Getting remote access to a UGREEN NAS on Australian NBN has one step most online guides skip: checking whether your connection is behind CGNAT. If it is, port forwarding will not work. This guide walks through every working method, from UGOS Pro built-in relay to Tailscale to a self-hosted WireGuard VPN.
In short: For most UGREEN DXP users on Australian NBN, Tailscale is the easiest remote access solution. It is free, bypasses CGNAT without needing a public IP, and takes about 10 minutes to set up via the UGOS Pro App Centre. UGOS Pro's built-in remote access also works but relies on UGREEN's relay servers. WireGuard is the best option if you want full self-hosted control and can get a public IP from your ISP.
The Australian NBN CGNAT Problem Explained
Many Australian NBN providers use Carrier-Grade NAT (CGNAT) on residential plans. Your router's WAN IP address is a private address (typically in the 100.64.0.0/10 range) shared among hundreds of customers. The ISP holds the public IP and translates outgoing traffic. Incoming connections from the internet cannot reach your router because there is no dedicated public IP to target.
How to check if you are on CGNAT: Log in to your router admin page (usually 192.168.0.1 or 192.168.1.1) and find the WAN IP address. Then search what is my IP in a browser on the same network. If the two addresses are different, you are on CGNAT. If they match, you have a direct public IP and port forwarding will work.
Providers known to use CGNAT on at least some plans include TPG, iiNet, Vodafone, and many MVNOs. Aussie Broadband and Superloop typically offer direct public IPs on standard plans but vary by connection type. Telstra plans for FTTN sometimes use CGNAT. If you are uncertain, call your ISP and ask directly: do I have a dedicated public IP on my plan?
Option 1: UGOS Pro Built-In Remote Access
UGOS Pro includes a built-in remote access feature that works through UGREEN's relay infrastructure. It does not require a public IP or port forwarding, so it works on CGNAT connections.
To enable remote access in UGOS Pro:
- In UGOS Pro, go to Settings.
- Find Network and then Remote Access (the exact path varies slightly by firmware version).
- Enable the remote access toggle. UGOS Pro generates a unique device link.
- On your remote device (phone or laptop), download the UGOS Pro mobile app or use the UGOS Pro web portal at your device's remote link.
- Log in with your NAS admin credentials.
Limitations: UGOS Pro's built-in remote access routes traffic through UGREEN's relay servers. Connection speed depends on the relay server proximity and load. For general file access and management this is acceptable. For streaming large media files or accessing Plex remotely, the relay may throttle bandwidth or introduce latency. For high-bandwidth remote use, Tailscale or a VPN is preferable.
Option 2: Tailscale (Recommended for Most Users)
Tailscale is a managed VPN service built on WireGuard. It creates an encrypted network between your devices using Tailscale's coordination servers to handle NAT traversal. It works through CGNAT without needing a public IP or port forwarding.
The free plan supports up to 3 users and 100 devices, which covers most households.
Setting up Tailscale on UGREEN DXP NAS:
- Create a free account at tailscale.com.
- In UGOS Pro App Centre, search for Tailscale. If it appears, click Install. If it does not appear, install Portainer first and then deploy the tailscale/tailscale Docker image through Portainer.
- Once the Tailscale container starts, open its logs in App Centre. You will see an authentication URL. Open that URL in a browser and sign in to link the NAS to your Tailscale account.
- Your NAS now appears as a device in your Tailscale network at a 100.x.x.x IP address (the Tailscale address).
- Install Tailscale on your phone or laptop and sign in with the same account.
- Enable Tailscale on your remote device before accessing the NAS. Use the Tailscale IP (100.x.x.x) or the device name to connect. Your NAS appears as if it is on your local network.
With Tailscale active, you can access UGOS Pro at http://100.x.x.x:9000, browse NAS shares via SMB using your Tailscale IP, and reach any container port without separate port forwarding rules.
Tailscale MagicDNS: Enable MagicDNS in your Tailscale admin panel at tailscale.com. This lets you reach your NAS by name (e.g. ugreen-nas) instead of the 100.x.x.x IP address. When you rename the NAS device in Tailscale, the MagicDNS name updates automatically.
Option 3: WireGuard VPN (Self-Hosted)
WireGuard is a fast, modern VPN protocol. Running a WireGuard server on your UGREEN NAS gives you a self-hosted VPN that remote devices connect to. This option requires a public IP (not CGNAT) and a forwarded UDP port on your router.
When to use WireGuard instead of Tailscale:
- You have a public IP and do not want to depend on a third-party coordination service.
- You want a VPN that works without any cloud service once set up.
- You manage an office or multi-user setup where you need fine-grained access control.
Setting up WireGuard via WG-Easy on UGOS Pro:
- Ensure your NAS has a public IP (check your router WAN IP matches your browser public IP).
- Forward UDP port 51820 on your router to your NAS IP address. Reserve a static DHCP entry for your NAS first.
- In Portainer, deploy the wg-easy/wg-easy Docker image. WG-Easy is a pre-configured WireGuard server with a web management interface.
- Set the WG_HOST environment variable to your public IP address or a dynamic DNS domain name.
- Access the WG-Easy web UI (default port 51821) to create client configurations.
- Download the client config on your phone or laptop. Import it into the WireGuard app.
- Connect to WireGuard. Your device routes traffic through the NAS, giving full access to your home network.
For a dynamic public IP (which changes after each router restart), use a free dynamic DNS provider like DuckDNS. Point a subdomain at your current public IP and use the subdomain as your WG_HOST. Update the DNS record automatically with a small DuckDNS Docker container.
Comparing the Three Remote Access Methods
Remote Access Methods for UGREEN NAS on Australian NBN
| UGOS Pro Built-In | Tailscale | WireGuard (WG-Easy) | |
|---|---|---|---|
| Works on CGNAT | Yes | Yes | No (requires public IP) |
| Setup Difficulty | Easy (built-in toggle) | Easy (10 min install) | Moderate (port forward + compose) |
| Speed / Bandwidth | Limited by relay servers | Good (relay or P2P) | Excellent (direct) |
| Requires Third-Party Account | UGREEN account | Tailscale account (free) | None (fully self-hosted) |
| Works on DH Series (ARM) | Yes | Docker required (DXP only) | Docker required (DXP only) |
| Access All NAS Features | UGOS Pro apps only | Full network access | Full network access |
| Cost | Free | Free (up to 3 users) | Free (self-hosted) |
| Best For | Simple DH/DXP access via UGREEN app | Most DXP users on CGNAT NBN | Power users with public IP |
Related reading: our NAS buyer's guide, our remote access and VPN guide, and our UGREEN brand guide.
Use our free NBN Remote Access Checker to check if your NBN plan supports NAS remote access.
Does the UGREEN DH4300 Plus support Tailscale?
Not directly. Tailscale on a NAS requires running it as a Docker container, and Docker is only available on UGREEN DXP models with UGOS Pro. DH series models (DH2300, DH4300, DH4300 Plus) do not support Docker. For DH series remote access, use UGOS Pro's built-in remote access feature. Alternatively, install Tailscale on a Raspberry Pi or another device on your home network and use subnet routing to reach the NAS through that device.
How do I know if my ISP uses CGNAT?
Compare your router's WAN IP address with your browser-visible public IP (search what is my IP online). If the two addresses differ, you are behind CGNAT. Alternatively, call your ISP and ask directly. Providers known to use CGNAT on residential plans include TPG, Vodafone, and many budget MVNOs. Aussie Broadband and Superloop generally provide direct public IPs on standard plans. If you need a public IP and your current ISP charges for it or does not offer one, consider switching providers.
Can I access my UGREEN NAS remotely with a free account?
Yes. UGOS Pro's built-in remote access is included with the NAS at no extra cost. Tailscale is free for up to 3 users and 100 devices. WireGuard is fully free and self-hosted. There is no subscription required for any of the three methods described in this guide. Plex remote access is the exception: if you use Plex, hardware transcoding and relay access above 2 Mbps require a Plex Pass subscription.
Is it safe to expose my UGREEN NAS to the internet?
Do not expose NAS management ports (port 9000 for UGOS Pro, port 22 for SSH) directly to the internet. These are targets for brute force attacks. Use a VPN or Tailscale instead of direct port exposure. If you must expose a service (like a web application), use a reverse proxy with HTTPS and enforce strong authentication. Keep UGOS Pro firmware updated and disable unused services. WireGuard or Tailscale are both safer than direct port exposure because they authenticate devices before allowing any traffic through.
What is the best way to stream Plex remotely on a UGREEN NAS?
Install Tailscale on both your NAS and your remote device. With Tailscale active on your phone, Plex sees your phone as local to the NAS. Streams play at full quality with no relay cap. Without Tailscale, Plex uses its own relay which limits remote streams to around 2 Mbps (720p or lower). If you have a public IP, you can also forward port 32400 to your NAS for direct Plex remote access without any additional software. See our Plex setup guide for UGREEN NAS for full configuration steps.
Setting up remote access for a UGREEN NAS you have not bought yet? Compare all current UGREEN DXP models with Docker and VPN support to find the right fit for your setup.
Compare UGREEN DXP Models