Synology is able to do everything a macOS Server could do, and more. So if you need to move your VPN service, it’s worth looking at a number of different solutions. The most important question to ask is whether you actually need a VPN any more. If you have git, mail/groupware, or file services that require remote access then you might want to consider moving these into a hosted environment somewhere. But if you need access to the LAN and you’re a small business without other servers, a Synology can be a great place to host your VPN services.
Before you setup anything new, first snapshot your old settings. Let’s grab which protocols are enabled, running the following from Terminal:
sudo serveradmin settings vpn:Servers:com.apple.ppp.pptp:enabled
sudo serveradmin settings vpn:Servers:com.apple.ppp.l2tp:enabled
Next, we’ll get the the IP ranges used so we can mimic those (or change them) in the new service:
sudo serveradmin settings vpn:Servers:com.apple.ppp.pptp:IPv4:DestAddressRanges
Now let’s grab the DNS servers handed out so those can be recreated:
sudo serveradmin settings vpn:Servers:com.apple.ppp.pptp:DNS:OfferedServerAddresses:_array_index
sudo serveradmin settings vpn:Servers:com.apple.ppp.l2tp:DNS:OfferedServerAddresses:_array_index
Finally, if you’re using L2TP, let’s grab the shared secret:
sudo serveradmin settings vpn:Servers:com.apple.ppp.l2tp:L2TP:IPSecSharedSecretValue
Once we have all of this information, we can configure the new server using the same settings. To install the VPN service on a Synology, first open the Synology and click on Package Center. From there, click on All and search for VPN. 
Then click on the Install button for VPN. Once installed, open VPN Server from the application launcher in the upper left-hand corner of the screen. Initially, you’ll see a list of the services that can be run, which include the familiar PPTP and L2TP, along with the addition of Open VPN. 
Before we potentially open up dangerous services to users we might not want to have access to, click on Privilege. Here, enable each service for each user that you want to have access to the VPN services.
Now that we can safely enable and disable each of the services, click on PPTP in the sidebar of the VPN Server app (if you want to provide PPTP-based services to clients).
Here, check the box for “Enable PPTP VPN server” and enter the following information:
- Dynamic IP address: The first DHCP address that will be given to client computers
- Maximum connection number: How many addresses that can be handed out (and therefore the maximum number of clients that can connect via PPTP).
- Maximum number of connections with the same account: How many sessions a given account can have (1 is usually a good number here).
- Authentication: Best to leave this at MS-CHAP v2 for compatibility, unless you find otherwise.
- Encryption: Leave as MPPE optional unless all clients can do MPPE and then you can enforce it for a stronger level of encryption.
- MTU: 1400 is a good number.
- Use manual DNS: If clients will connect to services via names once connected to the VPN, I’d put your primary DNS server in this field.
Click Apply and open port 1723 so clients can connect to the service. If you’ll be using L2TP over IPSec, click on “L2TP/IPSec” in the sidebar. The settings are the same as those above, but you can also add a preshared key to the mix. Go ahead and check the enable checkbox, provide the necessary settings from the PPTP list, and provide that key and then click on Apply. Note that the DHCP pools are different between the two services. Point UDP ports 1701, 500, and 4500 at the new server to allow for remote connections and then test that clients can connect.
That’s it. You’ve managed to get a new VPN setup and configured. Provided you used the same IP address, same client secret, and the ports are the same, you’ll then be able to probably use the same profile to install clients that you were using previously.
