Best option is always setting up the VPN endpoint at the router, not at the NAS.
Regards
See also this post.