Remote Access on UGREEN NAS: UGOS Pro, VPN and NBN Explained

Getting remote access to a UGREEN NAS on Australian NBN has one step most online guides skip: checking whether your connection is behind CGNAT. If it is, port forwarding will not work. This guide walks through every working method, from UGOS Pro built-in relay to Tailscale to a self-hosted WireGuard VPN.

The Australian NBN CGNAT Problem Explained

Many Australian NBN providers use Carrier-Grade NAT (CGNAT) on residential plans. Your router's WAN IP address is a private address (typically in the 100.64.0.0/10 range) shared among hundreds of customers. The ISP holds the public IP and translates outgoing traffic. Incoming connections from the internet cannot reach your router because there is no dedicated public IP to target.

How to check if you are on CGNAT: Log in to your router admin page (usually 192.168.0.1 or 192.168.1.1) and find the WAN IP address. Then search what is my IP in a browser on the same network. If the two addresses are different, you are on CGNAT. If they match, you have a direct public IP and port forwarding will work.

Providers known to use CGNAT on at least some plans include TPG, iiNet, Vodafone, and many MVNOs. Aussie Broadband and Superloop typically offer direct public IPs on standard plans but vary by connection type. Telstra plans for FTTN sometimes use CGNAT. If you are uncertain, call your ISP and ask directly: do I have a dedicated public IP on my plan?

Option 1: UGOS Pro Built-In Remote Access

UGOS Pro includes a built-in remote access feature that works through UGREEN's relay infrastructure. It does not require a public IP or port forwarding, so it works on CGNAT connections.

To enable remote access in UGOS Pro:

1. In UGOS Pro, go to Settings.
2. Find Network and then Remote Access (the exact path varies slightly by firmware version).
3. Enable the remote access toggle. UGOS Pro generates a unique device link.
4. On your remote device (phone or laptop), download the UGOS Pro mobile app or use the UGOS Pro web portal at your device's remote link.
5. Log in with your NAS admin credentials.

Limitations: UGOS Pro's built-in remote access routes traffic through UGREEN's relay servers. Connection speed depends on the relay server proximity and load. For general file access and management this is acceptable. For streaming large media files or accessing Plex remotely, the relay may throttle bandwidth or introduce latency. For high-bandwidth remote use, Tailscale or a VPN is preferable.

Option 2: Tailscale (Recommended for Most Users)

Tailscale is a managed VPN service built on WireGuard. It creates an encrypted network between your devices using Tailscale's coordination servers to handle NAT traversal. It works through CGNAT without needing a public IP or port forwarding.

The free plan supports up to 3 users and 100 devices, which covers most households.

Setting up Tailscale on UGREEN DXP NAS:

1. Create a free account at tailscale.com.
2. In UGOS Pro App Centre, search for Tailscale. If it appears, click Install. If it does not appear, install Portainer first and then deploy the tailscale/tailscale Docker image through Portainer.
3. Once the Tailscale container starts, open its logs in App Centre. You will see an authentication URL. Open that URL in a browser and sign in to link the NAS to your Tailscale account.
4. Your NAS now appears as a device in your Tailscale network at a 100.x.x.x IP address (the Tailscale address).
5. Install Tailscale on your phone or laptop and sign in with the same account.
6. Enable Tailscale on your remote device before accessing the NAS. Use the Tailscale IP (100.x.x.x) or the device name to connect. Your NAS appears as if it is on your local network.

With Tailscale active, you can access UGOS Pro at http://100.x.x.x:9000, browse NAS shares via SMB using your Tailscale IP, and reach any container port without separate port forwarding rules.

Option 3: WireGuard VPN (Self-Hosted)

WireGuard is a fast, modern VPN protocol. Running a WireGuard server on your UGREEN NAS gives you a self-hosted VPN that remote devices connect to. This option requires a public IP (not CGNAT) and a forwarded UDP port on your router.

When to use WireGuard instead of Tailscale:

• You have a public IP and do not want to depend on a third-party coordination service.
• You want a VPN that works without any cloud service once set up.
• You manage an office or multi-user setup where you need fine-grained access control.

Setting up WireGuard via WG-Easy on UGOS Pro:

1. Ensure your NAS has a public IP (check your router WAN IP matches your browser public IP).
2. Forward UDP port 51820 on your router to your NAS IP address. Reserve a static DHCP entry for your NAS first.
3. In Portainer, deploy the wg-easy/wg-easy Docker image. WG-Easy is a pre-configured WireGuard server with a web management interface.
4. Set the WG_HOST environment variable to your public IP address or a dynamic DNS domain name.
5. Access the WG-Easy web UI (default port 51821) to create client configurations.
6. Download the client config on your phone or laptop. Import it into the WireGuard app.
7. Connect to WireGuard. Your device routes traffic through the NAS, giving full access to your home network.

For a dynamic public IP (which changes after each router restart), use a free dynamic DNS provider like DuckDNS. Point a subdomain at your current public IP and use the subdomain as your WG_HOST. Update the DNS record automatically with a small DuckDNS Docker container.

Comparing the Three Remote Access Methods

Troubleshooting Remote Access on Australian NBN

The most common remote access failure on Australian NBN is CGNAT blocking inbound connections. You can verify whether your connection is behind CGNAT by comparing the IP shown on your router's WAN interface against the IP shown at a public IP check site like icanhazip.com. If the two differ, you are behind CGNAT and port forwarding will not work. Tailscale or UGREEN Connect are the solutions; do not spend time troubleshooting port forwarding in this situation.

The second common failure is the UGREEN Connect app timing out on first login. This usually means the DXP NAS is not registered under the correct UGREEN ID. Verify by logging into the UGOS Pro web interface locally (http://NAS-IP:8080), checking Settings > UGREEN Connect, and confirming the account shown matches the ID used in the mobile app. Unregistering and re-registering resolves most connection issues.

ISP-Specific Notes: Which Australian ISPs Use CGNAT

CGNAT is near-universal on Australian residential NBN plans as of 2026. Telstra, Optus, TPG, iinet, Exetel, Internode, and most resellers use CGNAT by default. Aussie Broadband is the notable exception: they offer static IP addresses for residential and business plans at no extra cost (subject to availability). A static IP eliminates the CGNAT problem and allows direct port forwarding without a relay service.

If you need direct port-forward access and your ISP uses CGNAT, the alternatives are: request a static IP from your ISP (if available, typically $5 to $15 per month extra for those that offer it), switch to Aussie Broadband or another ISP that does not use CGNAT on your plan tier, or use Tailscale which works regardless of CGNAT. UGREEN Connect also works regardless of CGNAT as it uses UGREEN's relay servers.

Domain Names and HTTPS: Making Remote Access More Reliable

Remote access via an IP address (e.g. http://112.23.45.67:8080) has two problems: residential IP addresses on most Australian ISPs change periodically (dynamic IP), and HTTP access is not encrypted. Solving both requires a domain name with Dynamic DNS (DDNS) and an HTTPS certificate.

UGOS Pro supports Dynamic DNS directly under Settings > DDNS. UGREEN provides a free DDNS hostname in the format yourname.ugreen.link. Point your remote access app at this hostname instead of an IP address, and the DDNS service updates automatically when your ISP changes your IP. For HTTPS, UGOS Pro can generate a free Let's Encrypt certificate under Settings > Security > HTTPS Certificate, which encrypts all remote access traffic without cost.

Related reading: our NAS buyer's guide, our remote access and VPN guide, and our UGREEN brand guide.

Use our free NBN Remote Access Checker to check if your NBN plan supports NAS remote access.

Does the UGREEN DH4300 Plus support Tailscale?

Not directly. Tailscale on a NAS requires running it as a Docker container, and Docker is only available on UGREEN DXP models with UGOS Pro. DH series models (DH2300, DH4300, DH4300 Plus) do not support Docker. For DH series remote access, use UGOS Pro's built-in remote access feature. Alternatively, install Tailscale on a Raspberry Pi or another device on your home network and use subnet routing to reach the NAS through that device.

How do I know if my ISP uses CGNAT?

Compare your router's WAN IP address with your browser-visible public IP (search what is my IP online). If the two addresses differ, you are behind CGNAT. Alternatively, call your ISP and ask directly. Providers known to use CGNAT on residential plans include TPG, Vodafone, and many budget MVNOs. Aussie Broadband and Superloop generally provide direct public IPs on standard plans. If you need a public IP and your current ISP charges for it or does not offer one, consider switching providers.

Can I access my UGREEN NAS remotely with a free account?

Yes. UGOS Pro's built-in remote access is included with the NAS at no extra cost. Tailscale is free for up to 3 users and 100 devices. WireGuard is fully free and self-hosted. There is no subscription required for any of the three methods described in this guide. Plex remote access is the exception: if you use Plex, hardware transcoding and relay access above 2 Mbps require a Plex Pass subscription.

Is it safe to expose my UGREEN NAS to the internet?

Do not expose NAS management ports (port 9000 for UGOS Pro, port 22 for SSH) directly to the internet. These are targets for brute force attacks. Use a VPN or Tailscale instead of direct port exposure. If you must expose a service (like a web application), use a reverse proxy with HTTPS and enforce strong authentication. Keep UGOS Pro firmware updated and disable unused services. WireGuard or Tailscale are both safer than direct port exposure because they authenticate devices before allowing any traffic through.

What is the best way to stream Plex remotely on a UGREEN NAS?

Install Tailscale on both your NAS and your remote device. With Tailscale active on your phone, Plex sees your phone as local to the NAS. Streams play at full quality with no relay cap. Without Tailscale, Plex uses its own relay which limits remote streams to around 2 Mbps (720p or lower). If you have a public IP, you can also forward port 32400 to your NAS for direct Plex remote access without any additional software. See our Plex setup guide for UGREEN NAS for full configuration steps.

Does UGREEN Connect work when the NAS is powered off or in sleep mode?

No. UGREEN Connect requires the NAS to be on and connected to the internet. If the NAS enters power-saving sleep (HDD hibernation mode), UGREEN Connect will time out until the NAS wakes up. Wake-on-LAN (WoL) can power the NAS on remotely, but this requires the NAS to be on the same LAN as a device that can send the WoL packet. For always-available remote access, configure the NAS to run continuously without deep sleep rather than relying on WoL.

Can I access a UGREEN NAS remotely from Windows without installing the UGREEN app?

Yes, via SMB over Tailscale. Install Tailscale on both the NAS (available in UGOS Pro Docker as a container) and the Windows PC. Once connected to the same Tailscale network, the NAS appears by its Tailscale IP address and Windows can map it as a network drive using File Explorer > Map Network Drive > \\TAILSCALE-IP\ShareName. No UGREEN app required, and the connection is encrypted end-to-end by WireGuard.

Is UGREEN Connect safe? Does UGREEN see my files?

UGREEN Connect uses relay servers when a direct peer-to-peer connection cannot be established (common behind CGNAT). The connection is encrypted in transit. However, UGREEN's infrastructure processes the relay traffic, which means the company's servers act as an intermediary. For files containing sensitive personal or business data, Tailscale with WireGuard encryption provides a technically stronger privacy guarantee because traffic goes peer-to-peer without a third-party relay. For most home users, UGREEN Connect is acceptable; for business use with confidential data, Tailscale is recommended.