Posting this here for posterity to help others since the various places I searched had either incomplete or incorrect information. These instructions are for getting the PIA VPN working with Synology DSM 6.X (I have not tested with DSM 7.X).
Preparation:
- Download the OpenVPN files from here: https://www.privateinternetaccess.com/openvpn/openvpn.zip
- Extract the .zip file and find your countries relevant .ovpn file.
- Open [your countries .ovpn file] using a text editor like Notepad.
- Delete the word “compress” and replace with “comp-lzo”.
- Save your changes and close the file.
Open Synology DSM:
- Open “Control Panel”.
- Open “Network”.
- Select “Network Interface”.
- Create “VPN Profile”.
- Select “OpenVPN (via importing .ovpn file)”.
- Give the “Profile” a name.
- Input your user name and password from your PIA account.
- Import the .ovpn file by browsing to [your countries .ovpn file].
- Import the CA certificate by browsing to the “ca.rsa.2048” file.
- Click “Advanced Options”.
- At the “Client Revocation” field, click on “Browse” and import the “crl.rsa.2048.pem” file.
- Click “Next”.
- Make sure to tick “Use default gateway on remote network” and “Reconnect when the VPN connection is lost”.
- Click “Done”.
That’s it! It should now work!
Edit: It has been brought to my attention that PIA has been acquired by a malware distributor company. I therefore do not recommend the continued use of PIA and urge you to find an alternative VPN provider.
PIA was recently acquired by cape technologies (along with express vpn) who have had a less that stellar reputation in the past. I would maybe run a quick google search and decide if you feel its safe
For those of you struggling to get this to work on DSM7.x, this is what finally got things running on my DS218+:
Preparation:
- Create a custom OpenVPN file from here:
- https://www.privateinternetaccess.com/account/ovpn-config-generator
Select OpenVPN 2.4 or newer → Linux → Select VPN Region of your choice (I have 3 separate configs built: Two US and One Canadian, but you can load as many or few as you want) → Select Port (I’m running the first default choice but there are several so you have options if your situation has specific requirements) → Click Generate
- Open the newly created .ovpn file using a text editor like Notepad.
Delete the word “compress” and replace with “comp-lzo”.
Delete the entire “” section
- Download the default OVPN config pack ZIP here:
- https://www.privateinternetaccess.com/openvpn/openvpn.zip
- Extract the .zip file and find the files labeled ca.rsa.2048.crt and ca.rsa.2048.pem then move them to the folder containing the .OVPN profiles you created in the first step.
Open Synology DSM:
- Open “Control Panel”.
- Open “Network”.
- Select “Network Interface”.
- Create “VPN Profile”.
- Select “OpenVPN (via importing .ovpn file)”.
- Give the “Profile” a name.
- Input your user name and password from your PIA account.
- Import the .ovpn file by browsing to the folder you saved your custom configs to.
- Import the CA certificate by browsing to the “ca.rsa.2048” file.
- Click “Advanced Options”.
- At the “Client Revocation” field, click on “Browse” and import the “crl.rsa.2048.pem” file.
- Click “Next” and unless your specific needs require otherwise select all three checkboxes.
- Click “Next” to complete the process.
To test your new profile navigate to the Network panel, select Network Interface then the profile you wish to use, and click “Connect.”
I created this guide by sorting through guides created by others like the one above, and am very thankful for the active NAS community as trying to figure all of this out on my own would have been a nightmare. Hope this helps anyone else running DSM7.x that’s having the same issues I was.
Has anyone actually tested this and confirmed that traffic is actually going through their VPN? I was able to get it connected successfully using these instructions, but if I test my IP at ipleak.net, it is showing my traffic is not going through the VPN even though it says it is connected in DSM.
Edit: I just figured it out. You also have to make sure “Use default gateway on remote network” is checked on the last screen, or you will be connected to VPN but your traffic will not be going through the VPN. Just a minor detail. You also probably want to check “Reconnect when VPN connection is lost” to make sure the connection stays alive.
Be sure to check your connection using ileak.net when you are done by visiting https://ipleak.net in a new window/tab in your web browser. Navigate to the section that says Torrent Address detection. Activate that feature and then copy and paste the Magnet link into the DSM Download Station app (install package if necessary). Start the download and wait for ipleak.net to refresh. Check the IP address. It should not match your local IP, but that of your VPN connection.
Thank you for this detailed set of instructions! I use PIA on my phone & PC to add security on guest networks when at work.
Would configuring the NAS to connect through a VPN on my home network add speed, security, both or neither? I’ve heard arguments for & against exclusively using a VPN so looking for more info.
Further to this you can also setup a DDNS that points to your NAS. This can then be used, together with an SSL cert and your own custom domain, to allow remote users, if you have them, still access Emby/Plex and other applications (sonarr/radarr etc) without having to use an openvpn client. Basically, all your system traffic goes through the VPN, Emby/Plex goes through your custom DDNS, protected by SSL.
You sir, you are the best. Tks!
This is great, thanks for this step by step guide!
When VPN is turned on, is my PLEX still accessible inside and outside my network?
Hi, somewhat off-topic question, but what’s wrong with DSM 7.x? I just got my first synology NAS today and I’ll be setting it up soon, should I setup with DSM 6?
Let me know how this works out for you long term. I had this exact setup for a long time and every 3-4 month the connection would just die and refuse to reconnect. I then had to go in and redownload fresh OVPN files and go through the whole process over and over. PIA stands for more than Private Internet Access so I dumped them for another provider and haven’t had the problem since.
PIA still or good now? Reading that people dont trust it and not using it anymore, i just bought a 3 years vpn for 70 euro and it does works
FYI, I did this with my linksys router. It had a VPN built in and integration for noip for ddns. The latter allows you to use a host name that stays tied to whatever IP you have.
For torrents, is the tracker you use able to connect to you ???
What does pt. 4 of the preparation do?
What means private internet access here? Sorry i am too new and dont know it technically
Hi! I was able to get openvpn working through my pia credentials! Thanks!
Is there a way to make the VPN ip static?
Is there a way to gain access to pia VPN options like Killswitch? Just an openvpn version?
Do you have a recommendation for a different VPN service? I need something to use my work computer on public networks.
Thanks for this! Seems to be working great!
I was completely unaware of this. Thank you for the information. As a result I have unsubscribed from PIA. I will continue to use it until my sub expires and then move to an alternative VPN provider. Thanks again.