How do I access my Synology NAS remotely behind CGNAT?

Use QuickConnect. It is free, built by Synology for this, and needs no port forwarding because the NAS makes an outbound connection to Synology and your client is introduced to it, so carrier-grade NAT does not block it. It tries a direct connection first, then NAT hole punching, then a relay server. Behind CGNAT you often land on the relay, which works but is the slow path and carries your traffic through Synology's infrastructure.

Should I port forward my Synology NAS to the internet?

No, and Synology's own guidance is to limit internet exposure of the NAS and restrict admin access. In 2026 alone, CVE-2026-13639 and CVE-2026-13684 were both rated CVSS 9.8 and let an unauthenticated attacker read and write arbitrary files, while CVE-2026-32746 allows unauthenticated remote command execution. A NAS is also usually the backup, so compromising it defeats the recovery plan that was meant to survive a compromise.

What ports does Synology DSM use and should I open them?

DSM serves its management interface on port 5000 for HTTP and 5001 for HTTPS. Do not open either to the internet: that interface is the administrative surface the recent unauthenticated vulnerabilities concern. Moving DSM to a non-standard port is not protection either, because scanners sweep the whole port range. If an external system must reach something on the NAS, publish that one service on its own port and leave DSM reachable only over your LAN or a private mesh.

Is QuickConnect slow?

It depends which of its three stages you get. A direct connection is as fast as connecting locally, NAT hole punching is close to port-forwarded speed, and the relay stage is the slow one because all traffic passes through a Synology server. Behind carrier-grade NAT the relay is a common outcome. That is fine for browsing files or checking on the system and poor for pulling a large restore.

Can I use Tailscale with a Synology NAS?

Yes. Tailscale is available as a package for DSM 7 from the Package Center. Your devices join a private network with the NAS, so DSM, SMB shares and Synology Photos are reachable as though you were at home while nothing is exposed to the public internet. For a household this is usually the best balance of speed and safety. It cannot help when someone outside your network, or an external service, needs to reach the NAS directly.

Guide

Synology NAS Remote Access Behind CGNAT

Do not put DSM on the public internet. Synology's own guidance is to limit internet exposure of the NAS and restrict admin access, and 2026 has given three separate reasons why: CVE-2026-13639 and CVE-2026-13684, both rated CVSS 9.8, let an unauthenticated attacker read and write arbitrary files, and CVE-2026-32746 allows unauthenticated remote command execution. A NAS is usually also the backup, so a compromise does not cost you one machine — it costs you the thing you were going to restore from. QuickConnect is free, built by Synology for exactly this, and works through carrier-grade NAT. Start there.

Option 1: QuickConnect, free and built for this

QuickConnect is Synology's own remote access and it needs no port forwarding, which is why carrier-grade NAT does not stop it: your NAS makes an outbound connection to Synology and your client is introduced to it.

It tries three things in order, and knowing which one you get explains the speed you see:

Direct. Your client asks Synology for the NAS's registered addresses and connects straight to it. On your own LAN this is as fast as typing the IP.
Hole punching. Each side opens a temporary port on its own NAT and Synology introduces them. Traffic then flows directly, at close to port-forwarded speed.
Relay. If neither works, everything goes through a Synology relay server. This is the slow one, and behind CGNAT it is often where you land.

That third stage is the honest caveat: it is free, but your traffic is passing through Synology's infrastructure and the throughput is theirs to shape. For browsing files and checking on things it is fine. For pulling a large restore over it, less so.

Option 2: Tailscale, if it is only you

Free at household scale, works through CGNAT, exposes nothing. Synology publishes Tailscale as a package for DSM 7, installable from the Package Center, which makes this considerably less fiddly than it used to be.

Your laptop and phone join a private network with the NAS. DSM, SMB shares, Synology Photos, all reachable as though you were at home, and none of it on the public internet. For a household this is the best combination of speed and safety on this page.

The limit is the usual one: only devices on your network can reach it. Sharing a folder with someone outside, or letting an external service pull from the NAS, needs something else.

Option 3: a public address — for a service, never for DSM

This is what we sell, so weigh it accordingly, and note that the advice narrows it rather than widening it.

There are real cases: a service on the NAS that external users or systems must reach directly, an offsite backup target another machine writes to, a self-hosted app on a port a relay will not carry.

Do not put DSM's management interface on that address. Ports 5000 and 5001 are DSM itself — the admin interface, the thing the CVEs above are about. Give the public address to the specific service, on its own port, and leave DSM reachable only over your LAN or your mesh.

curl -fsSL https://tunnelnet.io/install.sh | sudo bash
sudo tnet status

# the ONE service port, and no default protocol, deliberately --
# a UDP service with a TCP rule fails silently
sudo tnet ports allow tcp 8096          # e.g. a media server
sudo tnet ports mode                    # confirm what is open

# 5000 and 5001 are DSM. Do not open them.

If a container on the NAS can run the daemon instead of the NAS itself, better still: the blast radius of that container is smaller than the blast radius of DSM.

Why a NAS deserves more caution than a web server

Three things make it a worse thing to expose than almost anything else in a house:

It holds everything. Photos, documents, and often the only copies.
It is usually the backup. Compromising a backup target defeats the recovery plan that was supposed to survive the compromise. Ransomware crews know this, which is why storage appliances are targeted specifically rather than incidentally.
The vulnerabilities keep being unauthenticated ones. A flaw needing valid credentials is survivable behind a strong password. A flaw needing none is not, and 2026 produced several.

None of that means Synology builds bad hardware — it means a NAS is a high-value target and the honest posture is to keep its management surface off the public internet entirely.

If anything on it is reachable, harden first

Patch DSM, promptly. The CVEs above all have fixes. An unpatched NAS that is reachable is the specific combination that gets encrypted.
Disable the default admin account and use a named account instead. Synology recommend this and it removes the username half of every guess.
Turn on two-factor authentication for every account that can log in to DSM.
Enable auto-block and the DSM firewall to lock out repeated failures and restrict which sources can reach which services.
Do not use 5000 or 5001 externally, and do not simply move DSM to a different port and consider it hidden. Scanners sweep the full range.
Keep an offline or immutable backup copy. If the NAS is your only backup, you do not have a backup — you have a single point of failure with a RAID array in it.

Choosing, honestly

You want to reach your own files from outside? QuickConnect. Free, made for it, nothing to configure.
You want speed and privacy and it is only your devices? Tailscale, from the Package Center.
Something external must reach a service on the NAS? That is the case a routable address solves — pointed at the service, never at DSM.

Get a public IP — $10/mo See all plans

The plans for this

TunnelNet IP · $10/mo

A public IPv4 address of your own on a computer you run: Linux, Windows, or a Mac with Apple Silicon. People can reach it at that address. Everything except SSH stays closed until you open a port.

Buy TunnelNet IP →

TunnelNet Full · $20/mo

The same address, and your computer’s outgoing traffic leaves from it too. Today that works on Linux and iPhone; on Windows and Mac you get the address, but your traffic goes out through your own connection.

Buy TunnelNet Full →

If a free option above fits, use it. Our hubs are in Chicago and Newark, there is no protection from flood attacks (DDoS), and port 25 is blocked. All plans and prices.

Sources

Synology QuickConnect white paper (the three connection stages, no port forwarding)
Synology DSM advisory SA-26-13 (CVE-2026-13639 and CVE-2026-13684, CVSS 9.8, unauthenticated)
CVE-2026-32746 (unauthenticated remote command execution)