Skip to content

Tailscale: Remote Access to Synology and Its Services Made Easy

Important or Recent Updates
Historic UpdatesDate
New guide Published18/03/2023
Swapped to using the version direct from Tailscale20/03/2023
Fixed the Routes and Subnets command as seems to run differently depending on some configs27/03/2023
Amended wording relating to exit nodes and DNS09/04/2023
Changed the Tailscale Up command to use the DNS servers specified in the admin console – amended the DNS section accordingly (thanks Roy)10/12/2023
Historic Updates

What is Tailscale?

Tailscale is very clever, it’s a VPN mesh network that allows you to use all your local network resources such as your NAS, all your Docker containers and even other devices on your network remotely.

This guide is based on the official documentation here which covers the basics however I received enough questions via Discord / Matrix and email that I felt it warranted a step-by-step walkthrough.

This will take you through the steps to get Tailscale running on your NAS and then accessing via an Android mobile.


Let’s Begin

The first step is to install the Tailscale Package (believe it or not we are not using Docker!!)

You have a couple of options here, either install the current version via the Package Centre or grab the latest version direct from Tailscale.

We are going to get the latest version in this guide, if you ever want to update either check back on newer versions via the link above or eventually the Package Centre version will catch up!

Open the link above and grab the version of the of package which works with your model of NAS. Most + models will use the version shown in the screenshot (you can find out of what type of CPU your NAS has here)

Once downloaded pen up the Package Centre and Click on ‘Manual Install’ on the top right. Then browse to your downloaded package and click Next.

You will be asked to accept all responsibility by installing this package, of course we will agree!

Once the package has finished either find it in the list or search for it in the top bar and click Open.

A new browser window will open, and it will ask you to Log In to your Tailscale account

Click log in, and you will be taken to the next screen with different options to log in – Tailscale uses sign ins via three providers Google, Microsoft, or GitHub select the one you prefer and login. You will use this to sign in on all devices going forward.

Once you have signed in you will see the screen below which is confirming the details of the device being added to your account. Click ‘Connect’.

You can now visit https://login.tailscale.com/admin/, and you will see your NAS in the list of your devices – I have blurred out my other devices in the screenshot, but you can add up to 25 for free.

You will see that you NAS has been assigned an IP address on the Tailscale network. We want to be able to access all our services via their original IP and ports rather than having to remember a new IP address. So lets carry on…


Enabling Outbound Connections on DSM7 and up

In order for our containers and apps running on DSM to have outbound access to the Tailscale network we need to enable this via a boot up command. This is nice and easy as we can use the Task Scheduler in the Control Panel.

So open up Control Panel > Task Scheduler > Create Task > Triggered Task > User-Defined script

In the Create Task window that appears enter the following information.

Task Name:tailscale-outbound
User:root
Event:Boot-up
Pre-task:Leave this blank

Now click the ‘Task Settings’ tab and enter the code below in the ‘User-defined Script’ section

Bash
/var/packages/Tailscale/target/bin/tailscale configure-host; synosystemctl restart pkgctl-Tailscale.service

Now click ‘OK’ you will be warned about running scripts as a root user, you can safely click the scary Red OK button.

The final step for this section is to run the script, it will then run on each reboot automatically, just select the task from the list and then click ‘Run’ and a then say ‘Yes’ to the pop-up.


Subnets, Routes, and Exit Nodes

So one more step to set up on the NAS side of things, we now need to enable the following items:

  • Subnets – (Advertise Routes) In order for us to access other devices on our network we will allow the Tailscale connection to look across the network
  • Exit Node – By default your internet traffic will go via the connection on the device you are using. For example if you are using your mobile on 4g when you go to Google.com this is going directly from your mobile connection. However, if you enable the Exit Node feature you can route your traffic via your NAS and out of your home internet connection. If you have Ad-Guard or PiHole in place this also means your ad blocking works as well!

You can do this next part in two ways either via SSH or for simplicity I am going to show how via Task Scheduler.

Go back to the Task Scheduler in Control Panel and Click Create > Scheduled Task > User-defined script.

Next we set the following options:

Task Name:tailscale-routes-exit
User:root
Enabled:Unticked

Nothing need to be amended on the Schedule tab, then in the Task Settings tab enter the code below into the User-defined script section.

Before you do this though you need to edit the –advertise-routes=192.168.0.0/24, this must correspond to your own local subnet! The easiest way to figure out this is by taking your NAS IP address for example 192.168.0.79 and changing the final digit after the . to 0 ( 192.168.0.0)

Also, the –accept-dns=true will tell Tailscale to use the DNS servers set in the Admin Console we will visit this a bit later.

Bash
tailscale up --accept-dns=true --advertise-exit-node --advertise-routes=192.168.0.0/24 --reset

Now press OK and again as per the last section accept the warning. You will then need to run the command by selecting it from the list and pressing ‘Run’. This is everything completed on the NAS side of things!


Tailscale Admin Amendments

We are now going to make a couple of changes in the Tailscale admin panel. Head back to https://login.tailscale.com/admin/ you will notice our NAS shows the extra enabled features of Subnets and Exit node.

Click on the three dots next to your NAS and click on ‘Disable Key Expiry’ this will mean you don’t need to manually renew encryption keys every few months.

Then click the three dots again and select ‘Edit route settings..’ and you will see the screen below. Turn on both the ‘Subnet routes’ and ‘Exit Node.’ These will allow you to access devices and applications on your local network and enable the ability to route your internet traffic through the NAS.


Network wide ad-blocking / DNS

Our final step in the Admin Panel is to make sure we have some DNS servers in place, otherwise you will not have internet access via Tailscale.

In the video below I add local IPs for AdGuard or Pi-hole if you are not using those either add your preferred DNS provider(s) or select from the built-in ones.

In your Tailscale admin panel click DNS from the top section

Next scroll down to the Nameservers section and as per the video below click ‘Add Nameserver’ then select either from the drop-down list or Custom if you want to add the IP address of your Adguard or Pi-hole instance.


Mobile Setup

We are into the final stretch! Now the NAS is set up and our network running we can start adding more devices, I am using an Android phone as an example in this guide. However, adding an iPhone or Laptop, or any other device such as a remote NAS is pretty much the same.

The first step is to download the Tailscale app from the Google Play Store or you can install directly from Tailscale. I am not showing these steps as they should be self-explanatory.

Once installed open up the app, and it will ask you to sign in, use the same account you used earlier and follow the steps (not showing these as it varies slightly per account type)

Next you will see a screen to add the device to your account just press Connect.

You will now see a list of your devices on the Tailscale network – You can now turn on Tailscale at the top left of the app – accept the permission to set up a VPN connection when it appears.

The final step!

We need to select our exit node and turn on subnet access. Just click the three dots and choose ‘Use exit node…’ In the screen that appears select your NAS and tick the Allow LAN access box. (The Allow LAN access does not appear on iPhone)

– Note some users have reported that using the Exit Node meant that Adblocking did not work for their setup, so you may need to leave this option off. This means that while your Internet traffic will continue via your local 4G/5G or WiFi Connection DNS will be handled by your PiHole or Adguard. –

That’s it! You can now access all your services via a mobile connection or Wi-Fi on someone else’s network – all end-to-end encrypted!


Buy Me a Coffee or a Beer

If you have found my site useful please consider pinging me a tip as it helps cover the cost of running things or just lets me get the odd beverage. Plus 10% goes to the devs of the apps I do guides for every year.

Published inOther Tools 7.1Other Tools 7.2

52 Comments

  1. Sherri Sherri

    Sorry for some newbie questions. First of all your instructions were great. 1) If I am home and just running in my. local network and don’t want to go through the VPN what do I need to do? 2) I also have NordVPN which I sometimes use to watch things from another country etc. as well as to be safe on networks outside of my house. Should I just use the NordVPN configuration except when I am connecting to my NAS?

    • Dr_Frankenstein Dr_Frankenstein

      Hey

      So Tailscale is smart enough to connect via your local network when at home, so you could leave it running 24/7. On this setup you would need to swap VPN connections as I don’t believe current versions of Android allow multiple VPN connections at the same time. One of my users on Discord has actually set up the GlueTUN VPN and has that set as an Exit node, so they can just have Tailscale on to access local stuff and anything internet bound goes via the VPN!

      I can share the set-up if you want..

      • RB RB

        Sharing the Gluetun setup would be amazing! I followed your guide for setting it up on the NAS already, but I’m beyond the frontier of what I can figure out myself.

  2. Roy Roy

    What is the purpose of the “–accept-dns=false” line in the tailscale-up command? Is it forcing the client to use the Synology’s DNS or vice versa, always using local DNS? What if we’re not using Adguard/Pi-Hole – should we remove that line?
    I wonder if that command has anything to do with your caveat that some people have an issue when enabling “Allow LAN access”

    • Dr_Frankenstein Dr_Frankenstein

      Hey

      So the command has two outputs true or false

      False will not allow Tailscale to overide the local DNS configuration on that device with the DNS settings within the Tailscale Admin Console. So if the NAS is using Adguard it will continue using it, if it is using 9.9.9.9 it will use it.
      I have re-read all the information on the knowledge base and I think I might amend the guide to give you the option on what to do, as this actually makes the ‘Optional Step’ redundant. I am not sure if this changed at some point as I am getting blocked ads so a little puzzling…
      https://tailscale.com/kb/1054/dns/

      So changing it to ‘true’ will immediately assign the DNS settings from the DNS settings in here https://drfrankenstein.co.uk/wp-content/uploads/2023/03/dns.mp4

      So the long and short is yes, now it makes sense as to why people had reported ad blocking not working.. Not sure why it works for me?!? Let me mull over the amends and I will see what to do around the wording / steps to give the option.. I will flag the start of the guide to show an update is incoming..

      Cheers

    • Dr_Frankenstein Dr_Frankenstein

      It just routes all your traffic from the device you are using via your home internet connection, sometimes this is useful for accessing sites your mobile provider blocks but not your Home ISP.

  3. Marcus Marcus

    nevermind my last comment. tried it myself and you’ll only get the IP of the NAS (exit node) when accessing stuff (adguard home/DNS) on the LAN. so no client specific settings will work as adguard home will only see the same IP from all devices using tailscale.

  4. Marcus Marcus

    using this setup, accessing stuff on the LAN. will it use my device IP or will it use the NAS IP?

    why im asking is because i use adguard home and have different settings for different devices (i.e kids, parents etc..). so its important that every device that connects thru tailscale gets their own IP on the LAN side.

    And if its like with wireguard that when a device connects thru VPN and access local devices (in this case the DNS) it uses the wireguard IP, theres no point in me moving over to tailscale. :I

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

drfrankenstein.co.uk – writing Synology Docker Guides since 2016 – Join My Discord!