diff --git a/cmd/tailscale/cli/web.go b/cmd/tailscale/cli/web.go
index 536febe40..81f8b13e4 100644
--- a/cmd/tailscale/cli/web.go
+++ b/cmd/tailscale/cli/web.go
@@ -26,6 +26,7 @@ import (
 	"strings"
 
 	"github.com/peterbourgon/ff/v3/ffcli"
+	"tailscale.com/envknob"
 	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/tailcfg"
@@ -59,6 +60,7 @@ type tmplData struct {
 	AdvertiseRoutes   string
 	LicensesURL       string
 	TUNMode           bool
+	IsSynology        bool
 }
 
 var webCmd = &ffcli.Command{
@@ -410,6 +412,7 @@ func webHandler(w http.ResponseWriter, r *http.Request) {
 		DeviceName:   deviceName,
 		LicensesURL:  licensesURL(),
 		TUNMode:      st.TUN,
+		IsSynology:   distro.Get() == distro.Synology || envknob.Bool("TS_FAKE_SYNOLOGY"),
 	}
 	exitNodeRouteV4 := netip.MustParsePrefix("0.0.0.0/0")
 	exitNodeRouteV6 := netip.MustParsePrefix("::/0")
diff --git a/cmd/tailscale/cli/web.html b/cmd/tailscale/cli/web.html
index 76ff6f3eb..34644cb5d 100644
--- a/cmd/tailscale/cli/web.html
+++ b/cmd/tailscale/cli/web.html
@@ -98,6 +98,13 @@
 	<div class="mb-4">
 		<a href="#" class="mb-4 link font-medium js-loginButton" target="_blank">Reauthenticate</a>
 	</div>
+	{{ if .IsSynology }}
+		<div class="mb-4">
+			<b>Outgoing access:</b>
+			{{ if .TUNMode }} enabled {{ else }} not configured {{ end }}
+			<nobr>[<a href="https://tailscale.com/kb/1152/synology-outbound/">docs</a>]</nobr>
+		</div>
+	{{ end }}
 	{{ end }}
 </main>
 <footer class="container max-w-lg mx-auto text-center">