🗄️

Synology NAS WireGuard Setup Guide

Manual gateway Works as a gateway for one LAN with no extra steps. Extra VLANs need a few rules added on the device by hand, explained below.

Synology DSM does not include WireGuard natively. You need to install a community package matching your DSM version and CPU architecture, then load the kernel module manually. Tested on DS220+ / DSM 7.1.

Find the right WireGuard package for your NAS

Download the community WireGuard package from github.com/runfalk/synology-wireguard — pick the .spk matching your DSM version and CPU platform:

DS220+, DS920+ (J4025/J4125) → geminilake
DS218+, DS718+ (J3355/J3455) → apollolake
DS1821+, DS1621+ (Ryzen V1500B) → v1000
DS923+, DS723+ (Ryzen R1600) → r1000

Example for DS220+ on DSM 7.1: WireGuard-geminilake-1.0.20220627_DSM7.1.spk

Not sure of your platform? Check Control Panel → Info Center → CPU.

Install the package

In DSM go to Package Center → Manual Install and upload the .spk file. If it shows Repair instead of Install (from a previous attempt), click Repair — it reinstalls cleanly.

DSM may warn about an unsigned package — click Continue.

Load the WireGuard kernel module

The package does not load the module automatically. SSH into the NAS and run:

sudo insmod /volume1/@appstore/WireGuard/wireguard/wireguard.ko

Verify it loaded:

lsmod | grep wireguard

You should see wireguard listed. If not, find the module path with:

find / -name "wireguard.ko" 2>/dev/null

Create a tunnel in ProxyLink

Go to Devices → + Add → Router / LAN site, select Public Server / Device (not Router / Gateway, because the NAS connects directly), and complete setup to download your .conf file.

Prepare and copy the config

Enable SSH in Control Panel → Terminal & SNMP if not already on. Copy the config to the NAS:

scp proxylink.conf [email protected]:/tmp/wg0.conf

SSH in, then move it into place:

sudo mkdir -p /etc/wireguard
sudo cp /tmp/wg0.conf /etc/wireguard/wg0.conf

Remove the Address line from the config — wg setconf does not accept it (it is set separately via ip addr):

sudo sed -i '/^Address/d' /etc/wireguard/wg0.conf

Bring up the tunnel

The wg binary is not in PATH on Synology — use the full path:

sudo ip link add dev wg0 type wireguard
sudo /volume1/@appstore/WireGuard/wireguard/wg setconf wg0 /etc/wireguard/wg0.conf
sudo ip addr add <your-vpn-ip>/16 dev wg0
sudo ip link set wg0 up

Replace <your-vpn-ip> with the Address from your config (e.g. 10.100.0.5).

Verify the tunnel is connected:

sudo /volume1/@appstore/WireGuard/wireguard/wg show

You should see a latest handshake a few seconds ago and bytes transferred.

Auto-start on boot

Go to Control Panel → Task Scheduler → Create → Triggered Task → Boot-up and add a script running as root:

sudo insmod /volume1/@appstore/WireGuard/wireguard/wireguard.ko
sudo ip link add dev wg0 type wireguard
sudo /volume1/@appstore/WireGuard/wireguard/wg setconf wg0 /etc/wireguard/wg0.conf
sudo ip addr add <your-vpn-ip>/16 dev wg0
sudo ip link set wg0 up

Create a proxy link

In ProxyLink go to your device → + Add service. Set the target to your NAS's VPN IP and the port of whatever service you're running (e.g. a Docker container). Once the NAS connects you'll see it go Online on the Devices list.

Good to know

The Address line in the ProxyLink config must be removed before running wg setconf — use "sudo sed -i '/^Address/d' /etc/wireguard/wg0.conf".

Do not add a DNS line to the config — Synology's iproute2 does not support it and will fail.

The community WireGuard package must be reinstalled after every major DSM update (e.g. 7.1 → 7.2). The kernel module gets wiped during upgrades.

The wg binary is not in PATH on Synology. Always use the full path: /volume1/@appstore/WireGuard/wireguard/wg

DSM's own web interface works through ProxyLink on port 5001 (HTTPS). Port 5001 is one of the ports we terminate SSL on, so the browser gets a valid certificate instead of a warning. Use a TCP link on 5001 rather than the plain-HTTP 5000.

Reaching more than one VLAN

One LAN needs nothing beyond this guide. If the site has several VLANs (a camera VLAN, a PBX VLAN, a guest network), there is one more thing to know.

ProxyLink gives every gateway its own private address range and translates between that range and your real LAN addresses. That is what lets two different clients both use 192.168.1.0/24 without colliding. The translation rules live in the PostUp and PostDown lines of the config we generate.

Synology NAS cannot run those rules for itself, so extra VLANs are routed directly instead of being translated. Two consequences worth knowing:

Add the VLAN under your gateway → VLAN subnets as normal, then add the equivalent forwarding rules for that VLAN on the device yourself.
Because the range is not translated, ProxyLink checks it does not collide with another customer's. A very common range that is already in use elsewhere may be refused.

If a site has several VLANs and you would rather not maintain that by hand, put a small Linux box (a Raspberry Pi is plenty) or a MikroTik beside the router and use it as the gateway. Both are managed, so every VLAN is handled automatically and the existing router is left alone. See the Linux and MikroTik guides.

What you get once the tunnel is up

Browser RDP, VNC, and SSH — open a terminal or remote desktop to any device behind the tunnel straight from the ProxyLink dashboard. No client software, no open ports on your side.
Proxy links — share an HTTPS URL that forwards to any internal web interface (NAS, NVR cameras, PBX admin panels, router UIs) with ProxyLink login in front of it.
No public exposure — the device keeps zero open ports and needs no static IP. The tunnel is outbound-only WireGuard to EU-hosted infrastructure. Read more about agentless remote access and NIS2 compliance.

Ready to connect?

Create a free account and set up your first tunnel in minutes. Free during early access — no card required.

Start free → Other platforms

Setup guides for other platforms

🐧Linux Server 🪟Windows 🍎macOS 🤖Android 📱iPhone / iPad 🔧OpenWrt 🌐GL.iNet 📡Asus Merlin ⚙️MikroTik RouterOS 7 📶TP-Link 🛡️OPNsense 🔒pfSense 🔵Ubiquiti UniFi Gateway 🔷Ubiquiti EdgeRouter 📻Netgear 🔌Zyxel