Default route / full tunnel mode for EdgeOS / Synology Docker

I want to configure default route / full tunnel mode on an EdgeRouter with EdgeOS 2.0 and on a Synology NAS running in Docker.
The KB page is not helpfull for me as I do know a bit about networking but not iptables.

EdgeOS has a GUI for SNAT/DNAT and I probably should use Masquerade. (I did not manage to show the ztxxxxxx interface in the GUI.)

On the NAS ZT is running as a docker image. Configuration should be rather standard if you know how.