Frequently Asked Questions
Why does my OpenVPN connection to a Synology suddenly stop working over UDP?
Symptoms:
The OpenVPN client gets stuck during connection setup and eventually runs into a timeout before a TLS connection is established.
A typical message is “Waiting for RESET”.
Cause:
The TLS handshake is not completed successfully because the required UDP packets do not reliably reach the server.
Common reasons include:
- Restrictions or filtering on firewall, router, or ISP level
- Overly aggressive UDP timeouts on NAT gateways
- MTU or fragmentation issues (e.g. PPPoE, DS-Lite, mobile networks, IPv6/IPv4 translation)
- Network devices or providers that prioritize, throttle, or block UDP traffic
Because UDP is connectionless, these issues often occur without any meaningful error message.
Resolution:
Switch the OpenVPN transport protocol from UDP to TCP.
TCP is significantly more robust than UDP:
- TCP maintains a real connection state
- Lost packets are automatically retransmitted
- Firewalls and NAT devices usually handle TCP traffic more favorably
- MTU-related issues are less critical
This allows the TLS handshake to complete successfully and restores a stable VPN connection.