Run Relay on ASUSTOR NAS

Overview

Viaalink Relay for ASUSTOR turns your NAS into your own private tunnel server. It lets you publish local web services, staging servers, and databases to the internet under your own domain name, with automatic HTTPS certificates, approved device keys, and a web setup dashboard.

Current version: 0.54.0-2

Requirements

Before installing the Viaalink Relay package, ensure your NAS satisfies the following requirements:

• ADM version: ADM 5.1 or newer (firmware 5.1.0+).
• Architecture: 64-bit x86-64 NAS models only. (Packages for Synology and QNAP are not yet available).
• Docker Engine app: Installed from App Central (search for “Docker Engine”).
• Memory: Minimum 128 MB RAM allocated for Relay operation.
• EZ-Connect: ASUSTOR’s built-in dynamic DNS enabled (ADM → Settings → EZ-Connect), providing a hostname such as yourname.myasustor.com.
• Custom domain name: A domain you control with wildcard DNS capability (see DNS setup below).

Download

The .apk is published with the first release — ask contact@viaalink.com for early access.

Step-by-step installation

1. Install Docker Engine

Open ADM, launch App Central, search for Docker Engine, and click Install. Ensure the app starts and reports running status.

2. Sideload the Viaalink Relay .apk

1. Open App Central.
2. Click the gear icon (⚙) in the top right corner and choose Install Manually.
3. Click Browse, select the downloaded .apk package, and click Upload.
4. Review the package information and click Install.

Known installer quirks

When installing the package via ADM App Central, you may encounter the following known interface quirks:

• Docker Engine shows a red ✗ in prerequisites dialog: ADM’s built-in dependency check can intermittently fail to match the installed Docker Engine app. The installer script performs its own verification (command -v docker) and will cleanly stop if Docker is genuinely missing. If Docker Engine is running in App Central, you can safely ignore the red ✗ and proceed with the installation.
• Informational port-conflict checklist: Items 3–5 in the “About This App” dialog display the package’s declared default ports (2222, 8080, 8443, 28080, 3478). This checklist is informational only and does not perform a live socket scan. If a port conflicts with an existing custom service on your NAS, you can reassign it directly from the setup page after installation.
• “Enable port forwarding” checkbox: Leave this option checked during installation. This activates ADM’s EZ-Router service to automatically forward the declared ports through your router via UPnP.
• Automatic reverse proxy entry: The installer automatically registers an HTTPS entry on port 28080 in ADM’s Control Panel → Services → Reverse Proxy, terminating TLS with the NAS’s own certificate and routing traffic to the Relay setup interface.

3. Start the application

In App Central, navigate to Installed Apps, locate Viaalink Relay, and ensure the toggle is set to On.

4. Locate your setup credentials

ADM creates a dedicated shared folder for persistent data during installation:

1. Open File Explorer from your ADM desktop.
2. In the left navigation pane under Shared Folders, open viaalink-relay-data.
3. Open CREDENTIALS.txt. This file contains your web setup link and initial access code.

Important: All server configuration, host keys, TLS certificates, license/license.jwt, and authorized client keys are stored in viaalink-relay-data. This folder is retained if the application is stopped or updated. Do not store application data in ADM’s internal app directories.

DNS setup: wildcard subdomains over dynamic IP

Viaalink Relay provides subdomains for each connected service (for example myapp.relay.example.com). Because ASUSTOR’s default *.myasustor.com zone does not support wildcard subdomains, you should use your own domain name.

Wildcard CNAME configuration

Configure two CNAME records at your DNS provider (such as Cloudflare, Porkbun, or Route53):

relay.example.com.    300 IN CNAME yourname.myasustor.com.
*.relay.example.com.  300 IN CNAME yourname.myasustor.com.

• When using Cloudflare, set both records to DNS only (grey cloud). Proxied mode prevents Let’s Encrypt from reaching the NAS to validate TLS certificates.
• The CNAME chain dynamically follows your NAS’s changing public IP address via EZ-Connect without requiring manual updates.

Static IP alternative

If your ISP provides a fixed, static public IP address, point direct A and AAAA records to your IP:

relay.example.com.    300 IN A    203.0.113.10
*.relay.example.com.  300 IN A    203.0.113.10

Router ports and EZ-Router

ADM uses a background daemon (ezrouterd) that periodically synchronizes router port mappings from /usr/builtin/etc/resource.conf.

Viaalink Relay automatically registers its primary active ports with ADM:

Note: Consumer routers typically reject UPnP requests for ports below 1024. When HTTPS via Caddy is enabled (--caddy-https-enabled=true), Caddy binds public ports 80 and 443 as the public front door while Relay’s 8080 and 8443 listeners remain internal on the NAS. If Caddy is not active, map external router port 80 to NAS port 8080 and external port 443 to NAS port 8443. The 16-port UDP range (49152–49167) for calls through firewalls is never registered in EZ-Router and requires a manual static router forwarding rule.

UPnP and STUN/TURN diagnostic commands

You can inspect or manage router port mappings and test STUN/TURN reachability from an SSH session on the NAS using the built-in subcommands:

# List active UPnP port mappings on the router
viaalink-relay upnp list

# Manually add or remove a UPnP port mapping
viaalink-relay upnp add 28080
viaalink-relay upnp remove 28080

# Verify STUN binding and TURN allocation from the command line
viaalink-relay stun-check relay.example.com:3478 --turn-realm relay.example.com --turn-secret <secret>

First-run setup page

Open CREDENTIALS.txt in viaalink-relay-data to find your initial setup code and admin console code. On your first visit, open the dashboard URL including ?x-authorization=<setup-code> (or click the Viaalink Relay icon on your ADM desktop):

https://yourname.myasustor.com:28080/_relay/dashboard?x-authorization=<setup-code>

For local network access, connect directly to the internal HTTP listener on port 8080:

http://<NAS-LAN-IP>:8080/_relay/dashboard?x-authorization=<setup-code>

Once authenticated, the browser stores your session cookie so subsequent visits to /_relay/dashboard do not require the query parameter. When the live traffic inspection console is enabled, open /_relay/console?x-authorization=<admin-code>.

The setup dashboard is organized into nine tabs:

• License: Paste your license.jwt file or run the Free plan (up to 10 connected devices).
• Domain & Ports: Configure your root domain (e.g. relay.example.com), notification email, and custom port overrides.
• Network: View live UPnP and EZ-Router forwarding statuses for each port, and configure IP or country allow/block lists (geodb).
• Domains & DNS: Verify CNAME and A record resolution with the built-in DNS check tool, or register extra domains (--bind-hosts) and per-domain TLS policies (--bind-hosts-tls).
• Users: Authorize client SSH public keys, create registration invites, or generate downloadable Ed25519 keypairs.
• HTTPS / Caddy: Configure DNS-01 automated wildcard certificates via the five supported DNS providers.
• Routes & Clients: Inspect live connected devices, active HTTP/TCP routes, and link to /_relay/console.
• NATS: Configure the embedded NATS message bus (4222 / 4223) and WebRTC signalling options.
• Calls through firewalls (STUN/TURN): Enable STUN and TURN (3478/udp and 49152–49167/udp), set --turn-public-ip, and run live STUN/TURN self-tests.

Expected restart behavior (brief 502)

Modifying network ports, root domain, TLS/Caddy settings, or IP/country filtering (geodb) requires the Relay process to restart. Because your browser connects through ADM’s internal reverse proxy on port 28080, ADM will display a 502 Bad Gateway page for approximately 10 seconds while the process reinitializes. Reload the page after 10 seconds to resume.

Activating a license

Viaalink Relay functions under the Free plan out of the box with up to 10 connected devices without requiring a license file.

To activate a paid plan (Personal, Team, Business, or Enterprise):

1. Open the license.jwt file received by email.
2. Navigate to the License tab on /_relay/dashboard.
3. Paste the contents of license.jwt into the text box and click Save & Activate (or save the file directly to viaalink-relay-data/license/license.jwt in File Explorer).
4. The license is verified offline against the built-in public key and takes effect immediately without restarting the server.

Updating the package

When an updated .apk package is released:

1. Open App Central → ⚙ → Install Manually.
2. Select the updated .apk package and confirm installation.
3. ADM replaces the application binaries while leaving the viaalink-relay-data shared folder untouched. All host keys, certificates, license/license.jwt, and configuration settings persist automatically.

Uninstalling

To remove Viaalink Relay:

1. Open App Central → locate Viaalink Relay → click Remove.
2. ADM stops the containers and removes the application launcher.
3. All persistent data, cryptographic keys, and settings remain safe in File Explorer under viaalink-relay-data. To perform a complete wipe, delete the viaalink-relay-data shared folder manually in File Explorer.

Troubleshooting

• 502 Bad Gateway after saving settings: This is normal during process reinitialization. Wait 10 to 15 seconds and refresh your browser.
• Published subdomains do not resolve: Confirm that your DNS provider has a wildcard CNAME record (*.relay.<your-domain>) pointing to your EZ-Connect hostname, and verify that Cloudflare proxying is set to DNS only (grey cloud).
• Cannot connect from outside the home network: Ensure that port 2222 and port 28080 are forwarded by EZ-Router or static router rules. Test connections from a mobile phone using cellular data rather than local Wi-Fi.

Release notes

0.54.0-2

• Fixed a crash in the HTTP proxy handler where concurrent requests through the same tunnel could race on the web console route state (concurrent map writes), causing the Relay process to restart under load when --admin-console or --service-console was enabled.
• Restored tunnel stability when serving websites with many parallel asset requests.
• Removed the temporary workaround of disabling --admin-console and --service-console.

0.54.0-1

• Added multi-domain discovery: Viaalink Relay now advertises every domain in domain and bind-hosts along with its per-domain certificate mode (bind-hosts-tls) to connecting Viaalink CLI clients.
• Differentiates domains with active wildcard certificates (https_wildcard: true) from single-host HTTP-01 domains (https_wildcard: false) and plain HTTP domains (none).
• Domains set to none are sorted last and marked https: false so clients do not offer broken https:// URLs.

0.53.0-10

• Added independent per-domain certificate modes for extra domains (bind-hosts-tls): DNS-01 (wildcard), HTTP-01 (port 80), or None (HTTP only) for domains behind an external proxy.
• Added a live Verify certs check in the dashboard that performs a TLS handshake against 127.0.0.1:443 for each domain and reports whether the served certificate is issued by Let’s Encrypt.
• Bundled CLI updated to understand per-domain certificate settings.

0.53.0-9

• Added external TURN verification for calls through firewalls and bounded the default TURN allocation range to 16 UDP ports (49152–49167 via --turn-relay-min-port / --turn-relay-max-port) so UPnP routers that forward individual ports are not overwhelmed; on ASUSTOR NAS, EZ-Router does not register this UDP range, so a manual static router port-forward rule for 49152–49167/udp is still required.
• Added an automated NAS package test suite covering ADM registry marks, listeners, and end-to-end tunnel verification.

0.53.0-8

• Documented that --turn-public-ip is required whenever TURN is enabled for calls through firewalls (--turn-realm set).
• Updated the STUN/TURN check to compare turn-public-ip against the router’s live public IP and warn on drift.

0.53.0-7

• Fixed an installer crash (unbound variable) in post-install.sh when ADM invoked the script without positional arguments.
• Improved cleanup of legacy registration entries in /usr/builtin/etc/resource.conf across package upgrades.