Skip to content

Tailscale: Remote Access to Synology and Its Services Made Easy

Important or Recent Updates
Historic UpdatesDate
New guide Published18/03/2023
Swapped to using the version direct from Tailscale20/03/2023
Fixed the Routes and Subnets command as seems to run differently depending on some configs27/03/2023
Amended wording relating to exit nodes and DNS09/04/2023
Changed the Tailscale Up command to use the DNS servers specified in the admin console – amended the DNS section accordingly (thanks Roy)10/12/2023
Historic Updates

What is Tailscale?

Tailscale is very clever, it’s a VPN mesh network that allows you to use all your local network resources such as your NAS, all your Docker containers and even other devices on your network remotely.

This guide is based on the official documentation here which covers the basics however I received enough questions via Discord / Matrix and email that I felt it warranted a step-by-step walkthrough.

This will take you through the steps to get Tailscale running on your NAS and then accessing via an Android mobile.


Let’s Begin

The first step is to install the Tailscale Package (believe it or not we are not using Docker!!)

You have a couple of options here, either install the current version via the Package Centre or grab the latest version direct from Tailscale.

We are going to get the latest version in this guide, if you ever want to update either check back on newer versions via the link above or eventually the Package Centre version will catch up!

Open the link above and grab the version of the of package which works with your model of NAS. Most + models will use the version shown in the screenshot (you can find out of what type of CPU your NAS has here)

Once downloaded pen up the Package Centre and Click on ‘Manual Install’ on the top right. Then browse to your downloaded package and click Next.

You will be asked to accept all responsibility by installing this package, of course we will agree!

Once the package has finished either find it in the list or search for it in the top bar and click Open.

A new browser window will open, and it will ask you to Log In to your Tailscale account

Click log in, and you will be taken to the next screen with different options to log in – Tailscale uses sign ins via three providers Google, Microsoft, or GitHub select the one you prefer and login. You will use this to sign in on all devices going forward.

Once you have signed in you will see the screen below which is confirming the details of the device being added to your account. Click ‘Connect’.

You can now visit https://login.tailscale.com/admin/, and you will see your NAS in the list of your devices – I have blurred out my other devices in the screenshot, but you can add up to 25 for free.

You will see that you NAS has been assigned an IP address on the Tailscale network. We want to be able to access all our services via their original IP and ports rather than having to remember a new IP address. So lets carry on…


Enabling Outbound Connections on DSM7 and up

In order for our containers and apps running on DSM to have outbound access to the Tailscale network we need to enable this via a boot up command. This is nice and easy as we can use the Task Scheduler in the Control Panel.

So open up Control Panel > Task Scheduler > Create Task > Triggered Task > User-Defined script

In the Create Task window that appears enter the following information.

Task Name:tailscale-outbound
User:root
Event:Boot-up
Pre-task:Leave this blank

Now click the ‘Task Settings’ tab and enter the code below in the ‘User-defined Script’ section

Bash
/var/packages/Tailscale/target/bin/tailscale configure-host; synosystemctl restart pkgctl-Tailscale.service

Now click ‘OK’ you will be warned about running scripts as a root user, you can safely click the scary Red OK button.

The final step for this section is to run the script, it will then run on each reboot automatically, just select the task from the list and then click ‘Run’ and a then say ‘Yes’ to the pop-up.


Subnets, Routes, and Exit Nodes

So one more step to set up on the NAS side of things, we now need to enable the following items:

  • Subnets – (Advertise Routes) In order for us to access other devices on our network we will allow the Tailscale connection to look across the network
  • Exit Node – By default your internet traffic will go via the connection on the device you are using. For example if you are using your mobile on 4g when you go to Google.com this is going directly from your mobile connection. However, if you enable the Exit Node feature you can route your traffic via your NAS and out of your home internet connection. If you have Ad-Guard or PiHole in place this also means your ad blocking works as well!

You can do this next part in two ways either via SSH or for simplicity I am going to show how via Task Scheduler.

Go back to the Task Scheduler in Control Panel and Click Create > Scheduled Task > User-defined script.

Next we set the following options:

Task Name:tailscale-routes-exit
User:root
Enabled:Unticked

Nothing need to be amended on the Schedule tab, then in the Task Settings tab enter the code below into the User-defined script section.

Before you do this though you need to edit the –advertise-routes=192.168.0.0/24, this must correspond to your own local subnet! The easiest way to figure out this is by taking your NAS IP address for example 192.168.0.79 and changing the final digit after the . to 0 ( 192.168.0.0)

Also, the –accept-dns=true will tell Tailscale to use the DNS servers set in the Admin Console we will visit this a bit later.

Bash
tailscale up --accept-dns=true --advertise-exit-node --advertise-routes=192.168.0.0/24 --reset

Now press OK and again as per the last section accept the warning. You will then need to run the command by selecting it from the list and pressing ‘Run’. This is everything completed on the NAS side of things!


Tailscale Admin Amendments

We are now going to make a couple of changes in the Tailscale admin panel. Head back to https://login.tailscale.com/admin/ you will notice our NAS shows the extra enabled features of Subnets and Exit node.

Click on the three dots next to your NAS and click on ‘Disable Key Expiry’ this will mean you don’t need to manually renew encryption keys every few months.

Then click the three dots again and select ‘Edit route settings..’ and you will see the screen below. Turn on both the ‘Subnet routes’ and ‘Exit Node.’ These will allow you to access devices and applications on your local network and enable the ability to route your internet traffic through the NAS.


Network wide ad-blocking / DNS

Our final step in the Admin Panel is to make sure we have some DNS servers in place, otherwise you will not have internet access via Tailscale.

In the video below I add local IPs for AdGuard or Pi-hole if you are not using those either add your preferred DNS provider(s) or select from the built-in ones.

In your Tailscale admin panel click DNS from the top section

Next scroll down to the Nameservers section and as per the video below click ‘Add Nameserver’ then select either from the drop-down list or Custom if you want to add the IP address of your Adguard or Pi-hole instance.


Mobile Setup

We are into the final stretch! Now the NAS is set up and our network running we can start adding more devices, I am using an Android phone as an example in this guide. However, adding an iPhone or Laptop, or any other device such as a remote NAS is pretty much the same.

The first step is to download the Tailscale app from the Google Play Store or you can install directly from Tailscale. I am not showing these steps as they should be self-explanatory.

Once installed open up the app, and it will ask you to sign in, use the same account you used earlier and follow the steps (not showing these as it varies slightly per account type)

Next you will see a screen to add the device to your account just press Connect.

You will now see a list of your devices on the Tailscale network – You can now turn on Tailscale at the top left of the app – accept the permission to set up a VPN connection when it appears.

The final step!

We need to select our exit node and turn on subnet access. Just click the three dots and choose ‘Use exit node…’ In the screen that appears select your NAS and tick the Allow LAN access box. (The Allow LAN access does not appear on iPhone)

– Note some users have reported that using the Exit Node meant that Adblocking did not work for their setup, so you may need to leave this option off. This means that while your Internet traffic will continue via your local 4G/5G or WiFi Connection DNS will be handled by your PiHole or Adguard. –

That’s it! You can now access all your services via a mobile connection or Wi-Fi on someone else’s network – all end-to-end encrypted!


Looking for some help, join our Discord community

If you are struggling with any steps in the guides or looking to branch out into other containers join our Discord community!

Buy me a beverage!

If you have found my site useful please consider pinging me a tip as it helps cover the cost of running things or just lets me stay hydrated. Plus 10% goes to the devs of the apps I do guides for every year.

Published inOther Tools 7.1Other Tools 7.2Remote Access

52 Comments

  1. Dan Dan

    Awesome guide as ever! Precise and easy to follow!! Thank you for that!

    I have one question regarding the connection types maybe you can share some insights! Once everything is setup, when i connect externally, i always connect via a relayed connection – access to synology containers and apps works, but e.g. streaming videos does not (I tried Infuse, VLC, Plex, etc..)

    I have read online, that could be down to various things such as Ports, blocked UDP,etc… but I was wondering if you have it working and can share how you have done it or if you do it via a different method to stream video remotely!

    Thanks!

    • Dr_Frankenstein Dr_Frankenstein

      Hey, while Tailscale can usually navigate its way around blocked ports etc it must be having difficultly getting a direct connection set up. Apparently it uses port 41641 by default, try opening that up and see if then you avoid the relays.

  2. LaVike LaVike

    Thank you so much for your guides! I am a total noob on how all of this works and I can follow most of what you are saying. I’ve read just about all of your guides twice!

    I did have a question regarding this Tailscale guide and your guides on Qbit & Gluetun.

    How would I go about setting up my own Private Network via Tailscale AND have the capability to select my Location or Obfuscate any Public Internet traffic? Do I just combine those two guides or is something else required?

    I’ve been assuming that if I want to use multiple of your guides, I just keep adding the tasks together. Is that correct?

    Any suggestion on order of completing guides?

    Thanks again for all of your AMAZING work!

  3. Scott Scott

    Thank you. A guide that was actually easy to follow.
    Then only difference for me was my Tailscale online account doesn’t show my local IP 192.168.50.0 next to my NAS as yours does.
    I was able to log into my qBittorrent container, which Container Manager says is using Host. But I could not access my other containers which connect via Bridge ” 172.17.0.0/16″
    Should I do another task to add the bridge subnet as I did for my local subnet ?
    Thanks

    • Dr_Frankenstein Dr_Frankenstein

      Hey, is the admin panel showing subnet access as available as the containers should just be available like you would be at home.

      • Scott Scott

        It does say Subnets next to Expiry Disabled, and when I go into Edit Route Settings my local IP is listed and ticked, it’s just not listed under Addresses on the front page.
        When I go into the NAS machine entry it says the local IP subnet is Approved.

      • Scott Scott

        Ok, managed to get it working.
        I added Bridge IP, 172.17.0.0/16, to your the exit routes task above and reran the task. It appeared in the subnet routes on TS admin page and using bridgeIP/port I can now access the container UIs.

        May not be the proper way to do it but it’s working.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

drfrankenstein.co.uk – writing Synology Docker Guides since 2016 – Join My Discord!