NBN Remote Access Reality Checker: Can You Actually Access Your NAS Remotely?

CGNAT (carrier-grade NAT) means your connection shares a public IPv4 address with other customers, so a connection started from outside cannot be forwarded to your NAS: the port forwarding rule in your router is correct and still never sees the traffic. RFC 6598 reserves 100.64.0.0/10 as Shared Address Space for carrier-grade NAT, so a router WAN address in 100.64.0.0 to 100.127.255.255 means the connection is behind CGNAT.

Of the 11 providers NTK tracks, 5 state that they use CGNAT by default (Aussie Broadband, Belong, Launtel, SpinTel and Superloop); 1 does not (Telstra). For Exetel, Leaptel, Optus, TPG and iiNet, the provider's own documentation does not settle it, so the table shows exactly what it says. Each row in the provider table on this page shows when NTK read the provider's documentation and links to it. Providers NTK does not track are not listed.

Open your router's admin page and find its WAN (internet) IPv4 address. If it is between 100.64.0.0 and 100.127.255.255, you are behind CGNAT. If it matches the address a "what is my IP" search shows, your router has a public address. RFC 6598 reserves 100.64.0.0/10 as Shared Address Space for carrier-grade NAT, so a router WAN address in 100.64.0.0 to 100.127.255.255 means the connection is behind CGNAT.

Yes. Everything you reach from outside your home is served by your upload, not your download. At 20 Mbps upload, about 2 remote streams at 10 Mbps (Plex's example 1080p file) fit, or about 5 at 4 Mbps (Plex's example 720p file), before anything else uses the upload. The upload of each nbn tier for your connection type is in the checker above, or type the upload you measured.

Synology says QuickConnect lets its apps reach your NAS over the internet without setting up port forwarding rules. Synology says QuickConnect is relayed through a Synology Relay Server when a direct QuickConnect connection is not possible, and that a relayed connection may be slow. QNAP says myQNAPcloud Link reaches your NAS over the internet without port forwarding settings on the router, and picks the connection itself based on your network.

Tailscale is a mesh VPN you install on the NAS and on each device you connect from. Tailscale's Personal plan is free and covers up to 6 users with unlimited user devices. Tailscale says every connection starts relayed through its DERP servers and is then upgraded to a direct connection where it can be; if that fails it tries a peer relay you have set up, and otherwise stays relayed through DERP, which is generally slower than direct. Tailscale lists a DERP relay region in Sydney, and `tailscale netcheck` shows which relays your device can use.

A static IP is a public IPv4 address that stays the same. It allows inbound connections if your router forwards them, which CGNAT does not. Some providers also offer a public IPv4 address that may change. What each provider offers, and what it costs, is in the provider table on this page. A public address removes the CGNAT barrier, not every block: your provider may still block some inbound ports. Aussie Broadband lists inbound TCP ports 80 and 443 as blocked on its network, and says ports can be unblocked in MyAussie only with a static IP or after opting out of CGNAT. If your public address may change, DDNS keeps a name pointed at it. Synology says DDNS lets you reach your NAS over the internet by a hostname mapped to its IP address, so you do not need to know the address itself.

Forwarding a port exposes that service to the whole internet, so open as little as you can, and never the NAS's own admin page (DSM or QTS). QNAP's first security recommendation is not to expose the NAS to the internet: connect remotely through myQNAPcloud Link or its VPN service instead, and avoid opening default port numbers to the internet. Synology lists DSM's default management ports (HTTP 5000, HTTPS 5001, SSH 22) and says changing them helps block malicious login attempts. Synology strongly recommends opening public ports on the router only for the services you need. Synology recommends HTTPS for DSM and its web packages, and multi-factor authentication for DSM accounts. Synology announces fixed vulnerabilities on its security advisory page. QNAP asks users to get security patches and advisories from its website and update their software regularly.