If you have a restrictive firewall, Synology devices need two URLs allowed outbound to update:

  • download.synology.com
  • update.synology.com

I couldn’t really find this information anywhere else, so here you go.