# Connecting to Synology NAS Surveillance Station with Pangolin and Newt

**URL:** <https://forum.hhf.technology/t/connecting-to-synology-nas-surveillance-station-with-pangolin-and-newt/603>\
**Category:** Home Networking\
**Tags:** synology, pangolin\
**Created:** [February 27, 2025, 7:17pm UTC](https://forum.hhf.technology/t/connecting-to-synology-nas-surveillance-station-with-pangolin-and-newt/603 "2025-02-27T19:17:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [February 27, 2025, 7:17pm UTC](https://forum.hhf.technology/t/connecting-to-synology-nas-surveillance-station-with-pangolin-and-newt/603/1 "2025-02-27T19:17:00Z")

</div>

### Connecting to Synology NAS Surveillance Station with Pangolin and Newt

After some trial and error, We found a solution that works seamlessly for connecting to my Synology NAS’s Surveillance Station through a VPS using Pangolin and Newt. The key was updating to the latest version of Pangolin and configuring an HTTP resource properly. Below are the steps to achieve this setup, ensuring compatibility with both web browsers and Synology apps while keeping all traffic on port 443 (similar to Cloudflare tunnels) and supporting multiple instances without needing to forward numerous ports.

#### Prerequisites

- **Synology NAS:** Configured with Surveillance Station using HTTPS on port 9901 to bypass the base NAS login screen.
- **VPS:** Running Pangolin and Newt, with Newt potentially on a separate server on the same flat network as the Synology NAS (as in your setup).
- **Goal:** Replace Cloudflare tunnels, disable Pangolin authentication, and use Synology’s authentication, supporting 20+ instances.

#### Steps to Set Up

1. **Update Pangolin to the Latest Version**

2. **Configure the Newt Resource**

3. **Disable Pangolin Authentication (Optional)**

4. **Verify Synology NAS Settings**

5. **Test Connections**

#### Why This Works

- **Pangolin 1.0.0-beta.15 Fix:** Earlier versions had compatibility problems with Synology apps over HTTP resources, likely due to how the apps handled TLS handshakes or Synology’s login redirects. The update resolves this, mimicking Cloudflare tunnels’ behavior of keeping traffic on 443.
- **HTTP Resource:** Using HTTP instead of TCP sockets (e.g., for ports 5000/5001) simplifies management and scales better for your 20+ instances, avoiding the need to forward multiple ports per instance.
- **Port 9901:** Surveillance Station’s dedicated HTTPS port bypasses the DSM login screen, streamlining access.

#### Troubleshooting Tips

- If the apps still fail to connect:
  - Double-check Pangolin’s version (`docker ps` if containerized, or check the release notes).
  - Use Wireshark to confirm the client is attempting a TLS handshake on 443 with the VPS and completing it successfully.
  - Ensure no Traefik or firewall rules on the VPS block the connection.

- If you’re unfamiliar with Traefik (as you mentioned), you likely don’t need to modify it beyond Pangolin’s default setup, since the beta.15 fix handles the Synology app quirks.

* * *

### Final Notes

This setup mirrors the simplicity of Cloudflare tunnels while leveraging Pangolin’s flexibility. You won’t need to forward TCP port 9901 to the host for each instance, as the HTTP resource handles everything over 443.