· I trying to get ARC working with my Synology NAS based RoonOn NAS system. My TP Link Archer 600 modem is connected to both my NAS and Sonnet Hermes bridge via a Netgear switch. I get the following error message. "{ "ipv4_connectivity": {"status":"NetworkError","status_code":504,"error":"error code: 504 "}, "external_ip": {"actual_external_ip":"119.aaa.bbb.ccc","actual_external_ipv6":"null","router_external_ip":"100.ddd.eee.fff"}, "status": "status": MultipleNatFound , "natpmp_autoconfig": {"status":"NotFound"}, "upnp_autoconfig": {"server_ip":"192.168.100.1","found_upnp":true}, "multinat_autoconfig": {"status":"Failed","error":"Unknown Error code"} }". Can someone translate this into plain English and suggest an option to fix the issue (also in plain English)?
MultipleNatFound means that are two or more NAT layers.
NAT is the mechanism by which you can connect a whole network (in your case all the devices in your home network with IP addresses in the range 192.168.100.1 to 192.168.100.254) behind a device (your router) that is only given a single ip address.
Multiple NAT layers are commonly occur for one or both of two reasons:
Within your home network, you have a router connected to one of the LAN ports of another router.
Your ISP uses CG-NAT to provide your router with an IP address.
From your network description, you state that you just use an TP Link Archer 600 Modem (the switch does contribute to the issue) so, from this description, you have only one router in your network. Thus the likely reason is that your ISP is using CG-NAT.
You can confirm whether or not your ISP is using CG-NAT by browsing to a web site (like https://www.whatsmyip.org/) that reports the IP address that is being used to connect to it’s servers. It the ip address that is reported by such a web site is the same as the WAN ip address reported by your router, then the ISP is not using CG-NAT. If this is not the case, then either your ISP is using CG-NAT or you have multiple routers and you are looking at the ip address of the wrong one.
If your ISP is indeed using CG-NAT, then you have two options to get ARC working:
Contact your ISP and ask them to provide you with an IP address that supports port forwarding (this necessarily excludes the use of CG-NAT). The ISP may or may not be able to help you with this. If they can, they may charge an additional fee.
Use Tailscale to avoid the need to set up port forwarding.
The general description of Tailscale in Roons Help Centre can be found at:
Particular instructions for installing Tailscale on NAS systems are at:
However, be aware that these instructions may not have been updated to reflect the recent move to Roon Docker containers for QNAP and older Synology NASs. I don’t know how they relate to such systems. However, you mention:
This implies that you are using a newer Synology NAS running DSM 7.2 (i think that is the earliest version that supports the current version of Roon Server) or later and running Roon Server directly on the NAS without a container. In this case the Tailscale on NAS instructions will probably work fine.
If you have setup Tailscale correctly, then this is irrelevant. It only pertains to connectivity via port forwarding and the whole point of Tailscale is to avoid the use of port forwarding.
The only way to test a Tailscale setup is to turn off WiFi on your phone and see if you ARC connects
As far as help with the Tailscale setup and configuration is concerned, I can not help further. I have no experience of Tailscale and can’t provide any information beyond that contained in the help centre articles linked in my first reply.
Thank you for your patience, and a big thanks to @Wade_Oram for correctly identifying the CG-NAT situation and pointing you toward Tailscale!
Understanding the Error Message
Wade is absolutely right in his assessment. The diagnostic test you are looking at under Roon > Settings > Roon ARC is specifically designed to check for a traditional Port Forwarding connection. Because your ISP uses CG-NAT, that built-in Roon test will always fail and display an error even when Tailscale is configured perfectly.
When you use Tailscale, you can completely ignore the error message in the Roon settings!
How to Use and Test Tailscale with ARC
Tailscale bypasses your router's port forwarding by creating its own secure, private tunnel between your devices. To get ARC working, you just need to ensure the Tailscale tunnel is active. Here is how to finalize and test your setup:
Verify Your Account: Double-check that the Tailscale app on your Synology NAS and the Tailscale app on your iPhone are logged into the exact same Tailscale account.
Activate the VPN: Open the Tailscale app on your iPhone and ensure the connection toggle is switched to Active/On.
Switch to Cellular Data: Turn off Wi-Fi on your iPhone so you are strictly relying on your mobile data. This simulates being away from your home network.
Launch Roon ARC: Open the Roon ARC app on your phone. It should now automatically route through the active Tailscale VPN and connect seamlessly to your NAS.
Give these steps a try and let us know if Roon ARC successfully loads your library! We are here to help if you run into any further roadblocks.
Still no luck. My phone tailscale app is logged into the same account, sees the ROONonNAS server app, matches it’s IP address, but ARC still can’t see it.
If I knew what the failure point was, I could fix it! Tailscale iPhone app sees both itself and the NAS, presumably then both are logged into the same account and the phone can see the NAS.
Thanks for the update. If the Tailscale iPhone app can see both itself and the NAS, then the account side looks aligned, but ARC still is not getting through to the Roon Server on the NAS.
How did you install Roon Server on the NAS, is it running in a Docker Container or as a RoonOnNAS package? If you used the container install, is Host Networking mode enabled? Did you follow the instructions in our KB guide above?
You can also try temporarily running Roon Server on another device, such as a PC, to see whether you can connect to ARC. If there are issues, you can try to switch the Tailscale install to the PC as a test. Please let us know what you find.
Just checking in on this. Have you had a chance to confirm how Roon Server is installed on the NAS, whether it is running in Docker or as a RoonOnNAS package, and if Docker host networking is enabled when applicable? We also asked whether you could try checking the subnet/IP range and, as a test, run Roon Server on another device like a PC or move Tailscale to that PC to see whether ARC connects there. Please let us know what you find.
Please note, if we don’t hear back from you this thread may close automatically soon. If the thread auto-closes and you need further assistance, please submit a reopen support request via the technical support help form below and specify that the issue should be reopened. Thank you.
It’s running as RoonOnNAS, not within Docker. I’ve tried connecting with Tailscale, and even though I can see my NAS from the iPhone Tailscale app, it still won’t connect
Fair point in your earlier reply, and apologies for it.
Turn Wi-Fi off on your iPhone so you are on cellular only, make sure Tailscale is toggled on, then open Safari and go to your NAS’s DSM login page using its Tailscale address followed by port 5000. The address is the 100.x.y.z one shown for the NAS in the Tailscale app, so the URL would look like http://100.101.102.103:5000.
This matters because seeing your NAS listed in the Tailscale app only tells us both devices belong to the same Tailscale network. It does not tell us that traffic actually reaches the NAS, and that is the thing nobody has verified yet.
If the Synology login page loads, the tunnel is genuinely reaching your NAS and the problem is narrower than we thought. It would then most likely be the DSM firewall blocking Roon’s port for Tailscale traffic, or Roon Server not listening on the Tailscale interface, and we would take it from there.
If the page does not load, the tunnel is not reaching services on the NAS at all, even though the device appears in the list. On some Synology models the Tailscale package cannot create a proper network interface and falls back to a limited mode where outgoing connections work but incoming ones do not. That would explain everything you have seen so far.
Two quick questions to go with it:
How did you install Tailscale on the Synology, from the Package Center or some other way?
Do you have the DSM firewall enabled, under Control Panel, then Security, then Firewall?
Please send us the result of the Safari test and those two answers. That gives us a definite direction instead of another list of things to try.
Tailscale iPhone app sees both itself and the NAS, presumably then both are logged into the same account and the phone can see the NAS.