I learned it is actually about the client security settings, see:
ssh on your synology
mono /volume1/@appstore/Duplicati/Duplicati.Server.exe --webservice-interface=any --webservice-port=5600 --webservice-interface=* --webservice-allowed-host=*
Works here.