Tailscale being merely a wrapper around Wireguard, which is pretty close to optimally efficient, I don’t think there’s much of an improvement to be expected by rolling your own or hopping over your VPS. You should probably start with investigating what’s causing the tailscale connection instability (is it your ISP? Is it the network on the side of the NAS?). If you are not bound to Borg, perhaps you can give a shot at Kopia, I found it to be much more performant for my use-cases, and it has a http “repository server” which you might be able to use with less protocols overhead than through your current setup.

So Tailscale connection instability is not common? I don’t like debugging this, since the NAS is remote and I don’t have much time going to the family member again and again for this. It definitely is something on the remote site, since the tailscale connections at my home are stable.

I will definitely have a look at Kopia. I was in search of a good open source backup solution, since borg also has its flaws. I will check it out, when I setup the remote NAS again (as I also want to put bigger disks in it)

Yes it is uncommon, as people have mentioned it is a Wireguard wrapper. Try just using Wireguard and troubleshoot from there. I would want to know what that 'simple' solution is failing. Your workaround could have similar issues.

Try just using Wireguard and troubleshoot from there

Troubleshooting wireguard is a pain in the ass, it using UDP and all that.

Why would UDP be any more difficult than TCP (or anything else) for troubleshooting? If nothing else, it should be easier because there are no stateful connections and every packet is “fire and forget”. Now, as a tunneling technology, WG might be more difficult than a simple client/server socket-driven application, but that just means some routing tables need to be inspected and you have to understand IP subnets. In any case, you’d still want to obtain packet traces from both ends of the WG tunnel.

With TCP there are built in listeners on OSs which you can use to test. Also TCP will work before UDP. For whatever reason firewalls and such do weird things with UDP traffic. I always use a cli tool that I can't remember the name of for testing.