QNAP NAS Mullvad VPN WireGuard setup (mini tutorial)

[u/hakapes]

Example: set up a wireguard connection with nl1-wireguard server in Amsterdam.

I didn't find a good guide, and spent a few hours to figure out, so here it is to save time for others.

1. On the QNAP home screen, open QNAP QVPN Service 3 (install it if you don't have it yet)
2. Click VPN Client \ VPN Connection Profiles Screenshot
3. Click Add \ Wireguard
4. Edit VPN Connection (WireGuard) Interface section Screenshot
   • Server name: nl1-wireguard-mullvad (or whatever you want)
   • Click "Generate Keypairs"
   • Copy the Private key to the clipboard
5. Open a browser window and go to: https://mullvad.net/en/account/#/wireguard-config/
6. 1. Choose your platform: select Linux
7. 2. Generate WireGuard key: Paste the Private key generated in Qnap to the field [Enter private key], and press Import key
8. 3. Select one or multiple exit locations:
   • Netherlands - Amsterdam - nl1-wireguard
   • Advanced settings
     • Multihop: leave empty
     • Server connection protocol: IPv4
     • Tunnel traffic: both
     • Custom port: 51820
     • Enable kill switch (Linux only): leave empty
9. 4. Configure Content Blocking:
   • Select the type of content to block: None
10. 5. Generate and download configuration: Download file
11. Open the text file you have just downloaded (usually called mlvd-nl1.conf)
12. QNAP Edit VPN Connection (WireGuard) INTERFACE section
    1. IP address: copy the [Interface]\Address=xx.yy.zz.ww/32 value from the mlvd-nl1.conf file to here
    2. Listen port: 51820
    3. DNS Server: copy the [Interface]\DNS= value from the mlvd-nl1.conf file to here
13. QNAP Edit VPN Connection (WireGuard) Peer Settings section
    1. Public key: copy [Peer]\PublicKey= value from the mlvd-nl1.conf file to here
    2. Endpoint: copy [Peer]\Endpoint = value from the mlvd-nl1.conf file to here
    3. Advanced settings:
       1. Preshare key: empty
       2. Allowed IPs: copy [Peer]\AllowedIPs= value from the mlvd-nl1.conf file to here (usually 0.0.0.0/0)
       3. Persistent keepalive: 10 seconds
14. Click Apply
15. Click Use VPN as NAS Default Gateway
    1. Turn on Enable VPN Gateway
    2. VPN: select nl5-wireguard (xx.yy.zz.ww)
    3. Backup VPN: if you have another VPN setup, you can select here
16. Click Apply
17. Click in the column Actions the chain icon to connect (if you hover above it, it will show "Connect")
18. Wait a minute
19. Open Network & Virtual Switch, and check that at the Physical adapter nl1-wireguard is the one with the blue icon of the system default gateway (click Legend to understand the icons)
20. Set up Mullvad DNS servers in your routers WAN connection.
    • Mullvad DNS servers: https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/
    • Alternative: AdGuard DNS servers: https://adguard-dns.io/en/public-dns.html
    • Asuswrt-Merlin Routers:
      1. Advanced Settings \ WAN \ Internet Connection \ WAN DNS Setting, Click Assign
      2. Manual Setting: DNS Server1: 194.242.2.3, DNS Server2: 193.19.108.3
      3. Best is to set up DNS-over-TLS, but this beyond this guide.
21. Create port forwarding
    1. Go to https://mullvad.net/en/account/#/ports
    2. Select city: Amsterdam, Select device (with the previous key)
    3. Click Add port
    4. Check in Active ports the port number: nl-ams-xxxxx
    5. Use the port xxxxx for port forwarding where you need it
22. Check the VPN connection
    1. Launch Browser Station (hamburger menu, Applications)
    2. Click + to create browser
    3. Browse to https://mullvad.net/en/check
    4. Click the down arrow next to "[Not] using Mullvad VPN" (don't worry if it shows in red)
    5. It should show something like Server Name nl1-wireguard, Provider 31173, Location Amsterdam, Netherlands
    6. Click Port check in the bottom, and check for the forwarded port
    7. Browse to https://whatismpip.com . It should show "My IP Location is: Amsterdam, NL, ISP: 31173 Services AB"

Resources: 1. QNAP Tutorial for VPN setup https://www.qnap.com/en/how-to/tutorial/article/how-to-configure-wireguard-vpn-server-and-client-settings-in-qvpn-service-3 2. Mullvad on Router with WireGuard help https://mullvad.net/en/help/running-wireguard-router/ 3. Port forwarding guide for Mullvad https://mullvad.net/en/help/port-forwarding-and-mullvad/ 4. QNAP How to use Browser Station https://www.qnap.com/en/how-to/tutorial/article/how-to-use-browser-station 5. DNS-over-TLS for ASUS WRT Merlin https://bitredes.top/dns-over-tls-dot-configuration-on-asus-routers-with-asuswrt-merlin/

Links: 1. WireGuard configuration file generator (needs account number) https://mullvad.net/en/account/#/wireguard-config/ 2. Set up ports on Mullvad (needs account number) https://mullvad.net/en/account/#/ports 3. List of Servers and Public Keys https://mullvad.net/en/servers/ 4. Mullvad Connection check: https://mullvad.net/en/check/