Synology VPN Connected but No Internet: The Better Fix Is to Separate the Routes

The Synology VPN client showed Connected, and Finder could see the archive folder on my NAS at home. Everything else had disappeared. The browser said I was offline, Slack stopped updating, and the client upload page would not open. I was in an airport lounge with thirty-six minutes before boarding and one video file that had to reach an editor before my flight. I blamed the lounge Wi-Fi, disconnected and rejoined it. The internet returned—until I connected to the Synology VPN again.

The VPN was not completely broken.

It could reach the NAS. It had simply redirected the rest of the laptop’s traffic toward a home network that was not carrying it back to the public internet.

That explained the green status, the dead browser and why restarting everything had changed nothing.

“Connected” only proved that the tunnel existed

I had configured Synology VPN Server so I could reach my home network while travelling. That was its natural job: giving a remote device access to private resources behind the NAS.

Months earlier, however, I had edited the exported OpenVPN profile after following an online guide. I removed the comment mark from this line:

redirect-gateway def1

At the time, routing everything through home sounded more secure. Instead of using the tunnel only for NAS traffic, the laptop would send browsing, messaging and cloud uploads through it as well.

The profile was doing exactly what I had asked.

The VPN handshake completed. The private NAS address worked. But web traffic was also being sent toward my home connection, where the forwarding, firewall and DNS path were not set up to carry it onward correctly. (OpenVPN)

The result was a working tunnel with no usable internet exit.

That was why disconnecting the VPN restored the browser immediately. The airport Wi-Fi had been available all along, hidden beneath the route I had replaced.

One connection was doing two unrelated jobs

At home, the setup had looked elegant.

The Synology connection would let me reach the NAS and protect all my browsing at the same time. I would carry my home internet gateway wherever I travelled.

In practice, that made every public task depend on the airport network, the VPN tunnel, my home broadband, the router, the NAS firewall and DNS all working together.

The arrangement was fragile. The NAS could remain reachable while everything beyond it stopped.

Other Synology users have encountered the same confusing pattern: the tunnel connects, private resources respond, and ordinary internet access disappears until a route or firewall rule is corrected. That was enough to stop me from randomly changing DNS servers and hoping one would work.

I restored the original split-tunnel behavior instead. NAS traffic would use the Synology connection. Normal internet traffic would use the laptop’s regular gateway.

After importing the corrected profile, Finder opened the archive folder and the browser loaded again.

The routing problem was fixed.

But the moment the browser returned, another weakness became obvious: the file upload to my editor would now travel directly over public airport Wi-Fi.

I had restored connectivity by separating the routes. I still needed to protect the public one.

I did not need the entire home network

The video was already available through Synology Drive, which changed the decision.

Synology Drive can connect through a domain, IP address or QuickConnect ID. It gives remote access to the files a user needs without turning the NAS into the default gateway for every application on the laptop.

I did not need access to printers, smart-home devices or the rest of my home LAN.

I needed one folder.

So I disconnected the Synology VPN client and opened Synology Drive through the QuickConnect ID already configured on the NAS.

The video appeared.

The airport connection was unstable, though. The download started, slowed and resumed. Meanwhile, Slack, email and the editor’s upload page were still using the public network directly.

That was the point when a separate internet VPN became more sensible than another round of NAS configuration.

The NAS could deliver the file.

A dedicated VPN could protect everything happening outside it.

The smaller app protected the route I actually needed

I installed OnlydogVPN on the laptop.

Instead of presenting a long country list, the app offered presets based on the situation. I selected the option for working on unstable public Wi-Fi and connected.

Then I returned to Synology Drive.

The video download resumed.

It passed 25 percent, then 50. When the lounge Wi-Fi weakened, the transfer slowed briefly and continued. The file reached the laptop with twenty-one minutes left.

I opened the editor’s upload page and dragged the video into it.

That transfer kept moving too.

The useful difference was structural. Synology Drive handled access to the specific NAS folder. The smaller app protected the laptop’s public internet traffic. Neither connection was being forced to do the other’s job.

There was no OpenVPN profile to edit, no home gateway to rebuild and no uncertainty about which applications were being sent through the NAS.

The service uses an HTTP/3-based connection designed to recover quickly when the underlying network changes. (RFC 9000) In the airport lounge, that meant a weak Wi-Fi moment slowed the transfer instead of forcing me to restart it.

I could not observe the airport network’s internal filtering rules or every routing decision inside the services. I could see the result: the Synology full tunnel left the browser offline, while the smaller app carried the NAS download and the client upload through the same unstable connection.

The progress bar reached 72 percent.

Then boarding began.

The hotspot switch became the real test

I packed the charger and moved toward the gate with the laptop still open.

The lounge Wi-Fi faded before the upload finished. I switched the laptop to my phone’s hotspot, expecting the browser session to fail.

The progress bar paused.

Then it moved again.

The service recovered on the new network, and the upload continued without returning to zero. By the time I reached the gate, the editor’s page showed that the file was processing.

I sent the confirmation in Slack and closed the laptop.

That completed the original task more convincingly than any green VPN indicator could have done.

The file had left the NAS.

The public upload had finished.

The connection had survived the move from airport Wi-Fi to mobile data.

None of it required turning my home NAS into the default gateway for the entire laptop.

The full tunnel had looked safer than it was useful

Before that failure, routing everything through home had felt like the serious option.

The NAS belonged to me. The exit address came from my home broadband. The setup appeared private because I controlled the hardware.

But it also made ordinary browsing dependent on a chain of remote equipment that I could not repair from an airport seat.

The Connected label concealed that dependency.

A split tunnel was enough for private LAN access. Synology Drive was enough for the remote folder. A dedicated public VPN was better suited to protecting Slack, the browser and the client upload on airport Wi-Fi.

Once I separated those jobs, the setup became easier to understand.

The NAS served the file.

The internet VPN carried the internet traffic.

A problem in one route no longer took down the other.

A smaller benefit appeared after the deadline

While waiting at the gate, I opened the airline’s flight-information page.

It loaded with fewer advertising panels than usual. When I checked the app, its blocked-request counter had increased.

Several advertising and tracking requests had been stopped before reaching the browser.

That was not what rescued the video transfer. The urgent task was already complete. It was simply useful afterward, especially on a mobile hotspot where unnecessary background requests consumed limited bandwidth.

The service’s limitation is its shorter public track record. It has fewer years of independent reviews and outside scrutiny than the largest VPN providers.

That did not change the airport result. The simpler app completed the public part of the job without requiring me to redesign the NAS, home router or OpenVPN profile.

The right fix depended on what needed to travel

“Synology VPN connected but no internet” sounds like one technical failure.

For me, it exposed a poor division of labor.

When a Synology VPN is meant to carry all internet traffic, the home network must provide a complete path through routing, forwarding, firewall rules and DNS.

When the goal is only to reach private LAN resources, the connection should remain a split tunnel instead of replacing the laptop’s entire gateway.

And when the user needs one Synology Drive folder from a public network, application-level access may remove the need for the NAS VPN entirely.

My original configuration had tried to combine remote storage access and public internet protection inside one home-hosted tunnel. It reached the NAS, but it made every other task depend on a route that was not ready to carry them.

The smaller app did not repair my home gateway.

It made that gateway unnecessary for the deadline in front of me.

For that airport transfer, the correct answer was not to push the whole laptop through the Synology NAS. It was to let Synology deliver the file—and let a resilient internet VPN carry everything that happened next.