Synology DSM offers you a quite simple interface for managing your VPN connections, however, aside the fact that it is missing a lot of advanced options, that are needed for certain providers, it also lacks the possibility of automation. For example, the reason I am writing this is, I am using an OpenVPN connection on my second Synology station together with multiple gateways. That’s all fine and good, however, as soon as the VPN client gets into a timeout, it will try to resolve the host name in the config via the VPN gateway, which is now inaccessible. The only way I found to fix this, is simply reconnecting to the VPN server. Sadly, Synology doesn’t make that simply exactly simple.
Basics of Synology VPN handling
Synology is using various scripts and flags for handling vpn connections. All of the relevant files for this are found in
/usr/syno/etc/synovpnclient. Also, the binary file the disk station uses for connection handling is found at
/usr/syno/bin/synovpnc, aliased to
A list of the files and directories in this directory:
l2tp- Holds configs for l2tp connections
pptp- Holds configs for pptp connections
openvpn- Holds configs for openvpn connections
scripts- Internal scripts by the VPN client
vpnc_connecting- A (only temporary) flag file, this will be very important later!
Simply typing the
synovpnc command will give us sufficient information about its usage.
Disconnecting a VPN connection
In order to disconnect a VPN connection, we can use the
kill_client function of synovpnc. The script requires either the name of the connection, as it is saved in the UI via
--name=MYVPN or the id via
Connecting to a VPN server
Now, disconnecting is pretty straightforward. Connecting however, is a bit more tricky, since synovpnc completely ignores arguments and only reads its parameters from a flag file at
If we attempt a connection, as we would expect it to work, we get the following response:
And nothing happens…
What we actually have to do is, write our parameter into the flag file mentioned above and then tell the script to connect or reconnect. When we
cat /usr/syno/etc/synovpnclient/vpnc_connecting while connection to the VPN from the UI, we actually see, which parameters are put in there. The script expects the config id and name, as well as the protocol type to connect in the flag file.
In fact, if you open the UI alongside the terminal, you will see, that the UI state changes to connecting, after we write the first line into the file. After executing the connect command, it should switch to connected.
Automatically reconnecting a VPN connection
The problem mentioned in the preamble of this article, is rather easy to solve, once we know how to connect and disconnect the VPN client via command line. For my example, I simply added a task that will execute the following bash script every 10 minutes:
Simplified, the script reads the last line from the openvpn log, since I am using an openvpn connection. If the log message contains the expected error, it will disconnect the VPN connection, wait for 20 seconds (which should be more than sufficient) and then write all the flags and cause the tool to reconnect. In the end, it will check if a successful connection was established and output a status message.
This is only one of the many examples of how you can use the power of manually manipulating VPN connections. The really important part is, that you are able to do it, despite Synology not providing any information on this whatsoever.