{"slug":"access-synology-nas-from-anywhere","title":"Access Synology NAS from anywhere","tags":["tailscale","access-control","logging"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Access Synology NAS from anywhere\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nTailscale lets you remotely access your Synology NAS. In the video below, Alex covers the basics you need know to get up and running.\r\n\r\nRemotely access your Synology from anywhere with Tailscale - YouTube\r\n\r\nTap to unmute\r\n\r\n[Remotely access your Synology from anywhere with Tailscale](https://www.youtube.com/watch?v=0o2EhK-QvmY) [Tailscale](https://www.youtube.com/channel/UCcdv38QxPjSMqbt5ffLhJLA)\r\n\r\n![thumbnail-image](https://yt3.ggpht.com/K3B5Hdi7j4zy2y53nlQCQb9J0qHNuSXhD2hWysrwaiDvv19tPr5RY04QuQfFOvb9rDq9cugGjZU=s68-c-k-c0x00ffffff-no-rj)\r\n\r\nTailscale68.5K subscribers\r\n\r\n## [Features and benefits](https://tailscale.com/docs/integrations/synology\\#features-and-benefits)\r\n\r\nWhen a Synology NAS device is connected, Tailscale supports the following:\r\n\r\n- Log in using a [supported identity provider](https://tailscale.com/docs/integrations/identity).\r\n- Access your Synology device from anywhere, [without opening firewall ports](https://tailscale.com/blog/how-nat-traversal-works).\r\n- Share your Synology device with designated Tailscale users, using [node sharing](https://tailscale.com/docs/features/sharing).\r\n- Restrict and control access to your Synology device using [access control policies](https://tailscale.com/docs/features/access-control).\r\n- Use your Synology device as a [subnet router](https://tailscale.com/docs/features/subnet-routers) to provide external access to your LAN.\r\n- Designate your Synology device as an [exit node](https://tailscale.com/docs/features/exit-nodes) for secure internet access for your other tailnet devices from anywhere.\r\n\r\n## [Install using Synology Package Center](https://tailscale.com/docs/integrations/synology\\#install-using-synology-package-center)\r\n\r\nInstallation from the Synology Package Center is the easiest way to get started.\r\n\r\nWe recommend that you [schedule automatic updates](https://tailscale.com/docs/integrations/synology#schedule-automatic-updates) as the version published in the Synology app store may not always reflect the most recently released Tailscale version.\r\n\r\n1. Go to the Synology Package Center ( [tutorial](https://kb.synology.com/en-sg/DSM/tutorial/How_to_install_applications_with_Package_Center)).\r\n\r\n2. Search for and install the **Tailscale** app.\r\n![The Synology Package Center user interface.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsynology-packagecenter.29693bdd.png&w=1080&q=75)\r\n3. After the Tailscale app is installed, follow the instructions to log in to your Tailscale network (known as a tailnet) using your preferred identity provider. If you don't already have a Tailscale account, a free account will be created automatically.\r\n![The Synology login prompt.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsynology-login.1e757b4f.png&w=828&q=75)\r\n4. After you authenticate to the tailnet, you can connect to your Synology device from your PC, laptop, phone, or tablet by [installing Tailscale on another device](https://tailscale.com/download).\r\n\r\n\r\n## [Schedule automatic updates](https://tailscale.com/docs/integrations/synology\\#schedule-automatic-updates)\r\n\r\nYou can create a scheduled task to check for Tailscale client updates and install them automatically.\r\n\r\n1. In Synology, go to **Control Panel** \\> **Task Scheduler**, select **Create**, and select **Scheduled Task**.\r\n\r\n2. Select **User-defined script**.\r\n\r\n3. In the **General Settings** tab, enter a task name and select the **User:** as `root`.\r\n\r\n4. Go to the **Schedule** tab, select **Run on the following days**, then **Run on the follow days**, and choose an increment such as **Daily**.\r\n\r\n5. Go to the **Task Settings** tab and enter the following for **User-defined script**:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\ntailscale update --yes\r\n```\r\n\r\n6. Select **OK** to save the settings.\r\n\r\n\r\n## [Enable outbound connections](https://tailscale.com/docs/integrations/synology\\#enable-outbound-connections)\r\n\r\nSynology DSM7 introduced tighter restrictions on what packages are allowed to do. If you're running DSM6, Tailscale runs as root with full permissions and these steps are not required.\r\n\r\nBy default, Tailscale on Synology with DSM7 only lets you make inbound connections to your Synology device but outbound Tailscale access from other apps running on your Synology is not enabled.\r\n\r\nThe reason for this is that the Tailscale package does not have permission to create a [TUN device](https://en.wikipedia.org/wiki/TUN/TAP).\r\n\r\nTo enable TUN, to permit outbound connections from other things running on your Synology device:\r\n\r\n1. Make sure you're running Tailscale v1.22.2 or later\r\n\r\n2. In Synology, go to **Control Panel** \\> **Task Scheduler**, select **Create**, and select **Triggered Task**.\r\n\r\n3. Select **User-defined script**.\r\n\r\n4. When the **Create task** window appears, select **General**.\r\n\r\n5. In **General Settings**, enter a task name, select **root** as the user that the task will run for, and select **Boot-up** as the event that triggers the task. Ensure the task is enabled.\r\n\r\n6. Select **Task Settings** and enter the following for **User-defined script**.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\n/var/packages/Tailscale/target/bin/tailscale configure-host; synosystemctl restart pkgctl-Tailscale.service\r\n```\r\n\r\n\r\n\r\nIf you're curious what it does, you can read the [`configure-host` code](https://github.com/tailscale/tailscale/blob/main/cmd/tailscale/cli/configure-synology.go).\r\n\r\n7. Select **OK** to save the settings.\r\n\r\n8. Reboot your Synology device. Alternatively, to avoid a reboot, run the above user-defined script as root on the device to restart the Tailscale package.\r\n\r\n\r\nYour TUN settings should now be persisted across reboots of your device.\r\n\r\nUpgrading the Tailscale package will require the above script to run again. When you upgrade Tailscale, run the above script as root, or reboot your Synology device.\r\n\r\n## [Adjust Synology firewall settings](https://tailscale.com/docs/integrations/synology\\#adjust-synology-firewall-settings)\r\n\r\nBy enabling TUN, Tailscale traffic will be subject to Synology's built-in firewall.\r\n\r\nThe firewall is disabled by default. However, if you have it enabled, add an exception for the Tailscale subnet, 100.64.0.0/10. In **Main menu** \\> **Control Panel** \\> **Security** \\> **Firewall**, add a firewall rule in the default profile that lets traffic through from the source IP subnet 100.64.0.0 with subnet mask 255.192.0.0.\r\n\r\n## [Troubleshooting](https://tailscale.com/docs/integrations/synology\\#troubleshooting)\r\n\r\nIf your Synology NAS cannot connect to your tailnet after uninstalling and re-installing the Tailscale app, we recommend the following steps:\r\n\r\n1. SSH into your NAS and run the command:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\nsudo tailscale up\r\n```\r\n\r\n2. Enter the password for your NAS (if prompted), then copy the provided URL.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\nTo authenticate, visit:\r\nhttps://login.tailscale.com/a/xxxxxxxxxx\r\nSuccess.\r\n```\r\n\r\n3. Paste the URL into your web browser, authenticate to your tailnet, then open the [Machines](https://login.tailscale.com/admin/machines) page of the admin console to verify that your NAS is connected to the tailnet.\r\n\r\n\r\n## [Install Tailscale on DSM manually](https://tailscale.com/docs/integrations/synology\\#install-tailscale-on-dsm-manually)\r\n\r\nSynology Package Center updates Tailscale approximately once per quarter. To use the latest version of Tailscale, you may either [configure automatic scheduled updates](https://tailscale.com/docs/integrations/synology#schedule-automatic-updates) or manually install the package.\r\n\r\n1. [Download](https://pkgs.tailscale.com/stable/#spks) the DSM package from the Tailscale package server site.\r\n\r\n\r\n\r\nTo determine which download is appropriate for your Synology device, visit the [Synology and SynoCommunity Package Architectures](https://github.com/SynoCommunity/spksrc/wiki/Synology-and-SynoCommunity-Package-Architectures) page and look up your architecture by Synology model. Then, find the SPK download at [Tailscale Packages](https://pkgs.tailscale.com/) that corresponds to your model. Synology packages (SPKs) are available from both [stable](https://pkgs.tailscale.com/stable/#spks) and [unstable](https://pkgs.tailscale.com/unstable/#spks) release tracks.\r\n\r\n2. [Manually install](https://kb.synology.com/en-sg/DSM/tutorial/How_to_install_applications_with_Package_Center) the DSM package onto your Synology device\r\n\r\n3. After the Tailscale app is installed, follow the instructions to log in to your Tailscale network (known as a tailnet) using your preferred identity provider. If you don't already have a Tailscale account, a free account will be created automatically.\r\n\r\n4. After you authenticate to the tailnet, you can connect to your Synology device from your PC, laptop, phone, or tablet by [installing Tailscale on another device](https://tailscale.com/download).\r\n\r\n5. The Tailscale daemon [`tailscaled`](https://tailscale.com/docs/reference/tailscaled) should now be running on your Synology device. You can configure it either by using the Tailscale package's Synology web UI or by using the [Tailscale CLI](https://tailscale.com/docs/reference/tailscale-cli) over SSH.\r\n\r\n\r\nFor instructions on using SSH to access Synology, refer to [How can I sign in to DSM/SRM with root privilege via SSH?](https://kb.synology.com/en-id/DSM/tutorial/How_to_login_to_DSM_with_root_permission_via_SSH_Telnet).\r\n\r\n## [Limitations and known issues](https://tailscale.com/docs/integrations/synology\\#limitations-and-known-issues)\r\n\r\n- If you upgrade Synology from DSM6 to DSM7, you will need to uninstall and then reinstall the Tailscale app. Do not perform the Synology DSM7 upgrade over Tailscale or you may lose your connection during the upgrade.\r\n\r\n- If you uninstall then re-install the Tailscale app and the NAS can no longer connect to your tailnet, refer to the [Troubleshooting](https://tailscale.com/docs/integrations/synology#troubleshooting) section for instructions.\r\n\r\n- Tailscale uses [hybrid networking mode](https://tailscale.com/docs/concepts/userspace-networking) on Synology, which means that if you share subnets, they will be reachable over UDP and TCP, but not necessarily pingable.\r\n\r\n- Other Synology packages cannot make outgoing connections to your other Tailscale nodes by default on DSM7. Refer to the following instructions to enable.\r\n\r\n- Tailscale on Synology currently can do `--advertise-routes` but not `--accept-routes`. This means that if you have other [subnet routers](https://tailscale.com/docs/features/subnet-routers), devices on those other subnets will not yet be able to reach your NAS or devices on its local subnet.\r\n\r\n- [Tailscale SSH](https://tailscale.com/docs/features/tailscale-ssh) does not run on Synology. You can use the provided SSH server in DSM instead.\r\n\r\n\r\nSome of these limitations are imposed on Tailscale by the DSM7 sandbox. Refer to our [Synology tracking issue on GitHub](https://github.com/tailscale/tailscale/issues/1995) for the latest status on the above issues.\r\n\r\n## [Special thanks](https://tailscale.com/docs/integrations/synology\\#special-thanks)\r\n\r\nSpecial thanks to [Guilherme de Maio (nirev)](https://github.com/nirev), who contributed the original [Synology-Tailscale package builder](https://github.com/tailscale/tailscale-synology). Tailscale now maintains this package builder and produces our official Synology packages.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Access Synology NAS from anywhere

\n

Last validated: Jan 5, 2026

\n

Tailscale lets you remotely access your Synology NAS. In the video below, Alex covers the basics you need know to get up and running.

\n

Remotely access your Synology from anywhere with Tailscale - YouTube

\n

Tap to unmute

\n

Remotely access your Synology from anywhere with Tailscale Tailscale

\n

\"thumbnail-image\"

\n

Tailscale68.5K subscribers

\n

Features and benefits

\n

When a Synology NAS device is connected, Tailscale supports the following:

\n\n

Install using Synology Package Center

\n

Installation from the Synology Package Center is the easiest way to get started.

\n

We recommend that you schedule automatic updates as the version published in the Synology app store may not always reflect the most recently released Tailscale version.

\n
    \n
  1. \n

    Go to the Synology Package Center ( tutorial).

    \n
    2. \n
  2. \n

    Search for and install the Tailscale app.\r\n\"The

    \n
    3. \n
  3. \n

    After the Tailscale app is installed, follow the instructions to log in to your Tailscale network (known as a tailnet) using your preferred identity provider. If you don't already have a Tailscale account, a free account will be created automatically.\r\n\"The

    \n
    4. \n
  4. \n

    After you authenticate to the tailnet, you can connect to your Synology device from your PC, laptop, phone, or tablet by installing Tailscale on another device.

    \n
    5. \n
\n

Schedule automatic updates

\n

You can create a scheduled task to check for Tailscale client updates and install them automatically.

\n
    \n
  1. \n

    In Synology, go to Control Panel > Task Scheduler, select Create, and select Scheduled Task.

    \n
    2. \n
  2. \n

    Select User-defined script.

    \n
    3. \n
  3. \n

    In the General Settings tab, enter a task name and select the User: as root.

    \n
    4. \n
  4. \n

    Go to the Schedule tab, select Run on the following days, then Run on the follow days, and choose an increment such as Daily.

    \n
    5. \n
  5. \n

    Go to the Task Settings tab and enter the following for User-defined script:

    \n
    6. \n
\n
tailscale update --yes\n
\n
    \n
  1. Select OK to save the settings.
    2. \n
\n

Enable outbound connections

\n

Synology DSM7 introduced tighter restrictions on what packages are allowed to do. If you're running DSM6, Tailscale runs as root with full permissions and these steps are not required.

\n

By default, Tailscale on Synology with DSM7 only lets you make inbound connections to your Synology device but outbound Tailscale access from other apps running on your Synology is not enabled.

\n

The reason for this is that the Tailscale package does not have permission to create a TUN device.

\n

To enable TUN, to permit outbound connections from other things running on your Synology device:

\n
    \n
  1. \n

    Make sure you're running Tailscale v1.22.2 or later

    \n
    2. \n
  2. \n

    In Synology, go to Control Panel > Task Scheduler, select Create, and select Triggered Task.

    \n
    3. \n
  3. \n

    Select User-defined script.

    \n
    4. \n
  4. \n

    When the Create task window appears, select General.

    \n
    5. \n
  5. \n

    In General Settings, enter a task name, select root as the user that the task will run for, and select Boot-up as the event that triggers the task. Ensure the task is enabled.

    \n
    6. \n
  6. \n

    Select Task Settings and enter the following for User-defined script.

    \n
    7. \n
\n
/var/packages/Tailscale/target/bin/tailscale configure-host; synosystemctl restart pkgctl-Tailscale.service\n
\n

If you're curious what it does, you can read the configure-host code.

\n
    \n
  1. \n

    Select OK to save the settings.

    \n
    2. \n
  2. \n

    Reboot your Synology device. Alternatively, to avoid a reboot, run the above user-defined script as root on the device to restart the Tailscale package.

    \n
    3. \n
\n

Your TUN settings should now be persisted across reboots of your device.

\n

Upgrading the Tailscale package will require the above script to run again. When you upgrade Tailscale, run the above script as root, or reboot your Synology device.

\n

Adjust Synology firewall settings

\n

By enabling TUN, Tailscale traffic will be subject to Synology's built-in firewall.

\n

The firewall is disabled by default. However, if you have it enabled, add an exception for the Tailscale subnet, 100.64.0.0/10. In Main menu > Control Panel > Security > Firewall, add a firewall rule in the default profile that lets traffic through from the source IP subnet 100.64.0.0 with subnet mask 255.192.0.0.

\n

Troubleshooting

\n

If your Synology NAS cannot connect to your tailnet after uninstalling and re-installing the Tailscale app, we recommend the following steps:

\n
    \n
  1. SSH into your NAS and run the command:
    2. \n
\n
sudo tailscale up\n
\n
    \n
  1. Enter the password for your NAS (if prompted), then copy the provided URL.
    2. \n
\n
To authenticate, visit:\r\nhttps://login.tailscale.com/a/xxxxxxxxxx\r\nSuccess.\n
\n
    \n
  1. Paste the URL into your web browser, authenticate to your tailnet, then open the Machines page of the admin console to verify that your NAS is connected to the tailnet.
    2. \n
\n

Install Tailscale on DSM manually

\n

Synology Package Center updates Tailscale approximately once per quarter. To use the latest version of Tailscale, you may either configure automatic scheduled updates or manually install the package.

\n
    \n
  1. Download the DSM package from the Tailscale package server site.
    2. \n
\n

To determine which download is appropriate for your Synology device, visit the Synology and SynoCommunity Package Architectures page and look up your architecture by Synology model. Then, find the SPK download at Tailscale Packages that corresponds to your model. Synology packages (SPKs) are available from both stable and unstable release tracks.

\n
    \n
  1. \n

    Manually install the DSM package onto your Synology device

    \n
    2. \n
  2. \n

    After the Tailscale app is installed, follow the instructions to log in to your Tailscale network (known as a tailnet) using your preferred identity provider. If you don't already have a Tailscale account, a free account will be created automatically.

    \n
    3. \n
  3. \n

    After you authenticate to the tailnet, you can connect to your Synology device from your PC, laptop, phone, or tablet by installing Tailscale on another device.

    \n
    4. \n
  4. \n

    The Tailscale daemon tailscaled should now be running on your Synology device. You can configure it either by using the Tailscale package's Synology web UI or by using the Tailscale CLI over SSH.

    \n
    5. \n
\n

For instructions on using SSH to access Synology, refer to How can I sign in to DSM/SRM with root privilege via SSH?.

\n

Limitations and known issues

\n\n

Some of these limitations are imposed on Tailscale by the DSM7 sandbox. Refer to our Synology tracking issue on GitHub for the latest status on the above issues.

\n

Special thanks

\n

Special thanks to Guilherme de Maio (nirev), who contributed the original Synology-Tailscale package builder. Tailscale now maintains this package builder and produces our official Synology packages.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}