I'm concerned about the security of part of my home setup, but I'm quite unfamiliar with a lot of this so I thought I'd start out by saying what I'm trying to do, in case my solution is a poor one in the first place.
My home network is pretty simple, ADSL modem connected to a wireless router. Synology NAS is wired ethernet to router, everything else is a wireless client. I want all WAN traffic on the NAS to be encrypted and not linked to my home IP. I want web traffic for other clients to go through my regular IP by default, but to also have the option of proxying it through a remote IP to circumvent browsing restrictions.
To do this I set up OpenVPN with PEM authentication on a dedicated server I'm already running for other purposes. This authentication seems to be the only one compatible with the Synology VPN client. There is a proxy server also running on the NAS that I plan to use with some kind of browser extension as a means to toggle between browsing normally or through the VPN.
Anyway, my concern is that because there is no network security other than whatever basic stuff the dedicated server host has in place at a network level, and whatever is running by default in Debian, my NAS at home is basically exposed through the dedicated server WAN IP. I guess for that to be true some route would need to be configured in iptables that allowed traffic to reach the NAS from the WAN IP but I really don't understand how that works... Advice or recommended reading would be appreciated.