Synology Package Center Can't Connect? Here's the Fix

You're in Package Center, trying to install or update something — maybe Docker, maybe a backup tool — and you get the red banner: "Cannot connect to the update server. Please check your network settings and try again." It's not intermittent; it's persistent. You can browse the web just fine from a laptop on the same network. This happens most often right after a fresh DSM install, or after you've changed your router or ISP. The NAS has internet, but Package Center doesn't think so.

What's Actually Happening Here

The root cause is almost never that Synology's servers are down. They're not. What's happening is your NAS can't resolve the hostnames that Package Center uses — or it's trying to route through a proxy that doesn't exist anymore. DSM 7 changed how it handles proxy settings, and DSM 6 had a known bug where it'd cache a bad proxy config even after you cleared it. The second most common cause: your router's DNS servers are slow or filtering, and the NAS's built-in DNS resolver stalls on certain queries.

Package Center doesn't just hit one host. It queries update.synology.com, global.synologydownload.com, and several others. If any one of those fails, DSM throws that generic error. It's not helpful, but once you know that, you can test each one individually.

The Fix: Step by Step

Skip the "reboot your router" advice. That wastes ten minutes for zero gain. Here's what works.

Check DNS resolution manually via SSH
SSH into your NAS (admin or your user with sudo). Run:
```
nslookup update.synology.com
```
If it fails or returns something like server can't find update.synology.com: NXDOMAIN, your DNS is the problem. If it returns an IP, move to step 2. If you get a timeout, the NAS can't even reach its DNS server — check your network gateway.
Ping the IP that nslookup returned
```
ping -c 3 <IP_address>
```
If that works but ping update.synology.com fails, DNS is still broken. Set static DNS servers in Control Panel > Network > Network Interface > Edit > IPv4. Use 8.8.8.8 and 1.1.1.1. DSM 7 sometimes ignores DHCP-provided DNS, so static entries override that.
Purge proxy settings
Go to Control Panel > Network > Proxy. If it's set to anything other than "No proxy", set it to "No proxy" and apply. Then SSH in and run:
```
sudo synoservice --restart pkgctl
```
This restarts the package manager daemon. On DSM 6, there's a cached proxy config file at /usr/syno/etc/packages/feeds/feedlist.conf that sometimes holds stale proxy URLs. Delete it (sudo rm /usr/syno/etc/packages/feeds/feedlist.conf) and re-run the restart command. DSM will regenerate it on next Package Center launch.
Check the firewall
If you have the firewall enabled (Control Panel > Security > Firewall), make sure outbound HTTPS (port 443) is allowed for the Package Center process. The rule should allow any source to any destination on TCP 443. Synology's firewall can block outbound traffic if the rule order is wrong — move the allow rule above any "deny all" rules.
Test with curl to confirm
Still failing? SSH in and run:
```
curl -I https://update.synology.com
```
If you get a valid HTTP response (200 or 302), the network path works. If you get a timeout or SSL error, your router might be doing deep packet inspection or blocking certain SNI hostnames. Log into your router and check for "Content Filtering" or "DNS-based filtering" features — turn them off temporarily to test.
DSM 7 specific: reset the update cache
On DSM 7, there's a database at /usr/syno/etc/packages/update_cache.db. Stop Package Center, delete that file, and restart:
```
sudo synoservice --stop pkgctl
sudo rm /usr/syno/etc/packages/update_cache.db
sudo synoservice --start pkgctl
```
This forces a fresh fetch of the package feed. I've seen corrupted cache files cause the exact same "cannot connect" error even when DNS and proxy are fine.

Still Failing? Check These

IPv6 — If your router hands out IPv6 but the NAS's IPv6 stack isn't stable, Package Center might try IPv6 first and fail. Disable IPv6 on the NAS in Control Panel > Network > Network Interface > Edit > IPv6 > Off.
DSM version itself — On very old DSM 6.x versions (like 6.0-7321), the SSL certificate bundle is ancient and can't validate modern server certs. Update DSM via manual download first from Synology's site, then retry Package Center.
Corporate proxy — If you're behind an authenticated proxy, Package Center doesn't support proxy authentication. You'll need to bypass it by adding your NAS's IP to the proxy exclusion list on your router.
VPN client on the NAS — If you're running a VPN client on the NAS itself, the VPN tunnel might be dropping specific routes. Disconnect the VPN, test Package Center, then reconnect. If it works without VPN, you need to add a route for Synology's update servers through the main interface.

One last thing: Synology has a status page at status.synology.com. Check it before deep-diving — but honestly, in four years of fixing these, I've never seen Package Center down. It's always DNS or a proxy ghost.