Synology NAS Remote Access Test
Find whether the problem is local service access, the public TCP path, upstream NAT or simply a relay/overlay path that should not expose a port.
Synology NAS remote access diagnosis
Choose whether you use QuickConnect, a VPN/overlay, DDNS/reverse proxy or direct port forwarding before running a public probe.
The public IP shown here is detected from this browser request. External probes are restricted to that same public IP.
QuickConnect and a public DSM port are different paths
QuickConnect can use Synology's relay service when a direct QuickConnect connection is not possible. If you chose Synology QuickConnect above, Connection Vitals stays in guidance mode instead of treating a closed public port as failure.
If you deliberately expose a direct DSM or reverse-proxy endpoint
Synology documents DSM ports 5000 for HTTP and 5001 for HTTPS. Enter the public TCP port clients actually use, which may be different when a reverse proxy or custom mapping is involved. A reachable result proves the TCP path, not a successful DSM login.
If the direct probe fails
Use the CGNAT Test when you suspect ISP address sharing, or the Double NAT Test when the router WAN address is private. If you use Tailscale instead, switch to the overlay troubleshooter.
Official reference: Synology QuickConnect documentation.