{"id":112,"date":"2024-06-17T10:00:00","date_gmt":"2024-06-17T10:00:00","guid":{"rendered":"https:\/\/netguide.io\/network\/activate-outgoing-synology-connections-for-tailscale\/"},"modified":"2026-08-14T19:26:32","modified_gmt":"2026-08-14T19:26:32","slug":"activate-outgoing-synology-connections-for-tailscale","status":"publish","type":"post","link":"https:\/\/netguide.io\/network\/en\/activate-outgoing-synology-connections-for-tailscale\/","title":{"rendered":"Activate outgoing Synology connections for Tailscale"},"content":{"rendered":"<div id=\"netgu-2488301848\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p class=\"wp-block-paragraph\">Synology DSM7 has introduced stricter restrictions on what packages are allowed to do. When DSM6 is used, Tailscale runs as root with full privileges and these steps are not required.<\/p>\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" width=\"1024\" height=\"328\" decoding=\"async\" src=\"https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/Tailscale-Logo-Black.svg_-1-1024x328-1.png\" alt=\"Tailscale logo\" class=\"wp-image-168\" srcset=\"https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/Tailscale-Logo-Black.svg_-1-1024x328-1.png 1024w, https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/Tailscale-Logo-Black.svg_-1-1024x328-1-300x96.png 300w, https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/Tailscale-Logo-Black.svg_-1-1024x328-1-768x246.png 768w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n<p class=\"wp-block-paragraph\">By default, Tailscale on Synology with DSM7 only allows inbound connections to the Synology device, but outbound Tailscale access from other applications running on the Synology NAS is not enabled.<\/p>\n\n<p class=\"wp-block-paragraph\">The reason for this is that the Tailscale package does not have the authorization to create a TUN device.<\/p>\n\n<p class=\"wp-block-paragraph\">To enable TUN so that outgoing connections from other apps running on the Synology are allowed, the following steps must be performed. The whole process takes about 5 minutes.<\/p>\n\n<h2 class=\"wp-block-heading\">Enable the TUN device for outgoing Tailscale connections<\/h2>\n\n<h3 class=\"wp-block-heading\">1. Install Tailscale on the Synology NAS<\/h3>\n\n<p class=\"wp-block-paragraph\">Make sure you are using Tailscale 1.22.2 or later, either via the Synology Package Center or a manually installed <code>*.spk<\/code> from the <a href=\"https:\/\/pkgs.tailscale.com\/\">Tailscale Packages Server<\/a>.<\/p>\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1376\" height=\"379\" class=\"wp-image-169\" src=\"https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/2023-10-16-16_24_19-Synology-01-Synology-NAS.png\" alt=\"Tailscale in the Synology Package Center\" srcset=\"https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/2023-10-16-16_24_19-Synology-01-Synology-NAS.png 1376w, \/wp-content\/uploads\/2023\/10\/2023-10-16-16_24_19-Synology-01-Synology-NAS-300x83.png 300w, \/wp-content\/uploads\/2023\/10\/2023-10-16-16_24_19-Synology-01-Synology-NAS-1024x282.png 1024w, \/wp-content\/uploads\/2023\/10\/2023-10-16-16_24_19-Synology-01-Synology-NAS-768x212.png 768w\" sizes=\"auto, (max-width: 1376px) 100vw, 1376px\"\/><\/figure>\n\n<h3 class=\"wp-block-heading\">2. Create a custom script<\/h3>\n\n<p class=\"wp-block-paragraph\">In Synology DSM, go to Control Panel &gt; Task Scheduler, click Create and select &#8220;Triggered Task&#8221;, then select &#8220;Custom Script.&#8221; When the Create Task window appears, click General. Under General Settings, enter a task name, select root as the user for whom the task will run and select Boot-up as the event that triggers the task. Make sure that the task is activated. Click Task Settings and enter the following as the custom script:<\/p>\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\"><pre class=\"shiki\" tabindex=\"0\" data-language=\"shell\"><code>\/var\/packages\/Tailscale\/target\/bin\/tailscale configure-host; synosystemctl restart pkgctl-Tailscale.service<\/code><\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">Click OK to save the settings, then restart the Synology. Alternatively, to avoid a reboot, run the custom script above as root on the device to restart the Tailscale package. The TUN settings should now be preserved each time you reboot your device.<\/p>\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1080\" class=\"wp-image-170\" src=\"https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/Synology-dsm-ausgeloeste-aufgabe-script-tailscale.jpg\" alt=\"Synology DSM triggered task with the Tailscale custom script\" srcset=\"https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/Synology-dsm-ausgeloeste-aufgabe-script-tailscale.jpg 1920w, \/wp-content\/uploads\/2023\/10\/Synology-dsm-ausgeloeste-aufgabe-script-tailscale-300x169.jpg 300w, \/wp-content\/uploads\/2023\/10\/Synology-dsm-ausgeloeste-aufgabe-script-tailscale-1024x576.jpg 1024w, \/wp-content\/uploads\/2023\/10\/Synology-dsm-ausgeloeste-aufgabe-script-tailscale-768x432.jpg 768w, \/wp-content\/uploads\/2023\/10\/Synology-dsm-ausgeloeste-aufgabe-script-tailscale-1536x864.jpg 1536w\" sizes=\"auto, (max-width: 1920px) 100vw, 1920px\"\/><\/figure>\n\n<h3 class=\"wp-block-heading\">3. Customize the Synology firewall (if enabled)<\/h3>\n\n<p class=\"wp-block-paragraph\">When TUN is enabled, Tailscale traffic flows through Synology&#8217;s built-in firewall. The firewall is disabled by default. However, if it is enabled, add an exception for the Tailscale subnet, 100.64.0.0\/10. In Main Menu &gt; Control Panel &gt; Security &gt; Firewall, add a firewall rule to the default profile that allows traffic from the source IP subnet 100.64.0.0 with subnet mask 255.192.0.0.<\/p>\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" width=\"604\" height=\"351\" decoding=\"async\" class=\"wp-image-171\" src=\"https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/2023-10-16-16_48_56-Synology-01-Synology-NAS.png\" alt=\"Synology firewall rule for the Tailscale subnet\" srcset=\"https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/2023-10-16-16_48_56-Synology-01-Synology-NAS.png 604w, https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/2023-10-16-16_48_56-Synology-01-Synology-NAS-300x174.png 300w\" sizes=\"auto, (max-width: 604px) 100vw, 604px\" \/><\/figure><div id=\"netgu-336049990\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Synology DSM7 blocks outbound Tailscale access by default. Learn how to enable the TUN device so other apps on your Synology NAS can reach the tailnet.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[8],"tags":[],"class_list":["post-112","post","type-post","status-publish","format-standard","hentry","category-uncategorized-en"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"Tobias Pries","author_link":"https:\/\/netguide.io\/network\/author\/tobias-pries\/"},"uagb_comment_info":0,"uagb_excerpt":"Synology DSM7 blocks outbound Tailscale access by default. Learn how to enable the TUN device so other apps on your Synology NAS can reach the tailnet.","brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/posts\/112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/comments?post=112"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/posts\/112\/revisions"}],"predecessor-version":[{"id":172,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/posts\/112\/revisions\/172"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/media?parent=112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/categories?post=112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/tags?post=112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}