Skip to main content

Synology NAS Tailscale Integration

Synology NAS Tailscale Integration

Last Updated: 2025-12-26
Status: Planned
Source: infrastructure-migration-nas-gpu.md

Overview

This guide covers integrating Synology DS224+ NAS with the Tailscale mesh network for secure, private access to NAS services.

Prerequisites

  • Synology DS224+ NAS with DSM installed
  • Tailscale account (flux423@mac.com)
  • Access to Tailscale admin console
  • Network connectivity to NAS

Installation Steps

Step 1: Install Tailscale Package

  1. Open Package Center in DSM
  2. Search for "Tailscale"
  3. Install Tailscale package
  4. Wait for installation to complete

Step 2: Configure Tailscale

  1. Open Tailscale application in DSM
  2. Click Sign in to Tailscale
  3. Authenticate with Tailscale account (flux423@mac.com)
  4. Wait for connection to establish

Step 3: Configure Tailscale Settings

Recommended Settings:

SettingValueReason
EnableONEnable Tailscale
Accountflux423@mac.comTailscale account
Subnet routingOFFNAS should not advertise routes
Exit nodeOFFNAS should not be exit node
FunnelOFFNo public exposure needed
Auto-connectONAuto-connect on boot

Step 4: Assign Tailscale IP and Tag

  1. Go to Tailscale admin console
  2. Find NAS device (hostname will be auto-generated)
  3. Assign Tailscale IP (e.g., 100.116.110.124)
  4. Add tag: tag:nas-storage
  5. Verify device appears in device list

Network Configuration

Current Network

  • Local IP: 192.168.68.60
  • Network: 192.168.68.0/24
  • Port: 5001 (HTTPS)

Recommended Network (If Moving to Agent Network)

  • Local IP: 192.168.8.10 (static)
  • Network: 192.168.8.0/24 (Bluefly-Agents)
  • Port: 5001 (HTTPS)

Benefits of Moving to Agent Network:

  • Same subnet as other agent infrastructure
  • Easier NFS configuration for Kubernetes
  • Consistent network topology
  • Better integration with router subnet routing

Tailscale ACL Configuration

Update Tailscale ACL policy to allow access to NAS:

{
  "tagOwners": {
    "tag:nas-storage": ["group:admins"]
  },
  "acls": [
    {
      "action": "accept",
      "src": ["group:admins"],
      "dst": ["tag:nas-storage:*"]
    },
    {
      "action": "accept",
      "src": ["tag:agent-host"],
      "dst": ["tag:nas-storage:*"]
    }
  ]
}

This allows:

  • Admins to access NAS from anywhere
  • Agent hosts to access NAS for storage operations

Access Methods

Via Tailscale (Private Access)

Once Tailscale is configured:

  1. Web Interface: https://100.116.110.124:5001 (via Tailscale IP)
  2. NFS: 100.116.110.124:/k8s-pv (via Tailscale IP)
  3. SMB: \\100.116.110.124\share (via Tailscale IP)

Via Cloudflare Tunnel (Public Access)

Currently configured:

  • Web Interface: https://nas.blueflyagents.com (via Cloudflare Tunnel)

Note: Cloudflare Tunnel provides public access, Tailscale provides private access. Both can coexist.

NFS Configuration for Kubernetes

Prerequisites

  • NAS on Tailscale network
  • NFS shares configured on NAS
  • NFS CSI driver installed in Kubernetes

Configuration

NFS Share Settings:

  • Share Name: k8s-pv
  • NFS Version: 4.1
  • Access Control:
    • Allow: 100.108.129.7 (Mac M4 Tailscale IP)
    • Allow: 100.108.180.36 (Mac M3 Tailscale IP)
    • Allow: 192.168.8.0/24 (Agent network, if NAS moved)
  • Root Squash: Enabled
  • Async: Enabled

Kubernetes StorageClass:

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: synology-nfs
provisioner: nfs.csi.k8s.io
parameters:
  server: 100.116.110.124  # Tailscale IP
  share: /k8s-pv
  mountOptions: "nfsvers=4.1,async"
volumeBindingMode: Immediate
allowVolumeExpansion: true

Testing

Test Tailscale Connection

# From Mac M4 or M3
tailscale ping 100.116.110.124  # NAS Tailscale IP

# Test web interface
open https://100.116.110.124:5001

# Test NFS (if configured)
mount -t nfs 100.116.110.124:/k8s-pv /mnt/test

Verify ACL Policy

  1. Check NAS device has tag:nas-storage
  2. Verify ACL allows access from agent hosts
  3. Test access from different devices

Troubleshooting

Tailscale Not Connecting

  1. Check Tailscale package is running in DSM
  2. Verify Tailscale account authentication
  3. Check network connectivity
  4. Review Tailscale logs in DSM

Cannot Access NAS via Tailscale

  1. Verify Tailscale IP is correct
  2. Check ACL policy allows access
  3. Verify NAS device is online in Tailscale admin
  4. Test connectivity: tailscale ping <nas-ip>

NFS Not Working

  1. Verify NFS is enabled on NAS
  2. Check NFS share permissions
  3. Verify Tailscale IP in StorageClass
  4. Test NFS mount manually

Security Considerations

  1. Tags: Use tag:nas-storage for access control
  2. ACL: Restrict access to admins and agent hosts only
  3. No Public Exposure: Tailscale provides private access only
  4. Funnel OFF: Never enable Funnel on NAS
  5. Subnet Routing OFF: NAS should not advertise routes

Related Documentation