How to Access Your UGREEN NAS Remotely: UGREENlink, DDNS, and Tailscale

If you want to access your UGREEN NAS while away from home or the office, there are three practical options: UGREENlink, DDNS, and Tailscale. UGREENlink and DDNS are built into UGOS Pro, while Tailscale is a third-party option that you can run through Docker. For most users, UGREENlink is the easiest place to start because it does not require a public IP address or manual router port forwarding.

Which Method Should You Choose?

Choose UGREENlink if you want the fastest setup and the least network configuration. It is designed for users who want remote access through a browser or app without dealing with router settings.

Choose DDNS if you want to access your NAS through your own domain name and you are comfortable managing router settings, public IP reachability, and port forwarding. DDNS gives you more control, but it also requires more careful setup.

Choose Tailscale if your priority is reducing direct public exposure and you are comfortable with Docker and basic network concepts. Tailscale creates a private mesh network called a tailnet. If you advertise and approve your home LAN as a subnet route, remote devices can reach your NAS by its normal LAN IP. Otherwise, you should use the NAS’s Tailscale IP or MagicDNS name instead.

If you are not sure where to start, begin with UGREENlink. Move to DDNS only if you specifically need your own domain name. Use Tailscale when you want private-network-style access without publishing the NAS management interface directly to the public internet.

Quick Comparison

Method 1: Remote Access with UGREENlink

UGREENlink is UGREEN NAS built-in remote access service. It is the simplest option because it does not require a public IP address or manual port forwarding on your router.

Setup Steps

1. Open Control Panel on your UGREEN NAS.
2. Go to Device Connection > Remote Access.
3. Turn on UGREENlink Remote Access Service.
4. Sign in to your UGREEN Cloud account. If you do not have one yet, create one first.
5. Enter a custom UGREENlink ID and click Apply.
6. After the ID passes validation, the system generates a web access link and a client ID.

Before enabling remote access, set a strong password for your NAS and enable two-factor authentication (2FA).

Tips for Choosing a UGREENlink ID

• Keep it short and easy to remember.
• Do not use personal information directly.
• If multiple people use the NAS, adopt a consistent naming convention, such as location plus purpose.

Accessing Through a Browser

1. Confirm that UGREENlink Remote Access Service is enabled on the NAS.
2. Open the generated URL in a browser. For example: https://ug.link/myNAS123
3. You will be redirected to the UGOS Pro login page.
4. Sign in and access your NAS.

Accessing Through the Client App

You can also connect remotely using the UGREEN NAS PC client or the UGREEN NAS mobile app.

1. Download and install the UGREEN NAS clienthei for PC or the UGREEN NAS app for iOS or Android.
2. Launch the app and enter your configured UGREENlink ID.
3. Complete the sign-in flow shown in the current client version.
4. Once authenticated, you can manage files and settings remotely.

If you access your NAS frequently, the client app usually provides a smoother experience than browser-only access.

Method 2: Remote Access with DDNS

DDNS is the right option when you want to access your NAS through your own domain name. UGOS Pro supports DDNS when your network has a reachable public IPv4 or IPv6 address. After configuration, you can access the NAS through your domain and the appropriate web port.

Before You Start: Check for a Public IP

Before setting up DDNS, confirm that your network actually has public reachability.

1. Open your router’s admin page and note the WAN IP address.
2. Visit a public IP-check site such as ip.me from a device on the same network.
3. Compare the two IP addresses.

If they match, your network is more likely to have direct public reachability. If they do not match, you may be behind carrier-grade NAT or another upstream NAT layer. In that case, DDNS may not work until the network issue is resolved. IPv6 may also be an option, depending on your ISP and router setup.

If your ISP does not provide a usable public endpoint, UGREENlink or Tailscale is usually the better choice.

Configure DDNS in UGOS Pro

1. Open Control Panel > Device Connection > Remote Access.
2. Turn on Enable DDNS support.
3. Click Add and select your DDNS provider.
4. Enter your domain name and the credentials required by that provider.
5. Run the connection test.
6. If the connection test succeeds, click Apply.

In UGOS Pro, the credential fields may appear as AccessKey ID / Key, but the exact values depend on the provider you use.

Reserve the NAS LAN IP on Your Router

If you use DDNS together with port forwarding, your NAS should keep a fixed LAN IP address. Otherwise, a router reboot or DHCP renewal can change the internal IP and break your forwarding rules.

Configure a DHCP reservation or static LAN assignment for the NAS in your router. Where possible, use manual port forwarding instead of relying on automatic mapping features such as UPnP.

Accessing the NAS with DDNS

After the DDNS setup is complete, access your NAS from an external network using your domain and the correct web port, for example:

• http://your-domain:9999
• https://your-domain:9443

UGOS Pro supports both HTTP and HTTPS for the web interface. By default, the HTTP port is 9999 and the HTTPS port is 9443. DDNS does not automatically mean HTTP-only access.

Optional: Add Trusted HTTPS with Nginx Proxy Manager

If you want your DDNS hostname to use a browser-trusted certificate on standard web ports, Nginx Proxy Manager is one practical option. It can sit in front of UGOS Pro, handle HTTPS, and forward requests to the NAS on its internal web port.

With this setup, the upstream target is usually the NAS LAN IP on port 9999 or 9443, depending on how you want to proxy it.

For a standard Nginx Proxy Manager deployment, publish TCP port 80 and TCP port 443 on the host running Nginx Proxy Manager. For ACME validation, HTTP-01 uses TCP port 80, while TLS-ALPN-01 uses TCP port 443. UDP is not part of those validation flows.

Basic Setup Flow

1. Confirm that your DDNS hostname resolves correctly.
2. Deploy Nginx Proxy Manager.
3. Create a proxy host for your DDNS domain.
4. Point that proxy host to the NAS LAN IP and the NAS web port.
5. Request a Let’s Encrypt certificate.
6. Save the host and test external access.

If you are using a free DDNS provider, review its current hostname limits before choosing it as your long-term solution.

Method 3: Remote Access with Tailscale

Tailscale is a VPN-based approach that lets devices join the same private tailnet. It is a good fit when you want remote access without exposing the NAS management interface directly to the public internet.

Preparation: Create an Account and Generate an Auth Key

1. Go to the Tailscale admin console and create an account using your preferred login method (Microsoft, Apple, Google, etc.).
   
   
   
   
2. Download the client from the admin console (you’ll install it on your PC and phone later).
3. In the admin console, go to the Keys page. Under Auth keys, select Generate auth key.
   
   
   
   

You’ll use this key in the container configuration on the NAS side. Treat it with the same care as a password.

Deploy Tailscale with Docker Compose

UGOS Pro supports Docker Compose, which makes it convenient to deploy Tailscale as a container. If you have not used it before, this Docker Compose guide for UGREEN NAS explains how a single compose file keeps your container settings organized and easy to recreate.

1. Open the Docker app.
2. Click Project > Create.
3. Paste the following Docker Compose configuration:

services:
  tailscale:
    container_name: tailscale
    image: tailscale/tailscale:latest
    hostname: ugreen-nas
    restart: unless-stopped
    environment:
      - TS_AUTHKEY=<YOUR_TAILSCALE_AUTH_KEY>
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_ROUTES=192.168.1.0/24
      - TS_USERSPACE=false
    volumes:
      - ./tailscale-state:/var/lib/tailscale
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
      - net_raw

4. Click Deploy Now to pull the image and start the container.

If you do not plan to use subnet routing, remove the TS_ROUTES line.

Key Parameters

Verify the Deployment

Once the container is running, open the Tailscale admin console and check whether your NAS appears in the Machines list.

If you are using subnet routing, open Edit route settings for that machine and approve the advertised subnet route. Without approval, other devices on your tailnet will not be able to use it.

Accessing the NAS

1. On the device you want to use for remote access, launch the Tailscale client and sign in with the same account.
2. Connect to the tailnet.
3. In your browser, enter one of the following:
   • The NAS’s Tailscale IP
   • Its MagicDNS name, if enabled
   • Its LAN IP, if you have configured and approved subnet routing

4. When the UGOS Pro login screen appears, sign in with your NAS account credentials.

As long as you are connected to Tailscale, you can reach your NAS remotely without directly exposing it to the public internet.

Security Essentials

Remote access always increases the importance of security controls, but not every method exposes your NAS in the same way.

• DDNS with forwarded ports exposes services directly to the internet.
• Tailscale is designed to avoid that direct public exposure by keeping access inside the tailnet.
• UGREENlink uses UGREEN’s remote access service rather than requiring you to publish the NAS management interface yourself.

No matter which method you choose, follow these basics:

• Set a strong password.
• Enable two-factor authentication (2FA).
• Disable unnecessary services and ports.
• Keep firmware and apps up to date.
• Apply least-privilege access to all NAS users.

For personal remote administration, UGREENlink or Tailscale is usually the safer default.

Frequently Asked Questions

Public IP Check Shows a Different WAN IP

If the IP address displayed by your public IP-check site differs from your router’s WAN IP, you are most likely behind carrier-grade NAT or another upstream NAT layer. In that case, remote access through DDNS may not work.

You can contact your ISP to request a public IP address or check whether IPv6 is available. If getting a public IP is difficult, UGREENlink or Tailscale is usually the more practical choice.

DDNS Is Not Connecting

Check the following:

1. Does your WAN IP match what public IP-check sites show?
2. Does the connection test in UGOS Pro succeed?
3. Is your domain resolving correctly?
4. Has the NAS LAN IP changed after a router reboot or DHCP renewal?

If the connection test fails, double-check the domain and provider credentials, including any leading or trailing whitespace.

Router Restarted and DDNS Stopped Working

The most common cause is that the NAS’s LAN IP changed after the restart, while the router’s port forwarding rules still point to the old address.

Set a DHCP reservation or static LAN assignment for the NAS so its internal IP remains fixed.

UGREENlink Is Not Connecting

First, confirm that UGREENlink Remote Access Service is turned on in UGOS Pro. Then verify that the generated URL is correct and that you are entering the correct sign-in details in the browser or client app.

Can’t Log In to the UGREENlink App

Make sure you are entering the correct UGREENlink ID and following the current sign-in flow shown in the app or PC client. A mistyped ID is one of the most common causes of failed sign-in attempts.

Which IP Should I Use with Tailscale?

By default, use the NAS’s Tailscale IP or its MagicDNS name. Use the NAS’s normal LAN IP only if you have configured subnet routing, advertised the route with TS_ROUTES, approved it in the Tailscale admin console, and configured the client to accept routes where required.

Tailscale NAS Does Not Appear in Machines

Check these first:

• Is the container running?
• Is the TS_AUTHKEY correct?
• Is the Tailscale state directory mounted correctly so the container can keep its identity?

Tailscale Device Key Expires

If you are being asked to re-authenticate often, review the device key expiration policy in the Tailscale admin console. Adjust it based on your security requirements and how long you expect the device to remain deployed.

Edit Route Settings in Tailscale

If you are using subnet routing, open the Machines list in the Tailscale admin console, find your NAS, and open Edit route settings to approve the advertised route. Also confirm that TS_ROUTES matches your home LAN subnet exactly.