Getting remote access to a UGREEN NAS on Australian NBN has one step most online guides skip: checking whether your connection is behind CGNAT. If it is, port forwarding will not work. This guide walks through every working method, from UGOS Pro built-in relay to Tailscale to a self-hosted WireGuard VPN.
In short: For most UGREEN DXP users on Australian NBN, Tailscale is the easiest remote access solution. It is free, bypasses CGNAT without needing a public IP, and takes about 10 minutes to set up via the UGOS Pro App Centre. UGOS Pro's built-in remote access also works but relies on UGREEN's relay servers. WireGuard is the best option if you want full self-hosted control and can get a public IP from your ISP.
The Australian NBN CGNAT Problem Explained
Many Australian NBN providers use Carrier-Grade NAT (CGNAT) on residential plans. Your router's WAN IP address may be in shared or private address space, including the 100.64.0.0/10 range, with a public IPv4 address shared among multiple customers. The ISP holds the public IP and translates outgoing traffic. Incoming connections from the internet cannot reach your router because there is no dedicated public IP to target.
How to check if you are on CGNAT: Log in to your router admin page (usually 192.168.0.1 or 192.168.1.1) and find the WAN IP address. Then search what is my IP in a browser on the same network. If the addresses differ, your connection may be behind CGNAT, double NAT or another upstream NAT layer. If they match, direct access is more likely, but successful port forwarding still depends on the router, firewall and ISP.
Providers known to use CGNAT on at least some plans include TPG, iiNet, Vodafone, and many MVNOs. Aussie Broadband and Superloop use CGNAT on residential services by default, although Aussie Broadband permits a CGNAT opt-out on request and Superloop offers a paid static-IP option. Telstra states that it does not use CGNAT on its home or business internet services. If you are uncertain, call your ISP and ask directly: do I have a dedicated public IP on my plan?
Option 1: UGOS Pro Built-In Remote Access
UGOS Pro includes a built-in remote access feature that works through UGREEN's relay infrastructure. It does not require a public IP or port forwarding, so it works on CGNAT connections.
To enable remote access in UGOS Pro:
- In UGOS Pro, open Control Panel > Device Connection > Remote access.
- Enable the remote access toggle. UGOS Pro generates a unique device link.
- On your remote device (phone or laptop), download the UGOS Pro mobile app or use the UGOS Pro web portal at your device's remote link.
- Log in with the credentials for an appropriately permissioned NAS account.
Limitations: UGOS Pro's built-in remote access routes traffic through UGREEN's relay servers. Connection speed depends on the relay server proximity and load. For general file access and management this is acceptable. For streaming large media files or accessing Plex remotely, the relay may throttle bandwidth or introduce latency. For high-bandwidth remote use, Tailscale or a VPN is preferable.
Option 2: Tailscale (Recommended for Most Users)
Tailscale is a managed VPN service built on WireGuard. It creates an encrypted network between your devices using Tailscale's coordination servers to handle NAT traversal. It works through CGNAT without needing a public IP or port forwarding.
The current Personal plan supports up to 6 users and unlimited user devices, with separate limits for tagged and ephemeral resources.
Setting up Tailscale on UGREEN DXP NAS:
- Create a free account at tailscale.com.
- On UGREEN NAS, deploy Tailscale through the UGOS Pro Docker app using a properly configured Docker Compose project and the current official Tailscale container instructions.
- Once the Tailscale container starts, open its logs in App Centre. You will see an authentication URL. Open that URL in a browser and sign in to link the NAS to your Tailscale account.
- Your NAS now appears as a device in your Tailscale network at a 100.x.x.x IP address (the Tailscale address).
- Install Tailscale on your phone or laptop and sign in with the same account.
- Enable Tailscale on your remote device before accessing the NAS. Use the Tailscale IP (100.x.x.x) or the device name to connect. Your NAS appears as if it is on your local network.
With a correctly configured Tailscale Docker deployment, UGOS Pro can be reached at the NAS Tailscale address using its configured management port (default HTTP 9999 or HTTPS 9443). SMB and container access also depend on the container’s networking and access-control configuration.
Tailscale MagicDNS: Enable MagicDNS in your Tailscale admin panel at tailscale.com. This lets you reach your NAS by name (e.g. ugreen-nas) instead of the 100.x.x.x IP address. When you rename the NAS device in Tailscale, the MagicDNS name updates automatically.
Option 3: WireGuard VPN (Self-Hosted)
WireGuard is a fast, modern VPN protocol. Running a WireGuard server on your UGREEN NAS gives you a self-hosted VPN that remote devices connect to. This option requires a public IP (not CGNAT) and a forwarded UDP port on your router.
When to use WireGuard instead of Tailscale:
- You have a public IP and do not want to depend on a third-party coordination service.
- You want a VPN that works without any cloud service once set up.
- You manage an office or multi-user setup where you need fine-grained access control.
Setting up WireGuard via WG-Easy on UGOS Pro:
- Ensure your NAS has a public IP (check your router WAN IP matches your browser public IP).
- Forward UDP port 51820 on your router to your NAS IP address. Reserve a static DHCP entry for your NAS first.
- Deploy a pinned current release of ghcr.io/wg-easy/wg-easy using the project’s current Docker Compose instructions, then enter the public hostname or IP address and WireGuard port during WG-Easy’s setup flow.
- Access the WG-Easy web UI (default port 51821) to create client configurations.
- Download the client config on your phone or laptop. Import it into the WireGuard app.
- Connect to WireGuard. Your device routes traffic through the NAS, giving full access to your home network.
For a dynamic public IP, which may change over time or after a reconnect, use a dynamic DNS provider such as DuckDNS. Point a subdomain at your current public IP and use the subdomain as your WG_HOST. Update the DNS record automatically with a small DuckDNS Docker container.
Comparing the Three Remote Access Methods
Remote Access Methods for UGREEN NAS on Australian NBN
| UGOS Pro Built-In | Tailscale | WireGuard (WG-Easy) | |
|---|---|---|---|
| Works on CGNAT | Yes | Yes | No (requires public IP) |
| Setup Difficulty | Easy (built-in toggle) | Easy (10 min install) | Moderate (port forward + compose) |
| Speed / Bandwidth | Limited by relay servers | Good (relay or P2P) | Excellent (direct) |
| Requires Third-Party Account | UGREEN account | Tailscale account (free) | None (fully self-hosted) |
| Works on DH Series (ARM) | Yes | Supported on Docker-capable DH4300 Plus; not supported on DH2300 | Supported on Docker-capable DH4300 Plus; not supported on DH2300 |
| Access All NAS Features | UGOS Pro apps only | Full network access | Full network access |
| Cost | Free | Free (up to 6 users on the current Personal plan) | Free (self-hosted) |
| Best For | Simple DH/DXP access via UGREEN app | Most DXP users on CGNAT NBN | Power users with public IP |
Troubleshooting Remote Access on Australian NBN
A common cause of failed inbound remote access is CGNAT or another upstream NAT layer. You can verify whether your connection is behind CGNAT by comparing the IP shown on your router's WAN interface against the IP shown at a public IP check site like icanhazip.com. If the two differ, your connection may be behind CGNAT, double NAT or another upstream NAT layer, and conventional port forwarding may not work. Tailscale or UGREEN Connect are the solutions; do not spend time troubleshooting port forwarding in this situation.
If the UGREEN NAS app times out during remote login, verify the UGREENlink ID, NAS account credentials and the NAS internet connection rather than assuming a single cause. Verify by logging into UGOS Pro locally at its configured management address (default http://NAS-IP:9999), then open Control Panel > Device Connection > Remote access and confirm the UGREENlink ID and account binding.
NBN CGNAT check: Open a terminal and run curl ifconfig.me. Compare against your router WAN IP. Different addresses may indicate CGNAT, double NAT or another upstream NAT layer. Matching addresses make direct access more likely but do not guarantee that port forwarding will work; ISP policies vary by provider and service.
ISP-Specific Notes: Which Australian ISPs Use CGNAT
CGNAT policy varies by provider and service type. Check the current policy for your exact plan: some providers use CGNAT by default, while Telstra states that it does not use CGNAT on home or business internet services. Aussie Broadband uses CGNAT by default but allows customers to request a CGNAT opt-out at no additional cost. A static IP is currently a paid add-on for residential services and is included with business broadband. A static IP eliminates the CGNAT problem and allows direct port forwarding without a relay service.
If you need direct port-forward access and your ISP uses CGNAT, the alternatives are: request a static IP from your ISP (if available, typically $5 to $15 per month extra for those that offer it), switch to Aussie Broadband or another ISP that does not use CGNAT on your plan tier, or use Tailscale which works regardless of CGNAT. UGREEN Connect also works regardless of CGNAT as it uses UGREEN's relay servers.
Domain Names and HTTPS: Making Remote Access More Reliable
Remote access via an IP address (e.g. http://112.23.45.67:8080) has two problems: residential IP addresses on most Australian ISPs change periodically (dynamic IP), and HTTP access is not encrypted. Solving both requires a domain name with Dynamic DNS (DDNS) and an HTTPS certificate.
UGOS Pro supports Dynamic DNS directly under Settings > DDNS. UGREENlink provides a remote URL in the format https://ug.link/your-UGREENlink-ID. UGOS Pro’s separate DDNS feature requires your own domain and a supported DDNS provider. Point your remote access app at this hostname instead of an IP address, and the DDNS service updates automatically when your ISP changes your IP. UGOS Pro supports HTTPS certificates, including Let's Encrypt for suitable domain-based connections. The certificate encrypts traffic that uses the configured HTTPS endpoint; other protocols require their own secure transport.
Related reading: our NAS buyer's guide, our remote access and VPN guide, and our UGREEN brand guide.
Use our free NBN Remote Access Checker to check if your NBN plan supports NAS remote access.
See also: our complete UGREEN NAS Australia guide.
Looking for UGREEN accessories?
UGREEN also makes chargers, power banks, USB-C docks, wireless chargers, Ethernet adapters and storage accessories. We have sorted the Australian range into the products actually worth considering.
Browse UGREEN accessories →Use our free NBN Plan Finder to compare real NBN plans by upload speed, CGNAT and static IP support.
Does the UGREEN DH4300 Plus support Tailscale?
Yes. UGREEN documents ARM64 Docker support on the DH4300 Plus, so Tailscale can be deployed through Docker with an ARM64-compatible configuration. The DH2300 does not support Docker. For DH series remote access, use UGOS Pro's built-in remote access feature. Alternatively, install Tailscale on a Raspberry Pi or another device on your home network and use subnet routing to reach the NAS through that device.
How do I know if my ISP uses CGNAT?
Compare your router's WAN IP address with your browser-visible public IP. If they differ, you may be behind CGNAT, double NAT or another upstream NAT layer; confirm with your ISP. Alternatively, call your ISP and ask directly. Providers known to use CGNAT on residential plans include TPG, Vodafone, and many budget MVNOs. Aussie Broadband and Superloop use CGNAT by default on relevant residential services, although public-IP options are available under each provider’s current policy. If you need a public IP and your current ISP charges for it or does not offer one, consider switching providers.
Can I access my UGREEN NAS remotely with a free account?
Yes. UGOS Pro's built-in remote access is included with the NAS at no extra cost. UGREENlink, WireGuard and Tailscale’s current Personal plan can be used without an access-method subscription; Tailscale currently allows up to 6 Personal users and unlimited user devices. Plex remote personal-video playback may require Plex Pass or Remote Watch Pass, and Plex Relay is capped at 2 Mbps even for subscribers.
Is it safe to expose my UGREEN NAS to the internet?
Do not expose NAS management ports (the configured UGOS Pro management port (default HTTP 9999 or HTTPS 9443), port 22 for SSH) directly to the internet. These are targets for brute force attacks. Use a VPN or Tailscale instead of direct port exposure. If you must expose a service (like a web application), use a reverse proxy with HTTPS and enforce strong authentication. Keep UGOS Pro firmware updated and disable unused services. WireGuard or Tailscale are both safer than direct port exposure because they authenticate devices before allowing any traffic through.
What is the best way to stream Plex remotely on a UGREEN NAS?
Install Tailscale on both your NAS and your remote device. A correctly configured Tailscale connection can give Plex a direct network path and avoid Plex Relay, but Plex does not automatically classify every Tailscale address as local and stream quality still depends on Plex, server, client and network settings. Plex Relay is used only when a direct connection cannot be established and is capped at 2 Mbps. If you have a public IP, you can also forward port 32400 to your NAS for direct Plex remote access without any additional software. See our Plex setup guide for UGREEN NAS for full configuration steps.
Does UGREEN Connect work when the NAS is powered off or in sleep mode?
No. UGREEN Connect requires the NAS to be on and connected to the internet. If the NAS is powered off, UGREENlink cannot connect until the NAS is powered on. HDD hibernation is a separate state in which the NAS can remain online and wake the disks when storage access is required. Wake-on-LAN (WoL) can power the NAS on remotely, but this requires the NAS to be on the same LAN as a device that can send the WoL packet. For always-available remote access, configure the NAS to run continuously without deep sleep rather than relying on WoL.
Can I access a UGREEN NAS remotely from Windows without installing the UGREEN app?
Yes, via SMB over Tailscale. Install Tailscale on both the NAS (available in UGOS Pro Docker as a container) and the Windows PC. Once connected to the same Tailscale network, the NAS appears by its Tailscale IP address and Windows can map it as a network drive using File Explorer > Map Network Drive > \\TAILSCALE-IP\ShareName. No UGREEN app required, and the connection is encrypted end-to-end by WireGuard.
Is UGREEN Connect safe? Does UGREEN see my files?
UGREEN Connect uses relay servers when a direct peer-to-peer connection cannot be established (common behind CGNAT). The connection is encrypted in transit. However, UGREEN's infrastructure processes the relay traffic, which means the company's servers act as an intermediary. Tailscale encrypts device-to-device traffic end to end with WireGuard. It attempts a direct peer-to-peer path but may use a Tailscale DERP relay when direct connectivity is unavailable; the relay cannot decrypt the WireGuard traffic. For most home users, UGREEN Connect is acceptable; for business use with confidential data, Tailscale is recommended.
Setting up remote access for a UGREEN NAS you have not bought yet? Compare all current UGREEN DXP models with Docker and VPN support to find the right fit for your setup.