Access Your NAS Remotely with Tailscale in 2026

Tailscale lets you reach your NAS from outside your home without opening a port on your router or exposing SMB or the admin interface to the Internet. Every device you install it on (NAS, laptop, smartphone) joins an encrypted, WireGuard-based private network called a “tailnet”. Each device gets a stable address in the 100.64.0.0/10 range (of the form 100.x.y.z) and, with MagicDNS, a machine name. Tailscale traverses NAT on its own: no port forwarding is needed, and you should definitely not create any.

This tutorial covers a Synology NAS running DSM 7, such as the Synology DiskStation DS220+, where Tailscale is installed from Package Center. It also covers a Linux mini PC used as a NAS, such as a Dell OptiPlex Micro Desktop running Debian or Ubuntu, where you use the official script. We will then see how to reach SMB shares (port 445) and the DSM interface through the tailnet only, and how to lock down access.

Prerequisites

• A Synology NAS running DSM 7 with administrator access, or a Linux machine (Debian, Ubuntu, Fedora…) acting as a NAS, with sudo.
• A Tailscale account. You create it by signing in with a supported identity provider (Google, Microsoft, GitHub, Apple…). The free “Personal” plan is enough for personal, non-commercial use. Its limits change over time: check them on Tailscale’s pricing page.
• The Tailscale client on at least one remote device (Windows, macOS, Linux, iOS, Android).
• The SMB service enabled on the NAS, with a user account that has rights on the shares.
• No domain name, dynamic DNS or port forwarding. If you have already forwarded ports 445, 139, 5000, 5001 or 22 to the NAS, delete those rules on your router.

About the hardware: the DS220+ runs the official Tailscale package. It has no M.2 slot, so an NVMe SSD like the Corsair MP511 SSD 1To cannot be fitted in it. However, it can serve as the system drive and fast storage in an OptiPlex Micro-type mini PC, provided your model has an M.2 NVMe slot (check its spec sheet). Tailscale itself needs no special hardware.

Step-by-step installation

Step 1: Install Tailscale on the NAS

On Synology (DSM 7): open Package Center, search for “Tailscale”, click Install, then Open. The package interface sends you to the login page. Sign in with your identity provider, and the NAS joins your tailnet. The Package Center version is only updated roughly once a quarter. You can also manually install the SPK file matching your model’s architecture (Package Center > Manual Install), downloaded from Tailscale’s package server.

On a Linux NAS (OptiPlex or other): use the official script, then connect the machine.

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
# open the printed URL to authenticate the machine

Check (Linux, or Synology over SSH): the command should print an address in 100.x.y.z.

tailscale ip -4
tailscale status

On Synology, if tailscale is not in the PATH, use the full path /var/packages/Tailscale/target/bin/tailscale. In every case, the NAS must also appear on the Machines page of the admin console (login.tailscale.com/admin/machines).

Step 2: Enable TUN mode on DSM 7 (Synology only)

On DSM 7, Synology’s sandbox prevents the package from creating its TUN interface. The NAS is still reachable, but other DSM packages cannot make outbound connections to the tailnet, and the DSM firewall does not filter that traffic. The official documentation (Tailscale 1.22.2 or later) provides a task that runs at boot:

1. Control Panel > Task Scheduler > Create > Triggered Task > User-defined script.
2. General tab: user root, event Boot-up, task enabled.
3. Task Settings tab, script:

/var/packages/Tailscale/target/bin/tailscale configure-host; synosystemctl restart pkgctl-Tailscale.service

Reboot the NAS, or run the task once with Run. You must rerun this script after every Tailscale package update.

Check: over SSH on the NAS (Control Panel > Terminal & SNMP > Enable SSH service, to be used only on the LAN or through Tailscale), the tailscale0 interface must exist and carry the 100.x.y.z address:

ip addr show tailscale0

The package creates this interface. There is nothing to create or rename in DSM.

Step 3: Disable key expiry for the NAS

By default, a device’s key expires (180 days for new tailnets). You then have to re-authenticate, which is a problem when you are away from home. Disabling it is common for a server: Machines page, ”…” menu at the right of the NAS row, then Disable key expiry.

Check: on the Machines page, the NAS shows “Expiry disabled” under its name.

Step 4: Use MagicDNS instead of a domain or dynamic DNS

The NAS’s 100.x.y.z address is stable, and MagicDNS gives it a name. MagicDNS is enabled by default on tailnets created since October 2022. Otherwise: admin console, DNS page, Enable MagicDNS button. The NAS then answers to its short name (for example nas) and to its full name nas.<your-tailnet>.ts.net. To change that name: Machines page, ”…” menu, Edit machine name. Dynamic DNS is pointless here: it tracks your router’s public IP, which Tailscale does not use.

Check, from a remote device connected to the tailnet (on mobile data, for example, to get off your LAN):

tailscale ping nas

The reply shows whether the link is direct (via <ip>:<port>) or relayed through a DERP server. Both work, but a direct link is faster.

Step 5: Access SMB shares through the tailnet

SMB uses port 445/TCP (port 21 is FTP’s). On Synology, make sure Control Panel > File Services > SMB > Enable SMB service is ticked. Then, from the remote device:

• Windows: in File Explorer, \\nas\share-name (or \\100.x.y.z\share-name).
• macOS: Finder, Go > Connect to Server, smb://nas.
• Linux: see below.

Check: curl does not test SMB, which is not HTTP. Use an SMB client that lists the shares instead:

# Linux (smbclient package)
smbclient -L //nas -U your_user

On Windows, in PowerShell, Test-NetConnection -ComputerName nas -Port 445 should return TcpTestSucceeded : True.

On a Linux NAS running Samba, first check the service locally: systemctl status smbd (Debian/Ubuntu; the configuration lives in /etc/samba/smb.conf). If UFW is active, allow SMB only on the Tailscale interface:

sudo ufw allow in on tailscale0 to any port 445 proto tcp
sudo ufw status verbose

The DSM interface remains reachable at https://nas:5001 (or http://nas:5000), again through the tailnet only.

Step 6: Secure the account and restrict access

Two-factor authentication: Tailscale does not manage passwords. 2FA is enabled at the identity provider you use to sign in (Google, Microsoft, GitHub account…), and is not a paid Tailscale option. Turn it on there.

Access rules: the default policy allows all traffic between tailnet devices. To limit access to the NAS to SMB and DSM, edit the policy file in the admin console, on the Access controls page. Example with a tag. The tag is applied to the NAS from Machines > … > Edit ACL tags, once it is declared in tagOwners:

{
  "tagOwners": {
    "tag:nas": ["autogroup:admin"]
  },
  "grants": [
    {
      "src": ["autogroup:member"],
      "dst": ["tag:nas"],
      "ip": ["tcp:445", "tcp:5001"]
    }
  ]
}

Warning: this file replaces the “allow everything” rule. Add any other flows you need (between your PCs, for example) before saving. The console validates the syntax when you save.

DSM firewall: if it is enabled (Control Panel > Security > Firewall), add an Allow rule to the profile in use for source 100.64.0.0, mask 255.192.0.0. Otherwise, Tailscale traffic will be blocked once TUN mode is on.

Check: from a member device, smbclient -L //nas -U your_user still works, while another port (for example nc -zv nas 22 on Linux) is refused or times out.

Step 7: Check status and keep Tailscale up to date

tailscale status
tailscale netcheck

status lists peers and their state. netcheck describes UDP connectivity and the nearest DERP relay. On Linux, daemon logs are read with journalctl -u tailscaled.

For updates on Synology, the documentation suggests a Scheduled Task > User-defined script run as root (daily, for example):

/var/packages/Tailscale/target/bin/tailscale update --yes

Then remember to rerun the configure-host script from step 2, or reboot the NAS. On Linux, Tailscale is updated with the package manager (sudo apt update && sudo apt upgrade).

Check: tailscale version prints the installed version.

Verification checks

• tailscale status on the NAS: the remote device is listed.
• tailscale ping nas from outside: you get a reply.
• smbclient -L //nas -U user, or Test-NetConnection -Port 445: the shares are listed, or the port responds.
• From an outside network without Tailscale running, your router’s public IP must not respond on 445 or 5001. Also check on the router that no port forwarding points to the NAS.

Security and best practices

• Never expose SMB, DSM, SSH or Docker to the Internet: with Tailscale, there is no need to.
• Disable QuickConnect and the NAS’s UPnP/NAT-PMP forwarding if you no longer need them.
• Enable 2FA at your identity provider, and on the DSM administrator account too.
• Restrict flows with grants and give the NAS a dedicated tag.
• HTTPS for DSM: Tailscale can issue a certificate for the *.ts.net name (admin console, DNS page, Enable HTTPS, then tailscale cert on the machine). The names of certified machines are then published in public Certificate Transparency logs: avoid revealing names. On Synology, the certificate has to be imported into DSM by hand; check the procedure for your version.
• Tailscale is not a backup: apply a 3-2-1 strategy.

Troubleshooting common errors

The NAS shows as offline in the console

Cause: expired key, or the package stopped after a DSM update. Fix: over SSH, run sudo tailscale up and open the printed URL. Then disable key expiry (step 3).

Other DSM packages cannot reach the tailnet

Cause: TUN mode is inactive, which often happens after a package update. Fix: rerun the configure-host task (step 2) and check with ip addr show tailscale0.

The NAS stops responding after enabling TUN mode

Cause: the DSM firewall blocks 100.64.0.0/10. Fix: add the allow rule described in step 6.

nas does not resolve

Cause: MagicDNS is disabled, or the client does not accept Tailscale DNS. Fix: enable MagicDNS (DNS page) and test with the full name nas.<tailnet>.ts.net or the 100.x.y.z IP.

Slow connection

Cause: link relayed via DERP, which happens with strict NAT or filtered UDP. Fix: run tailscale netcheck and tailscale ping nas. Do not open service ports: see Tailscale’s documentation on direct connectivity.

SMB/DSM ports are refused

Cause: overly restrictive grants, or the SMB service is disabled. Fix: review the policy file and check File Services > SMB.

FAQ

Do I need to open a port on my router?

No. Tailscale makes outbound connections and traverses NAT. It falls back to an encrypted DERP relay when a direct connection is impossible.

Is traffic encrypted?

Yes, end to end with WireGuard, between your devices. HTTPS is still useful for DSM, but it is not required for encryption.

What is the difference between the free and paid plans?

The free Personal plan is meant for personal, non-commercial use. Paid plans add team-oriented features. Quotas change regularly: check the official pricing page.

Does Tailscale SSH work on Synology?

No, the documentation states it is not supported. Use DSM’s built-in SSH server, reached through the tailnet.

How do I check that everything is configured correctly?

Run tailscale status on the NAS and tailscale ping nas from a remote device, then list the SMB shares with smbclient or test port 445.

Read also

• Strategie sauvegarde 3 2 1 nas
• Temperature disque dur nas limites
• Nas occasion vs neuf