Tailscale gives phones, laptops, and a home NAS a private mesh VPN over WireGuard without opening DSM or QTS to the public internet. Clients join the same tailnet, then reach file shares, admin UIs, and LAN services as if they were on the couch next to the box.

Port-forwarding DSM, QTS, SSH, or SMB is the old pattern. It works until a CVE, a weak password, or a forgotten service turns the NAS into an attack surface. Tailscale keeps the NAS behind NAT and CGNAT and still lets approved devices in.

This guide is for Synology DSM and QNAP QTS (or QuTS hero) paths. It pairs with the NAS overview at /what-is-a-nas-network-storage-explained, and it is a different job from UPS shutdown (/ups-auto-shutdown-synology-qnap-nut) or the backup layout at /3-2-1-backup-strategy-nas.

What Tailscale is (and is not)

Tailscale is a mesh VPN built on WireGuard. Each device gets a stable 100.x address in your private network (a "tailnet"). Traffic is encrypted end to end. There is no need to punch a hole in the router for DSM HTTPS or SMB.

It is not a full site-to-site VPN appliance by default. Subnet routing and exit nodes are optional add-ons you enable when you want the phone to see the whole LAN, or when you want to egress through home. ACLs in the Tailscale admin console decide who can talk to what.

Why not port-forward the NAS

Exposing DSM, QTS, QuickConnect-style relays you do not control, or raw SMB to the internet trades convenience for a permanent remote-login surface. Tailscale flips that: the NAS initiates outbound connections to Tailscale's coordination plane, then peers connect over WireGuard. Home routers with CGNAT (common on cellular and some ISPs) still work because neither side needs a public inbound port.

Synology: Package Center or Container Manager

A current 2-bay Synology such as the Synology DiskStation DS225+ is a typical always-on Tailscale host. Prefer Package Center when Synology ships a Tailscale package for your DSM version. Use Container Manager (Docker) when the package is missing or you want a pinned image.

  1. In DSM, open Package Center, search for Tailscale, and install if listed. Or open Container Manager, pull the official Tailscale image, and run it with the host network (or the documented privileged / TS_AUTHKEY pattern for your DSM generation).
  2. Launch Tailscale and start login. On Package installs this is often a browser link or a one-time auth URL shown in the package UI. On Docker, pass an auth key from the Tailscale admin console or complete the interactive login URL from the container logs.
  3. In the Tailscale admin console, confirm the Synology appears as a connected machine. Approve it if your tailnet requires admin approval for new devices.
  4. From a laptop already on Tailscale, open https://100.x.y.z:5001 (or the MagicDNS name) and confirm DSM loads without touching router port forwards.

Give the Tailscale process permission to advertise routes if you plan subnet routing (next section). On constrained NAS CPUs, Tailscale is light, but DERP relay fallback costs a little more CPU than a direct peer path.

QNAP: App Center or Container Station

QNAP owners follow the same idea with different menus. A 4-bay box such as the QNAP TS-464-8G-US is a common always-on host with enough RAM for Container Station workloads alongside Tailscale.

  1. In QTS / QuTS, open App Center, search for Tailscale, and install if QNAP publishes a package for your build. Otherwise open Container Station, deploy the official Tailscale container with host networking (or the vendor-documented compose snippet), and supply an auth key or login URL.
  2. Complete device auth in the Tailscale admin console and approve the QNAP if your policy requires it.
  3. Test DSM-equivalent access: hit the QNAP web UI over the 100.x address or MagicDNS name from a remote Tailscale client.
  4. Keep QNAP firmware and Container Station current. Orphaned containers with stale auth keys are a common "it used to work" failure.

Auth, MagicDNS, and clients

Install Tailscale on the devices that should reach the NAS:

  • Mac: Tailscale from the Mac App Store or the official pkg, then sign in with the same account (or an invited user) as the NAS.
  • iPhone / iPad: Tailscale from the App Store, enable VPN permission, sign in, and leave it connected when you need home LAN reachability.

In the Tailscale admin console, enable MagicDNS so you can use names like ds225.tailnet-name.ts.net instead of memorizing 100.x addresses. Split DNS is optional if you also want LAN DNS (Pi-hole, router DNS) while on the tailnet.

Subnet routing (reach the whole LAN)

By default Tailscale reaches the NAS itself. Subnet routing advertises your home LAN (for example 192.168.1.0/24) so a phone on cellular can open a printer, camera NVR, or smart home hub that is not running Tailscale.

  1. On the NAS Tailscale host, enable route advertising for your LAN CIDR (Package UI toggle, or tailscale up --advertise-routes=192.168.1.0/24 in SSH / container exec, matching your real subnet).
  2. In the Tailscale admin console, open the machine, and Approve the advertised subnet routes.
  3. Disable SNAT only if you know you need return-path tricks; most home LANs keep the defaults.
  4. From the phone, ping a LAN IP that is not the NAS. If only the NAS responds, the route was not approved or the advertised CIDR is wrong.

If the NAS is a weak Tailscale host (old ARM, heavy Docker stack, flaky Container Station), park Tailscale subnet routing on a cheap always-on mini PC instead and leave the NAS as a plain client. A low-power box such as the Beelink Mini S13 works well as a dedicated subnet router or exit node. For more always-on host options, see /best-mini-pcs-home-server-2026. Wake-on-LAN notes for sleeping PCs live at /wiki/wake-on-lan.

ACLs (short note)

Tailscale ACLs are JSON policies in the admin console. A locked-down home tailnet often allows personal user devices to the NAS tags, and denies guest devices from SMB. Start open while you learn the topology, then tighten tags (tag:nas, tag:family-phone) before you invite anyone else. Wrong ACLs look like "connected but connection refused," so keep the policy diff small when debugging.

Common failures

Bottom line

Install Tailscale on the Synology or QNAP, authenticate into the tailnet, approve the device, then advertise and approve the LAN subnet if phones should reach more than the NAS. Keep DSM and QTS off the public internet. Use a mini PC as the subnet router when the NAS is the wrong place to run that role. Pair this with solid local power and backup habits from /ups-auto-shutdown-synology-qnap-nut and /3-2-1-backup-strategy-nas.