Tailscale on a Synology NAS - Secure Remote Connection without Port Forwarding or Firewall Rules

Access Synology NAS from anywhere
Tailscale makes it easy to securely connect to your Synology NAS devices over WireGuard®.

Tailscale is free for most personal uses, including accessing your NAS.

Installation steps
Visit the Synology Package Center (tutorial).

Search for and install the Tailscale app.

Once the app is installed, follow the instructions to Log in using your preferred identity provider. If you don’t already have a Tailscale account, a free account will be created automatically.

Now your Synology NAS is available on your tailnet. Connect to it from your PC, laptop, phone, or tablet by installing Tailscale on another device.

That’s it!

Features
When used with Synology, Tailscale supports these features:

Web-based login to any supported identity provider.
Access your Synology NAS from anywhere, without opening firewall ports.
Share your NAS with designated Tailscale users, using node sharing.
Restrict access to your NAS using ACLs.
Use your NAS as a subnet router to provide external access to your LAN. (Currently requires command-line steps.)
Use your NAS as an exit node for secure Internet access from anywhere. (Currently requires command-line steps.)
Limitations & known issues
Some things to be aware of:

If you upgrade Synology from DSM6 to DSM7, you will need to uninstall and then reinstall the Tailscale app. Do not perform the Synology DSM7 upgrade over Tailscale or you may lose your connection during the upgrade.

Tailscale uses hybrid networking mode on Synology, which means that if you share subnets, they will be reachable over UDP and TCP, but not necessarily pingable.

Other Synology packages cannot make outgoing connections to your other Tailscale nodes by default on DSM7. See instructions below to enable.

Tailscale on Synology currently can do --advertise-routes but not --accept-routes. This means that if you have other subnet routers, devices on those other subnets will not yet be able to reach your NAS or devices on its local subnet.

Advertising subnet routes can only be configured from the command line, not the web GUI.

Tailscale SSH does not run on Synology.

Some of those limitations are imposed on Tailscale by the DSM7 sandbox. Others we intend to fix in future releases of Tailscale.

See our Synology tracking issue on GitHub for the latest status on the above issues.

Manual installation steps
An alternative to the recommended approach of installing Tailscale from the Synology Package Center is to install Tailscale using a downloadable Synology package (SPK). A reason you might want to install from an SPK is to access new Tailscale features that are not yet released in the Tailscale version that is available from the Synology Package Center.

To manually install Tailscale:

Download the SPK for your Synology device from the Tailscale Packages server. Synology SPKs are available from both stable and unstable release tracks. To determine which download is appropriate for your Synology device, visit the Synology and SynoCommunity Package Architectures page and look up your architecture by Synology model. Then, find the SPK download at Tailscale Packages that corresponds to your model.

In the Synology DSM web admin UI, go to Main menu - Package Center.

Click Manual Install, click Browse, select the SPK (.spk) file that you downloaded, and then click Next.

Follow the remaining prompts to confirm settings and complete installation.

At this point tailscaled should be up and running on your Synology device and you can configure it either using the Tailscale package’s Synology web UI or the CLI over SSH.

Video Chapters
00:00 - The Start
00:38 - When did I start using Tailscale on my Synology NAS?
01:14 - What is Tailscale?
01:49 - Why is remote accessing your NAS so dangerous and how is it done?
02:38 - What is Port Forwarding and How does it work?
03:37 - What About a VPN to Conenct to your NAS Remotely?
04:33 - Tailscale vs Port Forwarding vs Synology Quick Connect vs VPNs
06:33 - How to Install Tailscale on your Synology NAS
06:57 - How to Setup Tailscale on your Synology NAS
07:50 - How to Install, Setup and Connect to the NAS over TAILSCALE with your Windows. Mac, Android or iOS system
09:32 - Tailscale to Synology NAS Connection remote connect demonstration
11:28 - Using Tailscale DOES NOT mean you shouldn't be aware of your Synology NAS Security!!!!

[j_holtslander]

Every time I go looking for info online regarding using my NAS it's always NASCompares that I end up at as a destination. Haha. Keep up the good work!

[ZajaxFilms]

How the hell did you know I was looking to research this today???

[Jonkelly-qj]

You mention security at the end - where can I find instructions for adding such security - e.g. you mentioned Lets Encrypt?

[vladiesc]

Nice one! Been using it on my Asustor NAS a while. Great piece of software! No port forward means less chance of being hacked.

[sandervanbergem]

If I understand it correctly you don't need to create an quickconnect ID. But how would you connect the Synology photo&file apps on your mobile then? Or do you still create that ID and still keep the ports closed?

[Tetra]

great guide! do you know how we can use Tailscale in conjunction with hyperbackup/vault to do secure connections to other Synology NAS's?

[NikolaBulj]

What about the firewall? Should we just allow tailscale from the ip-range they give, or also other services we might need to use (photos for example)?

[tonyvalenti]

Thanks again for yet another great video. I have been using Tailscale for several months now. Yes it was easy to setup, but I would have mentioned their recommendation to add a single line to your NAS Task Scheduler to ensure connection on reboot. That said, my use case was to connect two Synology’s, one onsite and the other offsite to use Hyper Backup supporting my 321 backup strategy. Worked great for about 7 backups, then disconnected and I was never able to reconnect or login through Hyper Backup to Hyper Vault. 😣

Tried asking everywhere, Synology and Tailscale subReddits, Synology and Tailscale themselves. No one has a solution recommendation. Would be great to see if you could get it working and share another video.

[revlioquick]

Could I request some content? The title would be "break your cloud provider reliance".

Overall the review/video would provide a guide to using local NAS resources to replace Google/Amazon/Apple/MS cloud services for:

1. Automatic mobile device photograph/video backup #most important I believe
2. Document sharing/editing
3. Sharing of content via common social media, messaging platforms

What with costs of these services constantly increasing, and the helpless feeling of being tied, powerless to their control. How easy is it to use Synology/QNap s/w to truly replicate that 'memories happily backed-up' feeling.

[haydenlee]

I only have a QNAP TS-231P3, so there is no native support for Tailscale.
However, I was able to set up a Tailscale VPN thanks to an extra help from another Youtube video about how to setup Tailscale via docker containers (for QNAP there's "ContainerStation")

I'm loving Tailscale so far!! It's so easy!!

[ekowlloyd]

He didn’t mention but you also need to install Tailscale on your other devices and have the service running in order to connect to the Tailscale ip of your NAS

[vimanaboy]

Great video- subscribed! What I really need now is to figure out how to make a Tailscale certificate and make reverse proxies for my Docker services (Vaultwarden, Jellyfin, Audiobookshelf, etc)). Or whichever is the best way to access them via Tailscale if that isn't it.

[BUBearsFan]

Good video. How do you add Tailscale to your NAS certificate to secure the connection? : )

[rb]

Great video. I am trying to figure out how to use Tailscale to allow 2 Synology NASs on 2 different external networks to each other. My goal is to map remote drives between the two so that I can drop a file in a directory on one NAS into a folder on that device and have it copy to the other...but not "sync." In other words, I want that file to automatically copy to a folder on the other NAS and then be able to delete it from the origin NAS and have it remain on the destination.

[PaulMarriott-pv]

How does Tailscale compare with Cloudflare Zero Trust Tunnel and/or Twingate??

[pbrigham]

One of the best ways to connect remotely to a NAS.

[petermarin]

how can I map the NAS in the file explorer? I can't see it when the devices are discovered.

[drpepa]

Is there a use case for Tailscale if NAS is behind CGNAT? Just went fullfibre with Befibre and now Plex remote access port forwarding is screwed unless i pay for a static ip fix

[cesiumion]

how would synology photos, video or music etc services work if used with openvpn?

[cdelama]

I'm using TailScale for a while now, but what i have discovered is that especially on my Android device, many other apps (including the web browser) are not working when i'm connected to the Tailnet. Would be great to find an option to just enable it for certain use cases or apps.