Skip to content

Tailscale: Remote Access to Synology and Its Services Made Easy

Last updated on 16 January 2024

Important or Recent Updates
Historic UpdatesDate
New guide Published18/03/2023
Swapped to using the version direct from Tailscale20/03/2023
Fixed the Routes and Subnets command as seems to run differently depending on some configs27/03/2023
Amended wording relating to exit nodes and DNS09/04/2023
Changed the Tailscale Up command to use the DNS servers specified in the admin console – amended the DNS section accordingly (thanks Roy)10/12/2023
Historic Updates

What is Tailscale?

Tailscale is very clever, it’s a VPN mesh network that allows you to use all your local network resources such as your NAS, all your Docker containers and even other devices on your network remotely.

This guide is based on the official documentation here which covers the basics however I received enough questions via Discord / Matrix and email that I felt it warranted a step-by-step walkthrough.

This will take you through the steps to get Tailscale running on your NAS and then accessing via an Android mobile.

Let’s Begin

The first step is to install the Tailscale Package (believe it or not we are not using Docker!!)

You have a couple of options here, either install the current version via the Package Centre or grab the latest version direct from Tailscale.

We are going to get the latest version in this guide, if you ever want to update either check back on newer versions via the link above or eventually the Package Centre version will catch up!

Open the link above and grab the version of the of package which works with your model of NAS. Most + models will use the version shown in the screenshot (you can find out of what type of CPU your NAS has here)

Once downloaded pen up the Package Centre and Click on ‘Manual Install’ on the top right. Then browse to your downloaded package and click Next.

You will be asked to accept all responsibility by installing this package, of course we will agree!

Once the package has finished either find it in the list or search for it in the top bar and click Open.

A new browser window will open, and it will ask you to Log In to your Tailscale account

Click log in, and you will be taken to the next screen with different options to log in – Tailscale uses sign ins via three providers Google, Microsoft, or GitHub select the one you prefer and login. You will use this to sign in on all devices going forward.

Once you have signed in you will see the screen below which is confirming the details of the device being added to your account. Click ‘Connect’.

You can now visit, and you will see your NAS in the list of your devices – I have blurred out my other devices in the screenshot, but you can add up to 25 for free.

You will see that you NAS has been assigned an IP address on the Tailscale network. We want to be able to access all our services via their original IP and ports rather than having to remember a new IP address. So lets carry on…

Enabling Outbound Connections on DSM7 and up

In order for our containers and apps running on DSM to have outbound access to the Tailscale network we need to enable this via a boot up command. This is nice and easy as we can use the Task Scheduler in the Control Panel.

So open up Control Panel > Task Scheduler > Create Task > Triggered Task > User-Defined script

In the Create Task window that appears enter the following information.

Task Name:tailscale-outbound
Pre-task:Leave this blank

Now click the ‘Task Settings’ tab and enter the code below in the ‘User-defined Script’ section

/var/packages/Tailscale/target/bin/tailscale configure-host; synosystemctl restart pkgctl-Tailscale.service

Now click ‘OK’ you will be warned about running scripts as a root user, you can safely click the scary Red OK button.

The final step for this section is to run the script, it will then run on each reboot automatically, just select the task from the list and then click ‘Run’ and a then say ‘Yes’ to the pop-up.

Subnets, Routes, and Exit Nodes

So one more step to set up on the NAS side of things, we now need to enable the following items:

  • Subnets – (Advertise Routes) In order for us to access other devices on our network we will allow the Tailscale connection to look across the network
  • Exit Node – By default your internet traffic will go via the connection on the device you are using. For example if you are using your mobile on 4g when you go to this is going directly from your mobile connection. However, if you enable the Exit Node feature you can route your traffic via your NAS and out of your home internet connection. If you have Ad-Guard or PiHole in place this also means your ad blocking works as well!

You can do this next part in two ways either via SSH or for simplicity I am going to show how via Task Scheduler.

Go back to the Task Scheduler in Control Panel and Click Create > Scheduled Task > User-defined script.

Next we set the following options:

Task Name:tailscale-routes-exit

Nothing need to be amended on the Schedule tab, then in the Task Settings tab enter the code below into the User-defined script section.

Before you do this though you need to edit the –advertise-routes=, this must correspond to your own local subnet! The easiest way to figure out this is by taking your NAS IP address for example and changing the final digit after the . to 0 (

Also, the –accept-dns=true will tell Tailscale to use the DNS servers set in the Admin Console we will visit this a bit later.

tailscale up --accept-dns=true --advertise-exit-node --advertise-routes= --reset

Now press OK and again as per the last section accept the warning. You will then need to run the command by selecting it from the list and pressing ‘Run’. This is everything completed on the NAS side of things!

Tailscale Admin Amendments

We are now going to make a couple of changes in the Tailscale admin panel. Head back to you will notice our NAS shows the extra enabled features of Subnets and Exit node.

Click on the three dots next to your NAS and click on ‘Disable Key Expiry’ this will mean you don’t need to manually renew encryption keys every few months.

Then click the three dots again and select ‘Edit route settings..’ and you will see the screen below. Turn on both the ‘Subnet routes’ and ‘Exit Node.’ These will allow you to access devices and applications on your local network and enable the ability to route your internet traffic through the NAS.

Network wide ad-blocking / DNS

Our final step in the Admin Panel is to make sure we have some DNS servers in place, otherwise you will not have internet access via Tailscale.

In the video below I add local IPs for AdGuard or Pi-hole if you are not using those either add your preferred DNS provider(s) or select from the built-in ones.

In your Tailscale admin panel click DNS from the top section

Next scroll down to the Nameservers section and as per the video below click ‘Add Nameserver’ then select either from the drop-down list or Custom if you want to add the IP address of your Adguard or Pi-hole instance.

Mobile Setup

We are into the final stretch! Now the NAS is set up and our network running we can start adding more devices, I am using an Android phone as an example in this guide. However, adding an iPhone or Laptop, or any other device such as a remote NAS is pretty much the same.

The first step is to download the Tailscale app from the Google Play Store or you can install directly from Tailscale. I am not showing these steps as they should be self-explanatory.

Once installed open up the app, and it will ask you to sign in, use the same account you used earlier and follow the steps (not showing these as it varies slightly per account type)

Next you will see a screen to add the device to your account just press Connect.

You will now see a list of your devices on the Tailscale network – You can now turn on Tailscale at the top left of the app – accept the permission to set up a VPN connection when it appears.

The final step!

We need to select our exit node and turn on subnet access. Just click the three dots and choose ‘Use exit node…’ In the screen that appears select your NAS and tick the Allow LAN access box. (The Allow LAN access does not appear on iPhone)

– Note some users have reported that using the Exit Node meant that Adblocking did not work for their setup, so you may need to leave this option off. This means that while your Internet traffic will continue via your local 4G/5G or WiFi Connection DNS will be handled by your PiHole or Adguard. –

That’s it! You can now access all your services via a mobile connection or Wi-Fi on someone else’s network – all end-to-end encrypted!

Buy Me a Coffee or a Beer

If you have found my site useful please consider pinging me a tip as it helps cover the cost of running things or just lets me get the odd beverage. Plus 10% goes to the devs of the apps I do guides for every year.

Published inOther Tools 7.1Other Tools 7.2


  1. Drew Drew

    It’s strange, I’ve setup the exit node and I had previously done your guide on AdGuard. When I enable my Synology as an exit node on my iPhone, I get NO blocking. When I turn off as an exit node I GET blocking.. a little confused what’s happening ..

    • Dr_Frankenstein Dr_Frankenstein

      OK well that is odd – I seem to get blocking with both the Exit Node and Without – The exit node routes your traffic however the DNS will still be done by adguard so I will tweak the wording of that section.

      • Drew Drew

        I’m a dumb dumb… at some point a while back prior to really building out my network I had manually set the DNS on my Synology to I’ve changed to my Synology’s IP and now it works o_O

      • L L

        The same thing happens for me on iOS — blocking only when I turn off my NAS as an exit node. I guess that’s fine, but is that bad? If I keep it off and use Tailscale on public wifi, am I exposing my connection or something? I’d prefer to fix it just so I know I’m not doing something weird.

        • Dr_Frankenstein Dr_Frankenstein

          Your connection will be perfectly fine your general Internet traffic will be exiting via your 4g connection but your other lan traffic is direct to the server and dns will be done by the pi hole

          When I get back online I will amend the wording as it is a little misleading/unclear on what it is doing when no exit node is selected.

  2. Drew Drew

    Great guide! I’m trying to wrap my head around how to access all my hosted Docker containers more easily. Prior I had exposed some services via a reverse proxy / cloudflare and could then go to, but now I have to note all the port bindings… is there a better way?

    • Dr_Frankenstein Dr_Frankenstein

      I am yet to do a guide, but I use Flame
      It’s pretty easy to set up and is essentially a nice way of having all the links to your apps in one place. So I just have this setup on my phone as a shortcut and on my Desktop its set to open on a new tab.

  3. thegreatnorth thegreatnorth

    I had to ssh into my synology to run the command for “Subnets, Routes, and Exit Nodes” because the Task Scheduler method just wouldn’t work for me.
    Everything is working great though

    Another great guide!

    • Dr_Frankenstein Dr_Frankenstein

      Could you do me a favour and on that task can you enable logging so it outputs a file with what it does and run it again. Could help me troubleshoot for others.

      Just edit it and specify a place for it to put the log.

    • Dr_Frankenstein Dr_Frankenstein

      Looks like when submitting via the Task Scheduler it asks for –reset to be added however it does not ask for this via SSH which is weird. Updated the guide..

  4. Roy Roy

    Thanks for putting up this guide! One thing I wondered about Tailscale is the free user limitation.
    Say I have one Synology NASes at each of two homes. I install Tailscale on my computers, phone, and both NASes. I want a family member to have VPN access to only one of the NASes. That would mean he should have his own user account, right? But then Tailscale doesn’t support more than 1 user for free, is that correct?

    • Dr_Frankenstein Dr_Frankenstein

      I have not done this ‘yet’ however you are able to send other user invites to a specific machine on your network via your Admin panel and clicking Share.. The free account only allows a single user.

  5. Mark Mark

    Thank you so much for this guide! After setting this up I manage to connect to local services such as (DSM) or watch a surveillance camera on and some more.

    But once I try to connect to the services I set up using your guides (Prowlarr, sabnzbd etc.) I can’t somehow. They give no connection.

    Can you give a hint on what I’m doing wrong here? Thanks, Mark

    • Dr_Frankenstein Dr_Frankenstein

      Hey Mark – Are the Subnet and Exit Node options showing in your Tailscale Admin page?


        Thanks for the guide mate !
        I follow the guide and run the exit nodes and subnet scripts but they doesn’t appear on tailscale Admin
        Do u got any ideas ?

        • Dr_Frankenstein Dr_Frankenstein

          It’s going to be hard to tell, It may be worth doing a reboot of your NAS, so the script has run at start up.

          • avuman avuman

            Having a similar issue as PENALVA. The extra features for subnet and exit node don’t show up in TailScale. I’ve tried restarting the NAS.

        • Dr_Frankenstein Dr_Frankenstein

          Hey I have updated the command to add to the Task Scheduler for some reason it’s different via that route vs SSH.

    • Dr_Frankenstein Dr_Frankenstein

      Hey – I have updated the command to run via the Task Scheduler as it didn’t seem to be functioning correctly for some people.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed. – writing Synology Docker Guides since 2016 – Join My Discord!