iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To reach home-network devices that cannot run Tailscale while you’re away, configure a NAS with Tailscale as a subnet router. It advertises your chosen home-LAN route to your tailnet, letting authorized Tailscale-connected devices reach devices on that LAN. It does not route all your internet traffic through home; that is what an exit node is for.
What a NAS subnet router does
A subnet router acts as a gateway between your Tailscale network (tailnet) and a specified private network, such as your home LAN. The NAS runs Tailscale and advertises the LAN route. A laptop or phone connected to your tailnet while traveling can then connect to devices on that LAN even when those devices cannot install Tailscale themselves.
The route is not the same as blanket access: advertising makes the route available to the tailnet, while your access policy determines which users and devices are allowed to use it. See Tailscale’s subnet routers guide and access-control documentation.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Subnet router or exit node?
| Option | Traffic destination | What runs Tailscale | Use it when |
|---|---|---|---|
| Subnet router | Specified devices or services on a private LAN route | A gateway on that LAN, such as a NAS; the remote client also joins the tailnet | You need to reach home equipment that cannot run Tailscale itself |
| Exit node | The client’s internet-bound traffic, routed through the selected device | The exit-node device and the remote client | You want internet traffic to leave through home or another selected network |
For example, a home printer or other LAN device that cannot run Tailscale is a subnet-routing use case. Choosing an exit node is not required to reach that device. Tailscale explains the distinction in its exit nodes guide.
#1 Best Overall
- Expanded 5.9 GHz spectrum support enables additional high-speed 80 and 160 MHz channels
- 2.5GbE port enables support for the fastest ISPs and can optionally be configured as a LAN port
- Create and define up to 5 separate networks to segregate and contain vulnerable devices
- Parental controls, web filtering, traffic control, and threat prevention put you in control over your network
- Comprehensive VPN server solution with remote desktop and site-to-site tunneling provides flexible and secure remote connectivity
What you need before configuring the NAS
- A NAS platform and Tailscale installation method supported by its current vendor instructions.
- The actual LAN network address in CIDR notation—for example, the network range you intend to make reachable, not an example copied from a guide.
- Administrator access to the NAS and the Tailscale admin console, so you can advertise the route and approve it if needed.
- An access policy that permits the intended traveling users and devices to reach the relevant LAN addresses and services.
IP forwarding is required for routing features. Whether you need to enable it manually depends on the platform and its Tailscale setup; consult Tailscale’s IP-forwarding troubleshooting guide for current guidance.
Configure the NAS to advertise your home LAN
- Install and connect Tailscale on the NAS. Follow the integration instructions for your NAS operating system and confirm that the NAS appears in your tailnet.
- Identify the LAN CIDR. Use the network range assigned to the home LAN you want to reach. Do not advertise a broader range than necessary.
- Advertise the route. Tailscale’s subnet-router instructions use the
--advertise-routesoption. Apply it using the method supported by your NAS platform; some integrations require a command-line workflow. - Enable or approve the route. In the Tailscale admin console, enable the advertised route unless your policy automatically approves it. Advertising and approval are separate from granting access under your policy.
- Check the access policy. Allow only the intended users and devices to connect to the required LAN destinations. A route being approved does not, by itself, mean every tailnet member has permission to use it.
- Connect from away from home and test the target service. Join the same tailnet from your traveling device, then try the device’s normal address and service. Test the application or protocol you need rather than relying only on ping.
Tailscale’s subnet-router documentation was last updated October 29, 2025. The precise console labels and platform steps can change, so use the live guide alongside the instructions for your NAS.
Rank #2
- Dedicated Tri-band 2.13 Gbps (400+867+867 Mbps) bandwidth optimized for performance and reliability
- Easy setup and remote management from web client or mobile app
- Comprehensive parental management and easy-to-use inter face with Safe Access
- Single Wi-Fi name and seamless roaming with 802.11 k/v/r support
- Create advanced VPNs with WebVPN, Synology SSL VPN, and SSTP VPN capability
NAS-specific considerations
Synology
Tailscale’s Synology integration page, last validated January 5, 2026, documents that Synology can advertise routes but cannot accept routes from other subnet routers. It also describes Synology’s hybrid networking: shared-subnet devices may be reachable over UDP and TCP without necessarily replying to ping. DSM 7 restrictions are also noted. These details describe the documented state on that validation date; check the current Synology integration guide for changes and the exact installation path.
QNAP
Tailscale’s QNAP instructions describe subnet-router setup as a command-line workflow using the Tailscale package’s CLI tool. Follow the current QNAP integration guide rather than assuming the Synology or general NAS steps apply unchanged.
Quick Recap
Best Value
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
Rank #4
- 1.7GHz Dual-core processor for fast, uncompromising performance
- Powerful 4x4 802.11ac wave 2 radios with MU-MIMO and up to 2.53Gbps breakthrough wireless speeds
- Smart Connect for seamless transition between maximum speed or range
- Hardware accelerated Layer 7 traffic control and monitoring
- Dual WAN capable for load balancing and failover support
Rank #3
- Dual-band Wi-Fi 6 with 5.9 GHz support and configurable WAN/LAN 2.5GbE port enable fast wireless and wired transfers
- Comprehensive network security provided through Threat Prevention, VLAN segmentation, and WPA3 support
- Standalone router that can be incorporated into a mesh system for whole home coverage
- Parental controls and web filtering keep your family protected
- DS router app provides easy-to-follow setup and network management through your mobile device
When a device is still unreachable
- Confirm route status: verify that the NAS advertised the correct CIDR and that the route is enabled or automatically approved.
- Check permissions: verify that the traveling device’s user and device are allowed by the tailnet access policy to reach the target.
- Check forwarding: confirm that IP forwarding is enabled if your platform requires it; Tailscale’s IP-forwarding guide covers the setting.
- Test the right thing: a failed ping does not always prove the route is broken. On Synology, the documented hybrid-networking behavior can allow UDP and TCP reachability without a ping response.
- Recheck platform instructions: NAS-specific limitations and setup procedures can differ, so use the current Tailscale integration page for your model’s operating system.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
