This package adds WireGuard support for Synology NAS drives. It provides the
WireGuard kernel module and the
You use everything here at your own risk. I am not responsible if this breaks your NAS. Realistically it should not result in data loss, but it could render your NAS unaccessible if something goes wrong.
If you are not comfortable with removing your drives from the NAS and manually recover the data, this might not be for you.
Dns = x.x.x.xsetting is unsupported. If you try it you will get the following message:
/usr/local/bin/wg-quick: line 31: resolvconf: command not found
wg-quick). Due to the system version of
being too old <https://lists.zx2c4.com/pipermail/wireguard/2018-April/002687.html>_. You'll get the error message
Error: argument "suppress_prefixlength" is wrong: Failed to parse rule type.
wg showbut no traffic is flowing through the tunnel. Apparently there is some kind of race when setting up the interface. The simplest known workaround is to append
; sleep 5; ip route add 10.0.0.0/16 dev wg0to the
PostUprule. This assumes that your WireGuard IP subnet is
issue #10 <https://github.com/runfalk/synology-wireguard/issues/10>_ for more information.
PRs that solve these issues are welcome.
All models marked Is working have been confirmed by users to work. If your model has the same platform as one of the working ones, chances are it will work for you too.
========= ========== =========== =========================== Model Platform DSM Version Is working?
DS1019+ apollolake 6.2 Yes DS114 armada370 N/A No (Kernel version too old) DS115j armada370 N/A No (Kernel version too old) DS116 armada38x 6.2 Yes DS1511+ x64 6.2 Yes DS1618+ denverton 6.2 Yes DS1817+ avoton 6.2 Yes DS1815+ avoton 6.2 Yes DS213j armada370 N/A No (Kernel version too old) DS213j armada370 N/A No (Kernel version too old) DS214play armada370 N/A No (Kernel version too old) DS214se armada370 N/A No (Kernel version too old) DS216+II braswell 6.2 Yes DS216se armada370 N/A No (Kernel version too old) DS216Play monaco 6.2 Yes DS218 rtd1296 6.2 Yes DS218+ apollolake 6.2 Yes DS218j armada38x 6.2 Yes DS220+ geminilake 6.2 Yes DS3617xs broadwell 6.2 Yes DS414slim armada370 N/A No (Kernel version too old) DS415+ avoton 6.2 Yes DS418play apollolake 6.2 Yes DS713+ cedarview 6.2 Yes DS716+II braswell 6.2 Yes DS718+ apollolake 6.2 Yes DS916+ braswell 6.2 Yes DS918+ apollolake 6.2 Yes RS214 armada370 N/A No (Kernel version too old) RS816 armada38x 6.2 Yes ========= ========== =========== ===========================
The minimum required kernel version is 3.10. If you have a kernel version lower
than that, WireGuard will not work. You can check your kernel version by
logging in through SSH and running the
uname -a command.
This project is also confirmed to be compatible with other brand NAS stations
========= ================ ========== =========== =========================== Model Hardware version Platform DSM Version Is working?
HP54NL DS3615xs bromolow 6.2 Yes ========= ================ ========== =========== ===========================
page for SPKs for your platform. If there is no SPK you have to compile it
yourself using the instructions below.
Now you just need to figure out how to configure WireGuard. There are lots of good guides on how to do that.
To put my WireGuard configuration on the NAS, I used SSH and created a
wg-quick configuration in
/etc/wireguard/wg0.conf. Then I opened the
Control panel, opened the Task scheduler and created Triggered task that
wg-quick up wg0 on startup.
iptables in the
PostDown rules I needed to
toggle the interface to make it work. My full startup task looks like this:
.. code-block:: bash
sleep 60 wg-quick up wg0 sleep 5 wg-quick down wg0 sleep 5 wg-quick up wg0
/etc/wireguard/wg0.conf looks like this:
[Interface] Address = 10.0.1.1/16 PrivateKey = <nas-private-key> ListenPort = 16666 PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE [Peer] PublicKey = <peer-public-key> AllowedIPs = 10.0.1.2/32
Note that you need to modify the rules if your network interface is not
eth0. You can check which name your interface has by running
ip a in an
I've used docker to compile everything, as
pkgscripts-ng clutters the file
system quite a bit. First create a docker image by running the following
command in this repository:
.. code-block:: bash
git clone https://github.com/runfalk/synology-wireguard.git cd synology-wireguard/ sudo docker build -t synobuild .
Now we can build for any platform and DSM version using:
.. code-block:: bash
sudo docker run --rm --privileged --env PACKAGE_ARCH=<arch> --env DSM_VER=<dsm-ver> -v $(pwd)/artifacts:/result_spk synobuild
You should replace
<arch> with your NAS's package arch. Using
this table <https://www.synology.com/en-global/knowledgebase/DSM/tutorial/General/What_kind_of_CPU_does_my_NAS_have>_
you can figure out which one to use. Note that the package arch must be
<dsm-ver> should be replaced with the version of DSM you are
For the DS218j that I have, the complete command looks like this:
.. code-block:: bash
sudo docker run --rm --privileged --env PACKAGE_ARCH=armada38x --env DSM_VER=6.2 -v $(pwd)/artifacts:/result_spk synobuild
If everything worked you should have a directory called
contains your SPK files.
It can take a long time to pull development files from SourceForge, including
occasional timeouts. To get around this, create a folder locally and map it to
/toolkit_tarballs Docker volume using the following command:
docker run command listed above. This will allow the development files
to be stored on your host machine instead of ephemerally in the container. The
image will check for existing development files in that folder and will use
them instead of pulling them from SourceForge when possible. You can also
download the files directly and put them in the folder you created by downloading
them from here: https://sourceforge.net/projects/dsgpl/files/toolkit/DSM<DSM_VER>
I based a lot of this work on
this guide <https://www.reddit.com/r/synology/comments/a2erre/guide_intermediate_how_to_install_wireguard_vpn/>_
by Reddit user
akhener <https://www.reddit.com/user/akhener>_. However, I had
to modify their instructions a lot since my NAS has an ARM CPU which made cross
compilation a lot trickier.
galaxysd <https://github.com/galaxysd>_ made
a guide <https://galaxysd.github.io/linux/20170804/2017-08-04-iptables-on-Synology-DSM-6>_
on how to enable iptables NAT support.