrypted through the tunnel. At least that's what I've been told.
Sunday, 05 April 2015 02:21:36 UTC
Thanks for the write up. I've been looking to do something like this for a while. I've setup a few ubuntu VPN servers, looks like SYNOLOGY makes this easier.
Sunday, 05 April 2015 15:15:52 UTC
Great blog, one thing I had to do to get the client side working on my Windows 8.1 surface was edit the registry and:

"create a new DWORD (32-bit) key AssumeUDPEncapsulationContextOnSendRule at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent and set it’s value to 2 since both the client and the server were behind NAT devices."

I guess you didn't have this issue this time round as the screenshots suggest you had already gone through the process of setting up your VPN to MS.

Source of fix:
http://www.carecom.de/en/blog/hm/blog/trouble-connecting-to-home-network-from-windows-8-1-vpn-client-via-synology-diskstation
Dinos Christou
Monday, 06 April 2015 00:58:59 UTC
Nice blog post.
Andrew
Monday, 06 April 2015 13:50:43 UTC
Interesting post. But why setting up a vpn if it's for doing RDC ?
You can easily set up a RDC without using a VPN. Is there an added value to the VPN ?

Also: yes, the Syno can set-up port forwarding on your router, but that requires taht you enable uPnP on the router, which is a very very bad idea: any malware you download will be able to use that to open ports on your router.
Monday, 06 April 2015 13:54:26 UTC
Is your Syno also doing the DHCP on your LAN ?
If DHCP is done by the router, in my experience, you can't "see" any device on the home LAN, and you have to remember their IP adress, right ?
Monday, 06 April 2015 16:19:11 UTC
Nice tuto, Scott.

+1 for the comments around securing the connection from a public hotspot.

I have an issue and I guess it is related to my router. I can forward the ports but I do not have this option "VPN passthrough". Checking UDP ports is not easy, I did it with nmap and 1 in the 3 ports is contacted.

So what is the purpose of this function "VPN passthrough" compared to the standard port forwarding? (never had it before)

I did not find it in the documentation of my current router. I will contact the vendor.
Monday, 06 April 2015 19:28:09 UTC
Nice write-up, I've been thinking about setting up something like this myself just the other day, so I was delighted to read about your experiences getting this working.

Bonus points for bringing a smile to my face when I saw the GeForce Experience pop-up on your remote desktop screenshot, since I worked on that project when I was still at NVIDIA :-)
Tuesday, 07 April 2015 10:30:09 UTC
For months I was stuck doing exactly those steps, trying different windows options, router firmware (dd-wrt included). Finally one week before this article I gave up and switched to OpenVPN. Scotts posts are so enjoyable, that this one got me motivated for another try, and this time just before 3AM with a success.

Although I did have this queued as one of future steps I want to thank Dinos Christou for making me try it. Great community!

tl:dr My issue was also "AssumeUDPEncapsulationContextOnSendRule" registry option.
Zbigniew Kosior
Wednesday, 08 April 2015 15:25:30 UTC
I prefer OpenVPN too, setup to accept connections over TCP 443 so that you can use it in locked down environments that typically block all non-standard HTTP ports.

Got it running on my Synology (well now it's XPEnology running in a VM but same thing)
Mark Wilson
Wednesday, 08 April 2015 21:36:19 UTC
Scott,

You said you point the VPN to your internal DNS server. Is that a hardware server or is it Synology running DNS?

Rob
Robert
Thursday, 09 April 2015 02:07:33 UTC
Also not sure if the setup would work if you have more Mac system then PC's seems that the ports use is defaults for Mac computers. Port 500 is use for back to mac services.
Robert
Friday, 17 April 2015 18:08:09 UTC
Hey Scott! I've been using a VPN to my Fritz!Box for years. The main use case for are public hotspots. Unfortunately, there is no way to force the iPhone to enable VPN if it is not on the home Wifi and even worse, it will happily download email etc before I have a chance to switch VPN on. Any ideas?
René Ruppert
Wednesday, 24 June 2015 16:32:45 UTC
I don't want to high jack this awesome post but I'm interested in setting up a surveillance camera system for my home and would like to tie it to a NAS like this. Any recommendations for a surveillance system? Thanks.
Jeff
Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.