How to Monitor Your NAS UPS Remotely from Android Using Tailscale or WireGuard

Your UPS is connected to the NAS at home, but you are travelling when a storm arrives. From your Android phone, you want to know whether utility power is available, how much battery remains, and how long the UPS might support the current load.

UPSLink reads this information from Network UPS Tools (NUT). It monitors the UPS, not NAS CPU usage, storage, disk health, or general NAS performance. A VPN such as Tailscale or WireGuard supplies the private network path while you are away.

How remote UPS monitoring works

The NAS must run a compatible, accessible NUT service. NUT's upsd commonly listens on TCP 3493, although administrators can change the port. Reaching a NAS administration website proves only that its web service is accessible; it does not prove that NUT is listening or permitted.

Some NAS systems monitor a UPS locally without exposing NUT to other clients. Others act only as clients of a separate NUT host. Identify the actual data server first. The NUT homelab guide explains the driver, server, and client roles.

Before you start

• A NAS or homelab host already monitoring a compatible UPS through NUT.
• An operational NUT server with a known UPS name, address, and port.
• An Android phone with UPSLink installed.
• A working Tailscale or WireGuard VPN with a route to that server.
• NAS firewall rules and NUT access permissions allowing the intended private clients.

First verify status locally with an existing NUT client. Exact setup steps depend on NAS platform, firmware, NUT packaging, and network topology. The examples below describe connection patterns, not verified instructions for every Synology, Unraid, or TrueNAS release.

Tailscale walkthrough

1. Choose direct access or a subnet router

A: Tailscale on the NAS or NUT host. Install the supported Tailscale package on that host and join your tailnet. Use the host's Tailscale IP address, or its MagicDNS hostname when enabled and resolving on Android. Check platform restrictions; Tailscale's Synology documentation covers DSM-specific networking considerations.

B: Tailscale elsewhere on the home network. Configure an always-on device as a subnet router for the LAN containing the NAS. Follow the official subnet-router documentation to enable forwarding, advertise the required subnet, approve the route where required, and allow access through tailnet policy. UPSLink then uses the NAS's private LAN address, not the subnet router's Tailscale address.

Installing Tailscale only on the phone does not make home LAN devices reachable. You need either a reachable Tailscale peer running NUT or an operational subnet route. An exit node is not required for these patterns.

2. Connect Android to the same tailnet

Install Tailscale on Android, sign in to the same tailnet, complete any required device approval, and connect the VPN. Confirm that the NUT host or subnet router is online. Review tailnet access rules so your phone is allowed to contact the destination on its configured NUT TCP port.

Check for another active Android VPN that could replace or conflict with this connection. When travelling, overlapping home and hotel LAN ranges can also send traffic down the wrong route.

3. Record the correct destination

For direct access, copy the NUT host's Tailscale address from its device details. For subnet routing, obtain the NAS's LAN address from your own network configuration and confirm that address is inside the approved advertised route. Use a stable address assignment where possible.

MagicDNS names identify tailnet devices; they do not automatically create DNS records for every NAS behind a subnet router. Start with the destination IP if hostname resolution is uncertain, then configure private DNS as needed.

4. Check the NUT listener and firewall

On a self-managed NUT host, review upsd.conf. A loopback-only listener cannot accept remote clients. Where needed, configure a LISTEN entry for the specific reachable private interface and configured port, following the upsd.conf reference. Apply service changes using your platform's supported method.

Managed NAS firmware may generate configuration files, so use its supported controls rather than assuming direct edits survive restarts. Keep firewall access narrow. With subnet-router source NAT, the NAS may see the router's LAN address; without it, return routes and rules must accommodate the VPN client addresses. Check the source the NAS actually sees before changing permitted-client lists.

5. Verify reachability before opening UPSLink

From a trusted VPN-connected computer with NUT tools, query upsc -l <nut-host>:3493 to list UPS names, then upsc <ups-name>@<nut-host>:3493 to read status. Replace the placeholders and port with your configuration. These are computer-side diagnostic commands, not UPSLink fields.

A successful query on another peer helps isolate server problems, but does not prove the phone has identical permissions. On Android, use an available TCP diagnostic tool to check the same host and port, or confirm with manual connection in UPSLink. Ping alone cannot establish that NUT is reachable.

WireGuard alternative

An existing WireGuard tunnel can provide the same private access. Its endpoint may run on your router, a Raspberry Pi, or another gateway; it does not need to run on the NAS.

1. Include the NAS address or required LAN subnet in the Android peer's AllowedIPs, and ensure the client installs the corresponding route.
2. Enable forwarding on the VPN gateway and allow only the necessary VPN-to-NAS traffic through its firewall.
3. Provide a return route to the VPN clients, or intentional source NAT on the gateway. Account for that source address in NAS restrictions.
4. Use the private NUT IP, or configure DNS that resolves its hostname while the tunnel is active. Test the NUT port before configuring the app.

WireGuard's official overview explains how allowed IPs select peers and constrain incoming source addresses. Correct keys and a successful handshake alone do not establish LAN forwarding. UPSLink connects to the NUT endpoint, not the VPN gateway unless that gateway also runs NUT. Hosting your own WireGuard endpoint may require an inbound VPN UDP rule or forwarding; never substitute public NUT forwarding.

Connect UPSLink to your remote NUT server

1. Install or open UPSLink on Android while the VPN is connected.
2. Tap Add UPS and use manual server entry with the VPN-reachable IP or hostname. Local network discovery may not cross VPN or subnet boundaries.
3. Enter the configured NUT port, normally 3493.
4. Supply NUT credentials only if required by your configuration and supported by the app's authentication flow. Use NUT credentials, not the NAS administrator login.
5. Select the UPS exposed by the server, assign a recognizable name, and save the connection.
6. Confirm current dashboard values. Turn off Wi-Fi and repeat over mobile data with the VPN active to verify access from outside the home LAN.

The complete UPSLink setup tutorial shows these screens, including authentication, UPS selection, saving, and alert permissions.

Battery percentage estimates charge remaining; runtime estimates remaining operating time at the current load. Load indicates UPS utilization. Online/on-battery describes utility versus battery power, which is distinct from whether the app's server connection is online. Voltage and other supported measurements depend on the UPS and NUT driver; missing fields are not necessarily a connection failure.

Practical NAS and homelab scenarios

Synology NAS with a USB-connected APC UPS: confirm the exact UPS works locally and that DSM exposes a compatible NUT service to permitted clients. Use direct Tailscale access or a subnet router, then check which source address reaches the NAS. This is a Synology UPS Android connection pattern, not a firmware-specific setup recipe.

Unraid server: confirm your UPS monitoring implementation actually provides a NUT-compatible endpoint. Local UPS reporting alone does not establish that. With NUT available, Unraid UPS monitoring follows the same private host-and-port workflow.

TrueNAS or Raspberry Pi: determine whether the system serves NUT data or consumes it from another host. TrueNAS UPS monitoring requires an accessible server configuration appropriate to that release. A Pi can instead run the driver and NUT server for compatible hardware; in that case UPSLink targets the Pi.

While travelling or using mobile data, the app queries that endpoint over the VPN. These are conceptual compatibility examples. Validate your specific platform and model locally before relying on remote access.

Remote alerts and connectivity limits

UPSLink can display remote status whenever its NUT endpoint is reachable. Background alerts also depend on monitoring settings, notification permissions, Android background execution and battery policies, and continuing VPN connectivity. A VPN supplies connectivity; it does not by itself create push notifications.

A persistent VPN can keep the private route available for background monitoring. Manually connecting only when checking status supports on-demand viewing, but leaves gaps while disconnected. Test your intended monitoring settings with the phone locked and over mobile data. Do not assume instant notifications or continuous monitoring when the phone is offline or the VPN drops.

Security best practices

• Never expose TCP 3493 directly to the public internet. Restrict NUT to trusted LAN/VPN clients and retain the NAS firewall.
• Limit tailnet or WireGuard gateway access to the destinations and ports needed for monitoring.
• Where authentication is required, use a dedicated least-privilege monitoring account. Avoid granting UPS commands or writable-variable permissions just to read status; consult NUT user permissions.
• Do not assume a password protects every NUT status query: some deployments allow anonymous reads. Network access restrictions remain essential.
• Keep credentials, VPN keys, and identifiable network details out of public screenshots and support posts.

Tailscale and WireGuard encrypt VPN transport. Users must still configure NUT permissions correctly. With a subnet router, encryption ends at that router; the remaining LAN hop needs its own trust and access controls.

Troubleshooting remote connections

Check the network path before changing credentials or the UPS driver. The table scrolls horizontally on narrow screens.

Frequently asked questions

Official configuration references

• Tailscale subnet routers and private LAN access
• Tailscale on Synology
• WireGuard routing and encrypted transport
• NUT listener configuration and user permissions