Tailscale on Synology DSM 6 – Fix Install Error 290 and SSH In from Anywhere

Tailscale’s official DSM 6 package (SPK) works on Synology DSM 6.2, and with it I can SSH into my home NAS from the office without opening a single router port. The catch: the DSM 6 package isn’t signed by Synology, so if Package Center’s trust level is set to “Synology Inc.”, installation fails with error 290. I switched the trust level to “Any publisher” just for the install, then set it back.

At a glance

Goal: SSH into the NAS from outside the house, without exposing port 22 to the internet
Package: download the DSM 6 SPK from pkgs.tailscale.com (it isn’t in DSM 6’s Package Center)
Problem 1: sudo synopkg → command not found. Fixed by using the full path /usr/syno/bin/synopkg
Problem 2: install error 290. Fixed by setting the Package Center trust level to “Any publisher”, then back after installing
Sign-in: open the link tailscale up prints, then disable key expiry for the NAS in the admin console
Result: with the Tailscale app on my Mac signed in to the same account, SSH works: 4 ms at home, 34 ms from the office over a direct connection

Port 22 stays closed on the router; only my own devices get an encrypted connection

Why Tailscale

My blog runs on a Synology NAS at home, so I SSH into it a lot to change settings or run backups. But SSH only worked inside my home network, so from the office I couldn’t do anything.

Forwarding port 22 on the router would be the easy way, and I didn’t want to do it. A NAS that faces the internet gets login attempts nonstop: my NAS’s auto-block list collected more than 17,000 IP addresses over two years. There was no reason to add SSH to that.

Option	Open a port?	Notes
Router port forwarding (22)	Yes	Easiest, but SSH is exposed to the whole internet
DSM VPN Server (OpenVPN etc.)	Yes (VPN port)	More setup, and the VPN port is exposed
Tailscale	No	Only devices on my account can connect. Free for personal use

Tailscale is a WireGuard-based VPN that builds encrypted connections directly between devices. Its servers only handle sign-in and “which device is where”. When a direct connection isn’t possible, traffic goes through a relay, still encrypted. Not touching the router at all was the biggest win.

What you need

A DSM 6.2 NAS with SSH access and an admin account that can use sudo (mine is Xpenology DSM 6.2.3 on an Intel CPU)
A Tailscale account (sign up with Google, Microsoft, GitHub, Apple and so on)
The Tailscale app on the device you want to connect from (a Mac in my case)

1. Download the Tailscale package for DSM 6

On DSM 7 you can install Tailscale straight from Package Center. On DSM 6 you download the SPK from the Tailscale package server: pick the file ending in dsm6 for your NAS’s CPU. Intel and AMD 64-bit models use x86_64.

Mine was tailscale-x86_64-1.104.1-600104001-dsm6.spk (about 41 MB). Each file has a .sha256 next to it, so I checked the download before installing.

mkdir -p ~/tailscale && cd ~/tailscale
curl -fLO https://pkgs.tailscale.com/stable/tailscale-x86_64-1.104.1-600104001-dsm6.spk
curl -fsSL https://pkgs.tailscale.com/stable/tailscale-x86_64-1.104.1-600104001-dsm6.spk.sha256   # official checksum
sha256sum tailscale-x86_64-1.104.1-600104001-dsm6.spk                  # your file → the two must match

Version numbers change, so check the package server for the current file name. According to the Tailscale docs, Tailscale runs as root on DSM 6, so none of the DSM 7 workarounds are needed.

2. Two problems during installation

sudo: synopkg: command not found

Over SSH, sudo synopkg install … said the command didn’t exist.

sudo: synopkg: command not found

sudo uses its own restricted PATH, and it doesn’t include /usr/syno/bin, where Synology’s tools live. Use the full path:

sudo /usr/syno/bin/synopkg install ~/tailscale/tailscale-x86_64-1.104.1-600104001-dsm6.spk

Failed to install package … error = [290]

With the path fixed, the installation itself was refused:

Failed to install package /var/services/homes/(user)/tailscale/tailscale-x86_64-1.104.1-600104001-dsm6.spk, error = [290]

The cause was Package Center’s trust level. My NAS was set to “Synology Inc.” (only packages signed by Synology), and Tailscale’s DSM 6 package doesn’t contain a Synology signature file. I couldn’t find an official explanation of error code 290, but changing the trust level made the install go through right away.

DSM → Package Center → Settings (top right) → General tab
Set Trust Level to Any publisher and click OK
Install again, then set the trust level back to Synology Inc. and click OK

Package Center → Settings → General → Trust Level (Korean DSM; the options are Synology Inc. / and trusted publishers / Any publisher)

When you set it back, make sure you click OK at the bottom of the window, or it isn’t saved. I thought I had reverted it and only noticed it hadn’t been saved when I checked the config file. The same trust level change is needed if you use “Manual Install” in Package Center instead.

sudo /usr/syno/bin/synopkg start Tailscale

Once installed, connect the NAS to your Tailscale account:

sudo /var/packages/Tailscale/target/bin/tailscale up --hostname=nas --accept-dns=false

--hostname: the device name shown in Tailscale.
--accept-dns=false: keeps the NAS’s own DNS settings. A server doesn’t need Tailscale’s DNS (MagicDNS).

It prints To authenticate, visit: https://login.tailscale.com/a/…. Open the link and sign in; the command finishes and the NAS gets a Tailscale address starting with 100.

Finally, in the Tailscale admin console under Machines, open the … menu next to the NAS and click Disable key expiry. By default devices have to sign in again periodically, and a server logging itself out is the last thing you want.

Device list in the Mac Tailscale app (account and addresses hidden)

Check the state with tailscale status. Note that synopkg status Tailscale run as a non-root user reported “stopped but unit is active” ([310]). That seems to be because the package script checks a file only root can read; the service was running fine.

4. Connect the Mac and add an SSH shortcut

On the Mac I installed Tailscale from the Mac App Store, allowed it to add a VPN configuration, and signed in with the same account as the NAS. When the menu bar icon says Connected, you’re done.

(At first I only signed in on the Tailscale website and forgot to install the Mac app, so the NAS was alone in the device list.)

Tailscale in the Mac menu bar: Connected

Then I added a second entry to ~/.ssh/config for the Tailscale address:

Host nas-ts
  HostName 100.x.y.z          # the NAS's Tailscale address
  HostKeyAlias 192.168.0.x    # the NAS's LAN address you already use
  User (NAS user)
  IdentityFile ~/.ssh/(key file)

HostKeyAlias reuses the NAS host key you already trusted on the home network, so there’s no “unknown host” warning for the new address. Now I use the usual name at home and ssh nas-ts everywhere else.

$ tailscale ping nas
pong from nas (100.x.y.z) via (LAN address):41641 in 4ms

At home, Tailscale connects directly inside the LAN, so the reply took 4 ms. The next day at the office, SSH to the LAN address timed out as expected, but ssh nas-ts connected right away. tailscale ping showed a direct connection to my home IP with no relay, at 34 ms.

What I like, and what to watch out for

Port 22 is still closed. Nothing new is open to the internet; only devices signed in to my Tailscale account can reach the NAS.
DSM’s admin page also opens over the Tailscale address, so there’s less reason to expose admin pages to the internet.
Tailscale SSH doesn’t run on Synology (Tailscale docs), so I use DSM’s own SSH server.
Updates are manual. New versions are installed the same way, from an SPK, and need the same trust level switch.
If you upgrade to DSM 7, the docs say to uninstall Tailscale and install it again.

Frequently asked questions

Does Tailscale work on Synology DSM 6?

Yes. It isn’t in DSM 6’s Package Center, but you can install the DSM 6 SPK from pkgs.tailscale.com. Choose the file for your CPU (x86_64 for Intel and AMD 64-bit).

I get error = [290] when installing.

Check whether Package Center’s trust level is set to “Synology Inc.”. Setting it to “Any publisher” for the install, then back again, fixed it for me.

Do I need port forwarding on my router?

No. Tailscale sets up the connection between devices itself and falls back to a relay when a direct connection isn’t possible. I didn’t change any router settings.

Is Tailscale free?

For personal, non-commercial use the free Personal plan is plenty. As of October 2026 it covers up to 6 users with unlimited devices. (Tailscale pricing)

Other things running on the same NAS: WordPress on PHP 8.3 in Docker and a Minecraft Forge server.

This is a translation of my original Korean article: DSM 6 시놀로지 Tailscale 설치 – 오류 290 해결하고 밖에서 SSH 접속. Last checked: 22 October 2026 (Tailscale 1.104.1, DSM 6.2.3).