This article covers backing up a CloudPanel server to a Synology NAS using CloudPanel’s remote backup feature over a private Tailscale network. No port forwarding, no VPN configs, no exposing your NAS to the internet. No custom scripts either — CloudPanel handles the scheduling, retention, and SFTP transfer for you.
We’ll use Tailscale to connect the two. Tailscale is a mesh VPN built on top of WireGuard. It creates a private network between your devices (e.g. your NAS, smartphone, laptop) — no matter where they are — without needing to open ports or configure firewalls.
You just install it, sign in, and your devices can talk to each other over encrypted connections. It’s free for personal use.
What You Need
- A server running CloudPanel
- A Synology NAS (any model with DSM 7+)
- A free Tailscale account
Step 1: Install Tailscale on Both Devices
On Your Server
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale upFollow the authentication link to connect the server to your Tailscale network (tailnet).
On Your Synology NAS
- Open Package Center in DSM
- Search for Tailscale and install it
- Open the Tailscale package and sign in with the same account
Both devices should now appear in your Tailscale admin console at login.tailscale.com. Note the Tailscale IP of your Synology (something like 100.x.y.z).
Step 2: Prepare the Synology
Enable SSH
CloudPanel’s remote backup uses SFTP, which runs over SSH.
- Go to Control Panel → Terminal & SNMP
- Check Enable SSH service
- Keep port 22
Create a Backup User
Create a dedicated user for backups instead of using your admin account.
- Go to Control Panel → User & Group
- Create a new user (e.g.
cloudpanel-backup) - Give it a strong password
- Grant read/write access to the shared folder where backups should land
Create the Backup Folder
On your Synology, create the destination folder. The path follows the format /<shared-folder-name>/<desired-path>. For example, if you have a shared folder called backup, create a subfolder for your server:
/backup/web01.nightlybuilds.coMake sure the cloudpanel-backup user has write permissions on this folder.
Step 3: Configure CloudPanel Remote Backup
This is where CloudPanel does the heavy lifting. Instead of writing custom rsync scripts and cron jobs, you configure everything from the admin panel.
- Log in to CloudPanel as admin
- Go to Admin Area → Backups
- Enable Remote Backup and fill in the following:
| Setting | Value |
|---|---|
| Frequency | Daily |
| Time | 02:00 |
| Authentication Method | Password |
| Retention Period (Days) | 7 |
| Host | 123.123.123.123 |
| User | cloudpanel-backup |
| Password | (your password) |
| Port | 22 |
| Remote Server Path | /backup/web01.nightlybuilds.co |
The host IP is the Tailscale IP of your Synology. Since both devices are on the same tailnet, CloudPanel can reach it directly — no public IP or port forwarding needed.
Leave Excludes empty unless you want to skip specific directories from the backup.
CloudPanel will now automatically back up your sites, databases, and configuration to your Synology every night at 2 AM, and clean up backups older than 7 days.
Offcourse it’ll also work with other sources.
Why Tailscale Makes This Simple
Without Tailscale, you’d need to either expose your Synology to the internet (bad idea), set up a traditional VPN (tedious), or punch holes in your firewall with port forwarding (fragile and insecure).
Tailscale creates a WireGuard-based mesh network between your devices. Traffic is encrypted end-to-end, there’s nothing to port-forward, and it just works — even when both devices are behind NAT.
