Home | Contact
whichnas.com

Set up Tailscale VPN on your Synology NAS for easy remote access

Working from a holiday house in Byron Bay while streaming media stored on a DiskStation back in Melbourne has become a realistic possibility thanks to mesh networking tools. Many Australians have started running home servers to keep their film libraries, work documents, and photo archives in their own hands rather than on someone else's cloud. Setting up a Synology for remote access used to mean fiddling with dynamic DNS, punching holes in a router, and hoping the connection stayed alive through the next NBN outage. A modern approach sidesteps most of that complexity by turning the NAS into a node on a private encrypted overlay network.

Tailscale works on top of WireGuard, which means the underlying cryptography is solid and the data path stays light. Rather than a traditional hub-and-spoke model, every device on the network can talk to every other one as if they were on the same LAN. For households where one person edits video off the NAS in Adelaide while another accesses surveillance footage from a property in Perth, the direct peer connections cut a lot of latency that would normally come from bouncing traffic overseas. Because the traffic stays inside a private tunnel, there is no need to open ports on a Telstra Smart Modem or an Optus router, which is a welcome change for anyone who has wrestled with carrier-grade NAT.

The Synology platform has long supported VPN packages, but the older IPsec and OpenVPN options often required manual certificate management and port forwarding. Running Tailscale through the Docker package on DSM 7 keeps the setup scriptable and contained, and it leaves the system folders untouched. Once the container is running, the NAS appears in the Tailscale admin console just like a laptop or phone, and MagicDNS resolves its hostname without any extra configuration.

This walkthrough covers the full path from a fresh DSM install through to having a stable mesh connection that survives reboots. A basic comfort with the command line is useful, but nothing here requires editing obscure system files. Anyone who has set up a Docker container before will find the process familiar, and even first-timers can follow along with the SSH commands provided.

Preparing your DiskStation for the Tailscale container

Before any software is installed, the Synology needs to meet a few minimum conditions. DSM 7 or later is strongly recommended, since older versions do not include the container manager that makes this whole exercise feasible. The Synology account tied to the unit should have administrator rights, as installing third-party packages typically requires elevated access. If the unit is part of a household with multiple users, creating a dedicated service account for VPN management keeps the audit trail tidy.

A reliable internet link matters more than people sometimes realise. Australian NBN services come in many flavours, from fibre-to-the-premises in newer Sydney estates to fibre-to-the-node in older suburbs and fixed wireless across regional Queensland. Each has its own quirks around upload speed and IP address stability, which affects how comfortable the remote experience feels. A static IP is not required, but a reasonably stable connection does help the Tailscale handshake complete quickly when waking the NAS from sleep.

The Docker package needs to be installed from Package Center. Synology rebranded this tool as Container Manager in more recent DSM releases, but the underlying functionality is identical. After installation, opening the package for the first time prompts the creation of a default bridge network, which is fine for the purposes of running Tailscale. SSH access should also be enabled from Control Panel under Terminal and SNMP, since the rest of the work happens over the command line.

A few useful prerequisites to confirm before moving on:

Installing the Tailscale container through SSH

With the SSH service enabled, the next step is to log into the NAS using a terminal application. On macOS and Linux, the built-in terminal works fine, while Windows users often reach for PuTTY or the newer Windows Terminal. Connecting to the local IP of the DiskStation using the admin account looks the same as any other SSH session: ssh admin@192.168.x.x, with the password being the same one used for the DSM web interface.

Once inside the shell, the tailscale image can be pulled directly from the official registry. The command sudo docker pull tailscale/tailscale:latest grabs the most recent stable build. After the download completes, a container can be started with a single docker run command that includes the necessary capability flags for networking. A typical invocation looks like this: sudo docker run -d --name tailscale --restart always --cap-add NET_ADMIN --cap-add SYS_MODULE -v /volume1/docker/tailscale:/var/lib/tailscale -e TS_AUTHKEY=tskey-auth-xxxxxxxx tailscale/tailscale:latest

The TS_AUTHKEY value comes from the Tailscale admin console under the Settings menu. Generating a reusable key labelled with the NAS hostname makes future container rebuilds painless. The volume mount at /volume1/docker/tailscale keeps the persistent state on the main storage pool, so removing and recreating the container does not require re-authenticating each time.

After the container starts, running docker ps inside the SSH session should show the tailscale entry as healthy. The tailscale status command from inside the container reveals the assigned IP address and confirms that the connection to the coordination server has succeeded. From this point onwards, the NAS is reachable over the Tailscale network using either the 100.x IP or, if MagicDNS is enabled, a friendly hostname like nas.tailnet-name.ts.net.

Authenticating and managing devices on the tailnet

Authentication is where Tailscale departs from the usual VPN experience. Rather than exchanging pre-shared keys or certificates, the system relies on identity providers such as Google, Microsoft, GitHub, or any OIDC-compliant service. For Australian households where family members already use Gmail or Microsoft 365 for school and work, signing in is almost frictionless. Each person gets their own device on the shared tailnet, and access rules can be tailored in the admin console.

Sharing the NAS across the tailnet works best when the relevant services are exposed only to the right devices. Synology packages each have their own listening ports, and configuring those is straightforward.

Services commonly opened up for household access:

ACLs in the Tailscale admin panel can restrict which devices see which ports, giving an extra layer of control beyond the DSM firewall. For most home setups, granting access to all household devices is reasonable, while keeping work devices isolated is a wise habit.

Routing subnets and handling exit nodes

For households with smart TVs, printers, or other gear that cannot run Tailscale natively, the Synology can act as a subnet router. Advertising the home LAN through the NAS means that any tailnet device can reach, say, a printer at 192.168.1.50 without the printer itself needing VPN software. The relevant flags are passed to the tailscale up command, and the admin console then offers the option to approve the route. Once approved, the route is available to every authorised device.

Exit nodes are another useful feature, particularly for travellers who want their internet traffic to appear as if it is coming from home. Turning the Synology into an exit node routes all client traffic through the home internet connection. The latency overhead can be noticeable when the home link is fixed wireless in the Northern Territory, so this feature is best reserved for situations where geographic masking matters more than raw speed.

Power management deserves a brief mention. Australian homes in bushfire-prone zones often install UPS units to keep networking gear alive during blackouts, and a NAS running around the clock benefits from the same treatment. Configuring DSM to enter safe mode after extended power loss, combined with the always-restart flag on the Tailscale container, keeps the mesh link reliable through minor grid blips.

Maintaining the connection over time

Once the setup is complete, ongoing maintenance is minimal. Tailscale releases updates regularly, and pulling a new image every few months keeps the cryptographic libraries current. Stopping the container, running docker pull, and starting it again is the full update cycle. Because the persistent volume holds the authentication state, no new login is required after an update.

Monitoring happens through the Tailscale admin console, where the NAS appears alongside phones, laptops, and any other machines on the tailnet. If a device drops offline, the console flags it within a few minutes, which is handy when troubleshooting why a Plex stream from a beachside Airbnb in Torquay suddenly stops. The DSM Resource Monitor and Docker logs together give a complete picture of what the container is doing at any moment.

Routine checks worth scheduling each month:

For Australians planning a long trip overseas, testing the connection before departure avoids the frustration of arriving somewhere exotic only to find the home setup needs attention. A short session from a mobile phone on a different network confirms the tunnel is alive, the services respond, and the right ports are exposed. From that point, the NAS behaves as if it were sitting on the same desk, no matter how many time zones away.

Pick up a Synology unit from an Australian retailer like Scorptec, Mwave, or JB Hi-Fi, pair it with a Tailscale account, and the rest of this guide will get the mesh link running within an hour. The combination turns a tucked-away DiskStation into a properly reachable personal cloud, without paying ongoing subscription fees or trusting third-party servers with private files.