So I would prefer to keep it that way rather than low.Port forwarding appears may break when I have the security level set 'medium', but there appear to be complex rules I can write up to bypass this. The DDNS works because if I temporarily permit external web admin on the VZ server, I can pull that web page up.I think but don't know, that it's probably better to have the router set to medium security setting vs low (is this right as a generalization unless I know more about what I'm doing?). I'm testing using an iphone with wifi turned off, using DS provided apps.

So I probably will need to make port forwarding work, and I need to test this more (as in prior paragraph).If anyone has experience with synology diskstations-I'm wondering if there's an easy way to test whether the ports are opened on it. I should (and will) test this further by disabling the port forward and trying with the low global setting (see if it's different).I've been reading more on DMZ-I could do this, but it would make more sense to do it if I had all traffic go through the synology, or if I had a second firewall between the DMZ and the rest of my network. Low on the router yields a refused connection, which maybe means the port is open and the synology says 'no'. Medium times out, like it's being blocked w/o response. So, I specify a device or ip address (drop down on this router), then I select a protocol (TCP), then source ports, destination ports, and 'foward to port' (same as incoming port).I have successfully forwarded ports in the past, on other routers-and it might be something else.I get different results if I change the global 'security' (low/med/high) setting.

Synology Vpn Port Forwarding