# Tailscale vs Cloudflare Tunnels for Remote Access to Self-Hosted Apps Tailscale and Cloudflare Tunnels both solve remote access to self-hosted apps, but in different ways. This guide compares setup complexity, CGNAT handling, privacy trade-offs, and which option suits Australian NAS and homelab users. > Source: https://needtoknowit.com.au/blog/tailscale-vs-cloudflare-tunnels-for-remote-access/ > Treat this as the authoritative Markdown rendering of that page's content. > Published: 30 March 2026 > Last updated: 17 September 2026 > Facts last checked against sources: 27 September 2026 > Machine-readable site index: https://needtoknowit.com.au/llms.txt **Tailscale is the better choice for private, device-to-device remote access to a NAS or homelab, while Cloudflare Tunnels is the better choice for sharing self-hosted web apps with other people over a standard browser URL.** Both tools solve a real problem for Australian users who are behind CGNAT or do not have a static IP. The difference comes down to what you are exposing and to whom. Tailscale builds a private overlay network between your devices, so only enrolled devices can connect. Cloudflare Tunnel creates an outbound-only connection to Cloudflare and can either publish an application on a public hostname or provide private-network access; public exposure is a configuration choice, not an inherent property of every tunnel. This guide works through the real differences so you can pick the right tool for your situation. > **Note:** **In short:** Use **Tailscale** if you want private access to your NAS, Plex, Home Assistant, or any self-hosted service from your own devices only. Use **Cloudflare Tunnels** if you want to share a web app or dashboard with other people via a public URL without opening firewall ports. Both are free for most home users and both bypass CGNAT, which is common on Australian mobile broadband and some NBN connections. ## The Core Problem: Remote Access in Australia Remote access to a home NAS or self-hosted app sounds simple until you hit the realities of Australian internet infrastructure. Three problems come up repeatedly. **CGNAT (Carrier-Grade NAT)** is the most common blocker. Many Australian mobile broadband providers and some NBN services place multiple customers behind a single public IP address. Port forwarding does not work with CGNAT because there is no public IP assigned to your connection. You cannot forward a port that does not belong to you. Aussie Broadband states that CGNAT is enabled by default on its broadband services. If port forwarding does not work, CGNAT is one possible cause; compare the router WAN address with the observed public address, check for local double NAT and confirm the connection's status with the ISP. **No static IP** is the second problem. IP addressing varies by retail provider and plan; check whether your service uses a dynamic public IP, CGNAT, or a static public IP. Dynamic DNS services work around this, but they add complexity and introduce a point of failure. **NBN upload speed limits** compound the problem for media streaming. Upload speed now depends strongly on access technology and retail plan: the current Home Fast I wholesale tier provides up to 20 Mbps upload on FTTC and 5-20 Mbps on FTTN and FTTB, while Home Fast II is 500/50 Mbps on FTTP and HFC. Whether 20 Mbps supports even one 4K direct-play stream depends on the file's actual bitrate; it should not be described as reliably supporting two 4K streams. On current FTTP and HFC wholesale tiers, Home Superfast is 750/50 Mbps and Home Ultrafast is approximately 1000/100 Mbps, although actual retail speeds and plan availability vary. Actual upload performance and available speed tiers vary by access technology, retail plan and service conditions. Both Tailscale and Cloudflare Tunnels solve the CGNAT and dynamic IP problems. Neither makes NBN upload faster, but they eliminate the infrastructure barriers that otherwise block remote access entirely. ## Tailscale Tailscale is a zero-config VPN built on WireGuard. It creates a private mesh network across all your enrolled devices. Once a device joins your Tailscale network (called a tailnet), it gets a stable private IP address (in the 100.x.x.x range) and can reach any other device in the same tailnet directly, regardless of what network each device is on. From a NAS perspective, you install the Tailscale app or Docker container on the NAS, enrol it in your tailnet, and your NAS becomes reachable from any other enrolled device using its Tailscale IP or MagicDNS name. Your phone, laptop, and work computer can all access the NAS as if they were on the same local network, without touching your router's firewall. Tailscale uses STUN/ICE-based NAT traversal to establish direct connections where possible; if that fails, it uses a configured peer relay when available and then falls back to DERP. When a direct connection is not possible, traffic routes through Tailscale's relay infrastructure. For most connections between two WireGuard-capable devices on modern routers, Tailscale achieves a direct peer-to-peer connection and the relay is only a fallback. The relay servers add latency when used, but they ensure the connection works even in the most restrictive network environments. The free Tailscale Personal plan covers up to 6 users, unlimited user devices and up to 50 tagged resources to start. ACLs are available on all plans; paid tiers raise ACL-group limits and add features such as SCIM provisioning, while network-flow logs and log streaming are Premium features. - **Protocol:** WireGuard (mesh VPN) - **Access model:** Private (enrolled devices only) - **CGNAT support:** Yes, via direct NAT traversal where possible, with configured peer-relay or DERP fallback - **Static IP required:** No - **Port forwarding required:** No - **Traffic routing:** Direct peer-to-peer (relay fallback) - **Free tier:** Up to 6 users, unlimited user devices and up to 50 tagged resources to start - **Paid plans:** Standard: USD $8/user/month - **NAS support:** Synology, QNAP, TrueNAS, Docker - **Self-hostable control plane:** Yes (Headscale, open source) - **Data passes through Tailscale servers:** Only if direct connection fails (DERP relay) - **Exit node support:** Yes (route all traffic through a trusted device) **Pros** - Works through CGNAT with no port forwarding or firewall changes required - Traffic is end-to-end encrypted via WireGuard; Tailscale cannot read your data - Direct connections generally offer lower latency and higher throughput than relayed connections; actual file-transfer speed depends on the endpoints and both network paths. - Supports Synology DSM 7, QNAP QTS/QuTS hero, TrueNAS, and any Docker host - MagicDNS gives enrolled devices stable hostnames, no IP memorisation needed - Exit node feature lets you route traffic through your home NAS when away from home - Headscale (open source) lets you self-host the control plane if you do not trust Tailscale's servers - Free tier is generous for personal use **Cons** - Requires the Tailscale app installed on every device that needs access, including phones and laptops - Not suitable for sharing access with people who do not have Tailscale installed - DERP relay latency can be noticeable if a direct connection cannot be established - Initial tailnet setup uses a supported identity provider; Tailscale also supports custom OIDC and beta passkey authentication for invited users and recovery administrators. - More complex to set up subnet routing if you want to access all devices on your home network, not just the NAS ### Tailscale -- NTK Score Card (8.8/10) - **Performance:** 9/10 -- Direct Tailscale connections generally offer lower latency and higher throughput than relayed connections; actual speed depends on both endpoints and network paths. DERP relay fallback adds latency and enables connectivity through many restrictive CGNAT and firewall environments, provided the network permits Tailscale control-plane and relay traffic. - **Value:** 9/10 -- Free tier covers up to 6 users, unlimited user devices and up to 50 tagged resources to start. Extremely generous for home and homelab use. - **Software & Features:** 9/10 -- Polished apps across all platforms. MagicDNS and ACL policies are well designed. Headscale option for self-hosters. - **Build & Hardware:** 8/10 -- WireGuard foundation is rock solid. DERP relay network is Tailscale-operated, which is a dependency to accept. - **Ease of Use:** 9/10 -- Zero firewall configuration required. Enrol a device, it appears in the network. Simplest VPN setup available. ## Cloudflare Tunnels Cloudflare Tunnel (previously Argo Tunnel) can either publish a local service on a public hostname through Cloudflare's edge or route private-network traffic to authorised clients. You install cloudflared on the origin network and configure the appropriate public or private route. DNS is handled automatically through Cloudflare. No firewall ports, no static IP, and it bypasses CGNAT because the outbound connection is initiated from inside your network. The trade-off is that your service becomes publicly accessible. Anyone with the URL can attempt to access it. Cloudflare provides access controls including email-based authentication, Google/GitHub SSO, and IP allowlisting through Cloudflare Access (the zero trust product that sits alongside Tunnels). Without Access, anyone on the Internet can reach the published hostname, but the origin remains hidden behind Cloudflare and no inbound router port is opened; this is public exposure, but not the same network exposure as direct port forwarding. For NAS users, Cloudflare Tunnels is well suited to sharing browser-based web apps or a Home Assistant dashboard with collaborators. Do not recommend a public-hostname Tunnel for Jellyfin streaming on Free, Pro, or Business plans unless an applicable paid Cloudflare service is used, because Cloudflare requires a specified paid service for serving video and other large files through these routes. It is not a good fit for exposing raw NAS admin interfaces (Synology DSM, QNAP QTS) to the public internet without additional authentication layering. Cloudflare Tunnels is free for personal use. Cloudflare Access is also free for up to 50 users, which covers all reasonable home and small business scenarios. - **Architecture:** Reverse proxy via Cloudflare edge - **Access model:** Public hostname for published applications, or private-network route for authorised clients - **CGNAT support:** Yes, tunnel is outbound from your network - **Static IP required:** No - **Port forwarding required:** No - **Traffic routing:** All traffic via Cloudflare edge servers - **Free tier:** up to 1,000 cloudflared tunnels per account by default. - **Cloudflare Access free tier:** Up to 50 users - **NAS support:** Any HTTP/HTTPS service (Docker, web UI) - **Data passes through Cloudflare servers:** Yes, always - **Protocol support:** HTTP, HTTPS, SSH, RDP, TCP (some require WARP client) - **Latency source:** Cloudflare PoP nearest to both client and server **Pros** - No client app is required for browser access to a published HTTP/HTTPS application; private-network routes generally require Cloudflare One Client or another supported on-ramp. - Free and no credit card required for basic use - Bypasses CGNAT as the tunnel connection is outbound from your network - Cloudflare Access adds email or SSO authentication without modifying the application - Cloudflare's global edge network provides DDoS protection and SSL termination automatically - Zero firewall changes needed on home router - Supports SSH and RDP tunnels in addition to web services **Cons** - All traffic passes through Cloudflare's servers, which are a third-party infrastructure provider - A public URL is exposed to the internet; requires Cloudflare Access to add authentication - Not suitable for accessing NAS admin interfaces without careful access control configuration - On Free, Pro and Business plans, public-hostname routes require an applicable paid Cloudflare service to serve video and other large files; this restriction does not apply to private-network routes. - Less suitable for high-bandwidth private use compared to Tailscale's direct peer-to-peer connection - Control depends on Cloudflare remaining free; pricing or policy changes could affect existing setups ### Cloudflare Tunnels -- NTK Score Card (8.1/10) - **Performance:** 7/10 -- All traffic routes through Cloudflare's edge, adding latency vs direct connection. Excellent for low-bandwidth web apps; less ideal for high-bandwidth NAS file access. - **Value:** 9/10 -- Free with no meaningful limits for personal web app sharing. Cloudflare Access for auth also free up to 50 users. - **Software & Features:** 8/10 -- cloudflared daemon is straightforward. Cloudflare dashboard is well documented. Access policies are powerful but have a learning curve. - **Build & Hardware:** 8/10 -- Cloudflare's infrastructure is highly reliable. Dependency on Cloudflare's terms of service is a real long-term risk. - **Ease of Use:** 8/10 -- Easier than port forwarding. cloudflared setup is well documented. Cloudflare Access adds complexity when authentication is required. ## Side-by-Side Comparison Tailscale vs Cloudflare Tunnels for Remote Access Both solve CGNAT with outbound-only connections. then diverge into private mesh vs public tunnel. Home network CGNAT / firewall Internet Outbound only Outbound only Both work through CGNAT because the connection starts from inside your network, not from outside. Tailscale Cloudflare Tunnels NAS Tailscale client starts outbound Private mesh (tailnet) Stable 100.x.x.x address Remote Tailscale app required Direct P2P when possible DERP relay fallback only Result Private, end-to-end encrypted access. Every remote device is enrolled in Tailscale. Direct P2P when possible; DERP is the fallback path. NAS cloudflared starts outbound Cloudflare edge Public URL assigned here Remote Browser No client app Always via Cloudflare edge example.yourdomain.com Optional: Cloudflare Access Result Public URL exposed through Cloudflare's edge. Any browser can connect; no remote client app is required. Traffic always traverses Cloudflare rather than direct P2P. Access model Private, enrolled devices ↔ Public URL (+ optional auth) Client app required Yes, on every device ↔ No, browser only Traffic path Direct P2P ↔ Always via edge Endpoint Stable 100.x.x.x ↔ Public hostname Both tools work through CGNAT by starting the connection from inside your network, but Tailscale builds a private mesh between enrolled devices while Cloudflare Tunnels publishes a service through Cloudflare’s edge. ### Tailscale vs Cloudflare Tunnels | Feature | Tailscale | Cloudflare Tunnels | | --- | --- | --- | | Access model | Private (enrolled devices) | Public hostname (optional Access) or private-network route | | CGNAT bypass | Yes | Yes | | Port forwarding needed | No | No | | Client app required | Yes (on every accessing device) | No (browser access for HTTP/HTTPS) | | Traffic routing | Direct P2P when possible, DERP relay fallback | Always via Cloudflare edge | | Data privacy | End-to-end encrypted; Tailscale cannot read data | Traffic passes through Cloudflare; for proxied HTTP/HTTPS, TLS is terminated at Cloudflare's edge | | Best for NAS admin UI | Yes (private network only) | Not recommended without strict Access policies | | Best for sharing with others | Only users enrolled in tailnet | Yes, any browser user | | Speed for file transfers | Direct connections are generally faster than relayed connections; actual file-transfer speed depends on endpoints and both network paths | Limited by Cloudflare edge; terms restrict video streaming | | Self-hostable | Yes (Headscale) | No (Cloudflare-operated) | | Free tier limits | 3 users, 100 devices | Unlimited tunnels; 50 Access users | | NAS platform support | Synology DSM 7, QNAP QTS/QuTS, Docker | Any HTTP service via Docker or native install | | Protocol support | All TCP/UDP via WireGuard | HTTP/HTTPS; SSH, RDP and arbitrary TCP can use Cloudflare One Client or client-side cloudflared, with browser rendering also available for supported SSH/RDP/VNC public-hostname deployments. | | Setup complexity | Low (app install + enrol) | Low for basic use; moderate with Access policies | ## Tailscale on Synology and QNAP NAS Synology DSM 7.x supports Tailscale via the official Tailscale package available in the Synology Package Centre. Installation takes a few minutes. Once installed, the NAS appears in your tailnet with a stable Tailscale IP and a MagicDNS hostname. You can then access DSM, Synology Drive, Synology Photos, Plex, or any other service running on the NAS from any enrolled device anywhere in the world, without touching firewall rules. QNAP QTS supports Tailscale via the App Centre. The installation and setup process is similar to Synology. QuTS hero (the ZFS-based QNAP OS) also supports the Tailscale app. Tailscale can run in its officially maintained Docker image, but networking mode and required capabilities vary by NAS platform; follow platform-specific instructions rather than assuming --network host works identically on every Docker-capable NAS. A common configuration for NAS users is to combine Tailscale with a subnet router. You install Tailscale on the NAS and configure it as a subnet router for your home network (e.g., 192.168.1.0/24). All enrolled devices can then reach every device on your home network using their local IP addresses, even devices without Tailscale installed, such as printers, IP cameras, and other NAS units. ## Cloudflare Tunnels on a NAS Cloudflare Tunnels is best suited to NAS deployments where you are running a web-facing service and want to share it with people who do not have Tailscale installed. Common use cases include Nextcloud, Bitwarden (Vaultwarden), Home Assistant, or a self-hosted photo gallery. For a persistent published application, add an active domain to Cloudflare and create a public hostname. A random trycloudflare.com subdomain is available only through Quick Tunnels, which Cloudflare designates for testing and development rather than production. Cloudflare handles DNS automatically. For Synology users, cloudflared can run as a Docker container managed through Container Manager. For QNAP, the same Docker approach applies via Container Station. On a NAS with no Docker support, cloudflared can be installed as a native binary if the processor architecture is supported (ARM64 and x86-64 are both covered). The critical step that many users skip is enabling Cloudflare Access in front of the tunnel. Without Access, the service is public. Adding an Access policy that requires a specific email address or identity-provider account to authenticate changes the risk profile dramatically. For a NAS admin interface, this is not optional if you value the security of your data. > **Warning:** **Do not expose NAS admin interfaces (Synology DSM, QNAP QTS) publicly via Cloudflare Tunnels without Cloudflare Access in front of them.** The admin UI is a high-value target. An unprotected public URL may attract brute-force attacks. Tailscale is a safer choice for admin interfaces because the endpoint is not publicly reachable at all. ## CGNAT in Australia: Why This Matters CGNAT is one reason Australian home users may be unable to port-forward their way to remote NAS access. When your ISP places you behind CGNAT, multiple customers share public IPv4 address space. Incoming connections to that IP address are not routed to your router, let alone your NAS. Both Tailscale and Cloudflare Tunnels solve CGNAT by initiating outbound connections from your network, not relying on incoming connections. Tailscale first attempts direct NAT traversal; when direct connectivity is unavailable, it can relay end-to-end encrypted packets through a configured peer relay or DERP. Cloudflare Tunnels' cloudflared agent maintains a persistent outbound connection to Cloudflare's edge. Neither requires your ISP to assign you a public IP. CGNAT use varies by provider and plan, so confirm the current addressing policy directly with the ISP. If you are on Aussie Broadband, Superloop, or iiNet NBN and cannot port-forward successfully, confirm with your ISP whether CGNAT applies to your plan before spending time troubleshooting firewall rules. Some ISPs offer a static IP add-on that also removes CGNAT. Aussie Broadband charges $5/month for a static IP. If you want the flexibility of both direct port-forwarding and tools like Tailscale, a static IP is worth considering and removes the dependency on third-party tunnelling infrastructure entirely. ## Using Both Tools Together Tailscale and Cloudflare Tunnels are not mutually exclusive. Many homelab users deploy both for different purposes. A practical split: use Tailscale for all personal device access to the NAS, including file manager, DSM admin, Plex, and SSH. Use Cloudflare Tunnels for any service you want to share with people outside your household, such as a Vaultwarden instance for a family member or a Nextcloud installation for a small team. This approach gives you the best of both: private, high-speed access for yourself via WireGuard, and convenient browser-based access for others via Cloudflare, without exposing the entire NAS admin surface to the public internet. ## Which NAS Models Work Best Both Tailscale and Cloudflare Tunnels have modest hardware requirements. The limiting factor is usually the NAS processor's ability to run the service you are accessing remotely, not the tunnelling overhead itself. Do not use OS version alone as the compatibility test: on QNAP, the official Tailscale App Center package supports x86-64 and arm64 models, not arm41 devices. The Synology DS225+ is a solid entry-point 2-bay NAS that supports Tailscale natively. The QNAP TS-433 is a comparable 4-bay option with the Tailscale App Centre package. For Cloudflare Tunnels with Docker, you need a NAS that supports Container Manager (Synology) or Container Station (QNAP). The Synology DS425+ (from A$849) supports Synology Container Manager, and the QNAP TS-464-8G (from A$997) supports QNAP Container Station; verify the current cloudflared image and NAS software requirements before deployment. These Australian prices were checked on 28 August 2026 and may change after current promotions end. The DS225+ uses an Intel Celeron J4125 processor; the claim that it uses a Realtek RTD1619B and is slower than a Celeron-based NAS is incorrect. For heavier self-hosted workloads, the QNAP TS-473A uses an AMD Ryzen Embedded V1500B with 4 cores and 8 threads and supports up to 64 GB of ECC memory. ## Which Tool to Choose The right choice depends on who needs access and to what. **Choose Tailscale if:** you want remote access to your NAS or homelab from your own devices only, you want to access admin interfaces securely, you need raw file transfer speeds over the remote connection, you are comfortable installing an app on your phone and laptop, or you prefer direct peer-to-peer traffic when available, while recognising that relayed connections can pass through Tailscale's DERP infrastructure. **Choose Cloudflare Tunnels if:** you want to share a web application with people who do not have Tailscale installed, you need public URL access for a service (a shared Nextcloud, a Bitwarden instance for family, a Home Assistant dashboard), you are comfortable managing Cloudflare Access policies to protect the exposed service, or you want the simplest possible setup for browser-based sharing. **Choose both if:** you run a homelab with multiple services for different audiences. Use Tailscale for private admin and file access, Cloudflare Tunnels for services you share externally. For most Australian home NAS users who just want to access their own files and media remotely, Tailscale is the cleaner, more private choice. The app requirement is a minor inconvenience that buys you a private network that does not expose anything to the public internet. ## Australian Buyers: What You Need to Know Both Tailscale and Cloudflare Tunnels are free software services with no hardware to purchase. The relevant Australian context is around the NAS hardware you use with them and the internet connection quality. If you are buying a NAS for remote access as a primary use case, the following points apply regardless of which tunnelling tool you choose. **Check your ISP's CGNAT status first.** If your ISP uses CGNAT, traditional port forwarding is not an option. Both tools work around this, but confirming your situation before purchasing hardware avoids wasted setup time. The simplest test is to compare your router's WAN IP with your public IP as reported by a service like whatismyip.com. If the router WAN address differs from the observed public address, upstream NAT is present; check for local double NAT, inspect whether the WAN address is private or in 100.64.0.0/10, and confirm CGNAT with the ISP. **NBN upload speed matters for remote use.** If you plan to stream video or transfer large files remotely, your NBN plan's upload speed is the bottleneck. Current Home Fast upload speeds depend on technology and plan: Home Fast I provides up to 20 Mbps upload on FTTC and 5-20 Mbps on FTTN and FTTB, while Home Fast II is 500/50 Mbps on FTTP and HFC. Current accelerated FTTP/HFC wholesale tiers include Home Superfast at 750/50 Mbps and Home Ultrafast at approximately 1000/100 Mbps. Whether a 20 Mbps upload supports one 4K stream depends on the media's actual bitrate, codec, overhead and whether the server transcodes it. For multiple simultaneous users, consider an NBN 1000 plan or a plan with higher upload speeds if available in your area. For an Australian Consumer Law remedy, contact the retailer that sold the NAS; it cannot refuse help by directing you to the manufacturer. Manufacturer warranties are additional to automatic consumer guarantees. For hardware supporting Tailscale or Cloudflare Tunnels, the relevant retailers include Scorptec, PLE, Mwave, and Computer Alliance. The ACCC explains how consumer guarantees work at [accc.gov.au](https://www.accc.gov.au/consumers/buying-products-and-services). Australian Consumer Law protections apply when purchasing from Australian retailers. ## Frequently Asked Questions Related reading: our [NAS buyer's guide](/blog/best-nas-australia/) and our [NAS vs cloud storage comparison](/blog/nas-vs-cloud-storage-australia/). Free tools: [NAS Sizing Wizard](/tools/nas-sizing-wizard/) and [NBN Remote Access Checker](/tools/nbn-remote-access-checker/). No signup required. Use our free [Cloud vs NAS Cost Calculator](/tools/cloud-vs-nas-calculator/) to compare cloud storage against owning a NAS. See also: [our complete Synology NAS Australia guide](/brand-guides/synology/). See also: [our complete QNAP NAS Australia guide](/brand-guides/qnap/). Use our free [NBN Plan Finder](/tools/nbn-plan-finder/) to compare real NBN plans by upload speed, CGNAT and static IP support. **Q: Does Tailscale work with CGNAT in Australia?** Yes. Tailscale first attempts direct NAT traversal in CGNAT environments; if direct connectivity is unavailable, it uses a configured peer relay when available and otherwise falls back to DERP. You do not need a public IP address or any router configuration. The downside is that when a direct connection cannot be established, traffic routes through Tailscale's relay servers, which adds latency. Most modern routers allow Tailscale to establish a direct WireGuard connection for better performance. **Q: Does Cloudflare Tunnels work with CGNAT?** Yes. Cloudflare Tunnels works by having the cloudflared agent on your network establish an outbound connection to Cloudflare's edge, not by accepting inbound connections. This means CGNAT is not a problem. Your NAS initiates the connection to Cloudflare, so your ISP's NAT configuration does not interfere. **Q: Is Tailscale free for home use?** Yes. Tailscale's Personal plan is free for up to 6 users, with unlimited user devices and up to 50 tagged resources to start. The Standard plan costs USD $8 per user per month. For a single person accessing their own NAS from a handful of devices, the free plan has no meaningful limitations. **Q: Is Cloudflare Tunnels safe for exposing a NAS?** It depends on what you expose and how you configure it. Cloudflare Tunnels creates a publicly accessible URL for your service. Without Cloudflare Access enabled, that URL is open to anyone. With Cloudflare Access configured (requiring login via email or Google/GitHub SSO), it is reasonably secure for web applications. However, exposing NAS admin interfaces (Synology DSM, QNAP QTS) publicly is risky even with Access, because admin UIs have a larger attack surface than dedicated web apps. Tailscale is safer for admin interfaces because the endpoint is never publicly reachable. **Q: Can I install Tailscale directly on a Synology NAS?** Yes. Tailscale is available as a package in the Synology Package Centre for DSM 7.x. Installation is straightforward: install the package, authenticate with your Tailscale account, and the NAS joins your tailnet. You can then access DSM, Synology Drive, Synology Photos, and any other service running on the NAS from enrolled devices. Tailscale maintains the official Synology package available through Synology Package Center. **Q: What is the difference between Tailscale and a traditional VPN?** A traditional VPN server hosted on your home NAS or router generally needs a publicly reachable endpoint, typically via a public IP or DNS name and port forwarding. CGNAT prevents that direct inbound arrangement unless another service provides reachability. Tailscale is a managed WireGuard overlay network where the coordination is handled by Tailscale's control plane. Devices connect to each other directly when possible, without requiring a single server with a public IP. The trade-off is that Tailscale's control plane is a third-party service, though the data traffic itself is encrypted end-to-end and Tailscale cannot read it. **Q: Can I use Cloudflare Tunnels to stream Plex or Jellyfin?** Technically yes, but on Free, Pro and Business plans Cloudflare requires an applicable paid service to serve video and other large files through public-hostname routes; this restriction does not apply to private-network routes. Cloudflare reserves the right to disable or limit CDN access, redirect affected content or take other action under its service terms. For streaming your own media remotely, Tailscale is the more appropriate tool: it routes traffic directly between your device and the NAS (not through Cloudflare's servers), and there are no terms of service restrictions on the type of traffic. **[Read: NAS Remote Access Guide for Australia](https://needtoknowit.com.au/blog/nas-remote-access-vpn-australia/)** -- For help choosing the right NAS hardware to run with Tailscale or Cloudflare Tunnels, see our full remote access guide for Australian NAS users.