{"id":13596765,"url":"https://github.com/runfalk/synology-wireguard","last_synced_at":"2025-05-16T07:06:45.245Z","repository":{"id":40200861,"uuid":"176117811","full_name":"runfalk/synology-wireguard","owner":"runfalk","description":"WireGuard support for some Synology NAS drives","archived":false,"fork":false,"pushed_at":"2024-04-01T17:33:54.000Z","size":94,"stargazers_count":948,"open_issues_count":73,"forks_count":132,"subscribers_count":38,"default_branch":"master","last_synced_at":"2024-10-13T09:15:06.919Z","etag":null,"topics":["synology","wireguard"],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/runfalk.png","metadata":{"files":{"readme":"README.rst","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-03-17T15:04:55.000Z","updated_at":"2024-10-08T04:39:51.000Z","dependencies_parsed_at":"2024-08-01T16:42:11.386Z","dependency_job_id":"70c22372-badc-4554-98e4-6cac860b9fda","html_url":"https://github.com/runfalk/synology-wireguard","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/runfalk%2Fsynology-wireguard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/runfalk%2Fsynology-wireguard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/runfalk%2Fsynology-wireguard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/runfalk%2Fsynology-wireguard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/runfalk","download_url":"https://codeload.github.com/runfalk/synology-wireguard/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254485066,"owners_count":22078767,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["synology","wireguard"],"created_at":"2024-08-01T16:02:46.384Z","updated_at":"2025-05-16T07:06:40.156Z","avatar_url":"https://github.com/runfalk.png","language":"Shell","funding_links":[],"categories":["Shell"],"sub_categories":[],"readme":"WireGuard support for Synology NAS\n==================================\nThis package adds WireGuard support for Synology NAS drives. It provides the\nWireGuard kernel module and the ``wg``/``wg-quick`` commands.\n\n\nDisclaimer\n----------\nYou use everything here at your own risk. I am not responsible if this breaks\nyour NAS. Realistically it should not result in data loss, but it could render\nyour NAS unaccessible if something goes wrong.\n\nIf you are not comfortable with removing your drives from the NAS and manually\nrecover the data, this might not be for you.\n\n\nFAQ/Known issues\n----------------\n* The releases in the releases page are for DSM 6 only. For DSM7, you'll need to follow the instructions in this readme and compile it yourself.\n* The ``Dns = x.x.x.x`` setting is unsupported. If you try it you will get the\n  following message:\n  ``/usr/local/bin/wg-quick: line 31: resolvconf: command not found``\n* IPv6 is probably not supported (at least not using ``wg-quick``). Due to the\n  system version of ``iproute2``\n  `being too old \u003chttps://lists.zx2c4.com/pipermail/wireguard/2018-April/002687.html\u003e`_.\n  You'll get the error message\n  ``Error: argument \"suppress_prefixlength\" is wrong: Failed to parse rule type``.\n* Everything appears to be OK when running ``wg show`` but no traffic is flowing\n  through the tunnel. Apparently there is some kind of race when setting up the\n  interface. The simplest known workaround is to append\n  ``; sleep 5; ip route add 10.0.0.0/16 dev wg0`` to the ``PostUp`` rule. This\n  assumes that your WireGuard IP subnet is ``10.0.x.x``. See\n  `issue #10 \u003chttps://github.com/runfalk/synology-wireguard/issues/10\u003e`_ for\n  more information.\n\nPRs that solve these issues are welcome.\n\n\nCompatibility list\n------------------\nAll models marked *Is working* have been confirmed by users to work. If your\nmodel has the same platform as one of the working ones, chances are it will\nwork for you too.\n**Note**: the releases in the releases page are for DSM 6 only. For DSM7, you'll need to follow the instructions in this readme and compile it yourself.\n\n=========== ========== =========== ===========================\nModel       Platform   DSM Version Is working?\n----------- ---------- ----------- ---------------------------\nDS1019+     apollolake 6.2         Yes\nDS114       armada370  *N/A*       No (Kernel version too old)\nDS115j      armada370  *N/A*       No (Kernel version too old)\nDS116       armada38x  6.2         Yes\nDS1511+     x64        6.2         Yes\nDS1618+     denverton  6.2         Yes\nDS1817+     avoton     6.2         Yes\nDS1815+     avoton     6.2         Yes\nDS213j      armada370  *N/A*       No (Kernel version too old)\nDS213j      armada370  *N/A*       No (Kernel version too old)\nDS214play   armada370  *N/A*       No (Kernel version too old)\nDS214se     armada370  *N/A*       No (Kernel version too old)\nDS216+II    braswell   6.2         Yes\nDS216se     armada370  *N/A*       No (Kernel version too old)\nDS216Play   monaco     6.2         Yes\nDS218       rtd1296    6.2         Yes\nDS218+      apollolake 6.2/7.0     Yes\nDS218j      armada38x  6.2         Yes\nDS220+      geminilake 6.2/7.0     Yes\nDS3617xs    broadwell  6.2         Yes\nDS414slim   armada370  *N/A*       No (Kernel version too old)\nDS415+      avoton     6.2         Yes\nDS418play   apollolake 6.2         Yes\nDS713+      cedarview  6.2         Yes\nDS716+II    braswell   6.2         Yes\nDS718+      apollolake 6.2         Yes\nDS720+      geminilake 7.0         Yes\nDS916+      braswell   6.2         Yes\nDS918+      apollolake 6.2         Yes\nRS214       armada370  *N/A*       No (Kernel version too old)\nRS816       armada38x  6.2         Yes\nVirtual DSM kvmx64     6.2/7.0     Yes\n=========== ========== =========== ===========================\n\nThe minimum required kernel version is 3.10. If you have a kernel version lower\nthan that, WireGuard will not work. You can check your kernel version by\nlogging in through SSH and running the ``uname -a`` command.\n\nThis project is also confirmed to be compatible with other brand NAS stations\nusing `XPEnology \u003chttps://xpenology.com/forum/topic/9392-general-faq/\u003e`_.\n\n========= ================ ========== =========== ===========================\nModel     Hardware version Platform   DSM Version Is working?\n--------- ---------------- ---------- ----------- ---------------------------\nHP54NL    DS3615xs         bromolow   6.2         Yes\n========= ================ ========== =========== ===========================\n\n\nInstallation\n------------\n1. Check the `releases \u003chttps://github.com/runfalk/synology-wireguard/releases\u003e`_\n   page for SPKs for your platform and DSM version. If there is no SPK you have to compile it\n   yourself using the instruction below.\n\n2. (*Not applicable for DSM from 7.0*)\n   In the Synology DSM web admin UI, open the Package Center and press the Settings button.\n   Set the trust level to Any publisher and press OK to confirm.\n\n3. In the Package Center, press the *Manual install* button and provide the SPK file. Follow the instructions until done.\n\n4. (*Only for DSM from 7.0*)\n   From DSM 7.0, an additional step is required for the WireGuard package to start.\n   This is related to `preventing  packages not signed by Synology from running with root privileges \u003chttps://www.synology.com/en-us/knowledgebase/DSM/tutorial/Third_Party/supported_third_party_packages_beta\u003e`_.\n   When installing the package, uncheck the ``run after installation`` option. After installing the package, `connect to the NAS via SSH \u003chttps://www.synology.com/en-us/knowledgebase/DSMUC/help/DSMUC/AdminCenter/system_terminal\u003e`_ and run the ``sudo /var/packages/WireGuard/scripts/start`` command.\n\n\nNow you just need to figure out how to configure WireGuard. There are lots of\ngood guides on how to do that.\n\nTo put my WireGuard configuration on the NAS, I used SSH and created a\n``wg-quick`` configuration in ``/etc/wireguard/wg0.conf``. My configuration looks like this:\n\n.. code-block::\n\n    [Interface]\n    Address = 10.0.1.1/16\n    PrivateKey = \u003cnas-private-key\u003e\n    ListenPort = 16666\n    PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE\n    PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE\n\n    [Peer]\n    PublicKey = \u003cpeer-public-key\u003e\n    AllowedIPs = 10.0.1.2/32\n\nNote that you need to modify the rules if your network interface is not\n``eth0``. You can check which name your interface has by running ``ip a`` in an\nSSH session.\n\n\nAdding WireGuard to autostart\n-----------------------------\nDSM since version 7.0 comes with `systemd unit \u003chttps://www.freedesktop.org/software/systemd/man/systemd.unit.html\u003e`_ support, while for previous versions you can use the built-in `upstart \u003chttp://upstart.ubuntu.com/\u003e`_.\nTo standardize the process of adding the WireGuard interface to the autostart, a simple ``wg-autostart`` script has been developed.\n\n**Important note:** before adding the interface to the autostart, start it manually by ``sudo wg-quick up wg0`` ensure that it does not cause the system to crash and that you can still access your NAS properly. Otherwise, you may not be able to start the NAS or you may not be able to access the device after a reboot.\n\nTo add the ``wg0`` interface to the autostart, run the command:\n\n.. code-block::\n\n    sudo wg-autostart enable wg0\n\n\nTo remove the ``wg0`` interface from the autostart, run the command:\n\n.. code-block::\n\n    sudo wg-autostart disable wg0\n\n\nCompiling\n---------\nI've used docker to compile everything, as ``pkgscripts-ng`` clutters the file\nsystem quite a bit. First create a docker image by running the following\ncommand in this repository:\n\n.. code-block:: bash\n\n    git clone https://github.com/runfalk/synology-wireguard.git\n    cd synology-wireguard/\n    sudo docker build -t synobuild .\n\nNow we can build for any platform and DSM version using:\n\n.. code-block:: bash\n\n    sudo docker run --rm --privileged --env PACKAGE_ARCH=\u003carch\u003e --env DSM_VER=\u003cdsm-ver\u003e -v $(pwd)/artifacts:/result_spk synobuild\n\nYou should replace ``\u003carch\u003e`` with your NAS's package arch. Using\n`this table \u003chttps://www.synology.com/en-global/knowledgebase/DSM/tutorial/General/What_kind_of_CPU_does_my_NAS_have\u003e`_\nyou can figure out which one to use. Note that the package arch must be\nlowercase. ``\u003cdsm-ver\u003e`` should be replaced with the version of DSM you are\ncompiling for.\n\nFor the DS218j that I have, the complete command looks like this:\n\n.. code-block:: bash\n\n    sudo docker run --rm --privileged --env PACKAGE_ARCH=armada38x --env DSM_VER=6.2 -v $(pwd)/artifacts:/result_spk synobuild\n\nIf everything worked you should have a directory called ``artifacts`` that\ncontains your SPK files.\n\n\nAvoiding timeouts when downloading build files\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nIt can take a long time to pull development files from SourceForge, including\noccasional timeouts. To get around this, create a folder locally and map it to\nthe `/toolkit_tarballs` Docker volume using the following command:\n`-v $(pwd)/\u003cpath/to/folder\u003e:/toolkit_tarballs`\nto the `docker run` command listed above. This will allow the development files\nto be stored on your host machine instead of ephemerally in the container. The\nimage will check for existing development files in that folder and will use\nthem instead of pulling them from SourceForge when possible. You can also\ndownload the files directly and put them in the folder you created by downloading\nthem from here: https://sourceforge.net/projects/dsgpl/files/toolkit/DSM\u003cDSM_VER\u003e\n(e.g. https://sourceforge.net/projects/dsgpl/files/toolkit/DSM6.2)\n\n\nCredits\n-------\nI based a lot of this work on\n`this guide \u003chttps://www.reddit.com/r/synology/comments/a2erre/guide_intermediate_how_to_install_wireguard_vpn/\u003e`_\nby Reddit user `akhener \u003chttps://www.reddit.com/user/akhener\u003e`_. However, I had\nto modify their instructions a lot since my NAS has an ARM CPU which made cross\ncompilation a lot trickier.\n\nGitHub user `galaxysd \u003chttps://github.com/galaxysd\u003e`_ made\n`a guide \u003chttps://galaxysd.github.io/linux/20170804/2017-08-04-iptables-on-Synology-DSM-6\u003e`_\non how to enable iptables NAT support.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frunfalk%2Fsynology-wireguard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frunfalk%2Fsynology-wireguard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frunfalk%2Fsynology-wireguard/lists"}