How to Secure Your UGREEN NAS and Home Network

A UGREEN NAS used only inside your home should have remote access and unused network services turned off. If you need access while away, use UGREENlink or a private-network option such as Tailscale instead of exposing multiple NAS services through manual port forwarding. In either case, protect administrator accounts with two-factor authentication, restrict access with the UGOS Pro firewall, install security updates, and verify that alerts and backups work.

Key Takeaways:

• Keep a home NAS local unless you truly need remote access; if you do, use UGREENlink or Tailscale instead of exposing multiple NAS services directly to the internet.
• Protect administrator access with strong unique passwords, two-factor authentication, limited user permissions, and regular reviews of login activity and trusted devices.
• Disable unused services, port forwards, UPnP mappings, Docker ports, and direct internet access to SMB, NFS, SSH, and the UGOS Pro management interface.
• Build firewall rules around only the services and devices that need access, then test both local and remote connections to confirm that unwanted traffic is blocked.
• Security settings do not replace backups; keep an independent backup with separate credentials and test that you can restore files.

If Your NAS Is Already Exposed, Secure It First

Contain the exposure first, preserve the evidence, and then rebuild remote access safely.

1. Remove manual router port forwards that point to the NAS, and disable unnecessary UPnP mappings.
2. Turn off the affected DDNS or remote-access service. If there are signs of an active compromise, disconnect the NAS network cable or disable its network connection.
3. Do not factory-reset the NAS or clear its logs before reviewing what happened.
4. Open the Logs application and review login attempts, account activity, administrator actions, firewall events, and unfamiliar IP addresses.
   
   
   
   
5. Check the user list, trusted devices, installed applications, running containers, and recently changed firewall rules.
6. Revoke unknown trusted devices or sessions and disable accounts you do not recognize.
7. From a known-clean computer, change the NAS administrator password, UGREEN account password, router administrator password, DDNS credentials, Tailscale keys, backup-service credentials, and any application tokens that may have been exposed.
8. Update UGOS Pro and installed applications, then run a security scan.
9. Re-enable remote access through UGREENlink, Tailscale, or one narrowly scoped service only after the review is complete.

If files have been encrypted, deleted, or renamed, stop normal NAS activity to avoid overwriting recoverable data. Follow the incident steps in how to protect a UGREEN NAS from ransomware before restoring or resynchronizing files.

Is It Safe to Expose a NAS Directly to the Internet?

Do not expose SMB, NFS, SSH, or the UGOS Pro management interface directly to the internet. For remote access, UGREENlink or Tailscale reduces the need for broad manual port forwarding. Use DDNS and direct forwarding only when a specific service requires them and you can protect that service with HTTPS, narrow firewall rules, and active monitoring.

Your remote-access method determines which network paths must remain open.

UGREENlink does not require router configuration or manual port forwarding. It provides a UGREENlink domain and automatically applies a certificate to the connection. It is the most practical starting point for home users, but it still depends on the security of the UGREEN account, NAS account, trusted devices, and recovery email.

Tailscale creates a private network between approved devices without publishing the NAS management interface directly. It runs through Docker on UGREEN NAS, so the DH2300 cannot host the Tailscale container because it does not support Docker.

DDNS maps a changing public IP address to your own domain. It does not encrypt traffic or secure the service behind that address. DDNS also requires router configuration, port forwarding, and certificate management.

Use the complete guide to compare UGREENlink, DDNS, and Tailscale before enabling a more complex access path.

Once you have chosen the access method, secure the accounts that control it.

Lock Down the Accounts That Can Change the NAS

Remote access is only as secure as the account behind the login screen. Protect administrator accounts before adjusting firewall rules or publishing any service.

Use the Administrator Account Only for Administration

Each person should have a separate Standard User account for everyday file access. Reserve administrator access for installing applications, changing network settings, creating storage pools, and managing users.

For a shared household NAS:

• Remove administrator access from accounts that do not need it.
• Delete or disable accounts that are no longer used.
• Give each person access only to the Personal and Shared Folders they need.
• Do not share one administrator password among family members.
• Review permissions when someone stops using the NAS.

The complete account and folder workflow is covered in setting up family accounts and shared-folder permissions.

In Control Panel > User Management > Advanced Setting, configure the system’s password-strength requirements. Use a long, unique password or passphrase for every administrator and store it in a password manager. Do not reuse the password for email, cloud storage, the router, or the UGREEN account.

Enable Two-Factor Authentication

UGOS Pro supports time-based one-time passwords through OTP applications such as Microsoft Authenticator and Google Authenticator.

To enable 2FA:

1. Confirm that automatic time synchronization is enabled under Control Panel > Time & Language > Time.
2. Click the user icon in the upper-right corner of the UGOS Pro desktop.
3. Select your username to open Account Settings.
4. Open Account Security.
5. Find Two-Factor Authentication and select Confirm.
6. Verify the account with its current password.
7. Scan the displayed QR code with an OTP application.
8. Enter the generated six-digit code.
9. Add a secure emergency verification email.

Incorrect time on the phone or NAS can cause valid OTP codes to fail.

UGOS Pro also provides Account Settings > Account Security > Manage Trusted Devices. Review that list regularly and revoke devices that are lost, sold, shared, or no longer used. Do not select “Trust this device” on a public or shared computer.

Review Account Activity and Previous Logins

Enabling 2FA protects future logins. It does not explain activity that occurred before 2FA was enabled.

Review:

• Successful and failed remote logins
• Administrator actions
• New or modified users
• Changes to trusted devices
• Unfamiliar IP addresses
• Newly installed applications or containers
• Unexpected firewall or remote-access changes

Use the Logs application to filter activity by user, module, severity, or keyword. If an unfamiliar login succeeded, rotate the affected credentials and review what that account accessed or changed.

Block Repeated Login Attempts

On UGOS Pro 1.10.0.0092 and later, open Control Panel > Security > Security and configure:

• Automatic logout after browser inactivity
• Clearing login sessions when the NAS restarts
• DoS protection
• Automatic blocking of IP addresses after repeated failed logins
• CSRF protection
• The HTTP Content Security Policy header
• The TLS security protocol

The failed-login rule can block an IP address after a chosen number of failures within a specified period. Block Management lets you review blocked addresses, set an automatic unblock period, and create exceptions for trusted IP addresses or subnets.

Use the whitelist carefully. Whitelisting the entire home subnet also exempts a compromised device on that subnet from the block rule. A reserved IP address for one trusted administration computer is a narrower exception.

Separate Backup Credentials from Administrator Credentials

Do not connect a cloud account, second NAS, or other network backup destination using the main NAS administrator account.

Create a dedicated backup account or service credential that:

• Has no NAS or destination administrator privileges
• Can access only the required destination folder or bucket
• Cannot browse unrelated data
• Cannot change security or retention settings
• Cannot delete retained versions when the destination supports that restriction

Use version retention or Object Lock when the backup destination supports it, and store recovery credentials separately from the source NAS.

If malware or an attacker gains control of the NAS administrator account, the same credentials should not provide permission to delete the independent backup.

Protected accounts still do not justify leaving unused services running. The next step is to reduce the NAS’s reachable surface.

Turn Off Services and Ports You Do Not Use

Review the following services on the NAS and router:

• UGREENlink
• DDNS
• SMB
• NFS
• WebDAV
• FTP or FTPS
• SSH
• Docker-published ports
• Reverse proxies
• UPnP mappings
• Manual port-forwarding rules

Disable any service that has no current use. Do not leave SSH running for a tutorial you completed months ago, and do not keep an old port-forwarding rule after removing the application that used it.

SMB, NFS, SSH, and the UGOS Pro administration interface should not be published directly to the internet. SMB and NFS are designed primarily for trusted networks. SSH provides operating-system-level administration and should remain disabled unless a current task requires it.

Docker needs a separate review. A container can publish a port even when the corresponding service is not listed among UGOS Pro’s built-in file services. Open Docker, inspect the port mappings for every running container, and remove mappings that are no longer needed. Stop containers that are not in active use.

Then inspect the router. Delete obsolete port forwards and turn off UPnP unless a current application genuinely requires it. UPnP can allow applications to create router mappings without the administrator reviewing each rule.

With the unnecessary services removed, the firewall can be built around the connections that remain.

Configure a Safe UGOS Pro Firewall Baseline

The UGOS Pro firewall filters traffic by network interface, service or port, source IP address, protocol, and action.

Open:

Control Panel > Security > Firewall

Under Select Firewall Configuration, choose Add > New Rules.

UGOS Pro evaluates rules from top to bottom and stops when it finds the first match. Rules under All Interfaces are evaluated before rules for an individual network interface. If no rule matches, UGOS Pro applies that interface’s default action. The initial default is Allow Access.

Create and test the required allow rules before changing the default action to Deny Access.

A practical home configuration can start like this:

Do not create an “all IP addresses” allow rule for SMB, NFS, SSH, or all services.

Before applying the configuration:

1. Confirm that the trusted administration device has a reserved local IP address.
2. Keep the current local administrator session open.
3. Apply the new rules.
4. Test access from a second trusted device.
5. Verify the rule order.
6. Change the default action to Deny Access.
7. Test local and remote access again.

If the test fails, use the session that remains open to correct the rule before signing out.

For more complex source-IP, service, and interface rules, follow the internal guide to configuring UGOS Pro firewall rules.

Multi-port systems need extra care. If multiple NAS network ports connect to the same subnet, firewall behavior may not match the intended interface design. With link aggregation, UGOS Pro applies the firewall rules of the first network interface. Test the actual traffic path instead of assuming every port uses an identical rule table.

The NAS firewall now controls the device itself. The router and local-network design determine which devices can reach that firewall.

Protect the Router, Wi-Fi, and IPv6 Path

The NAS firewall protects the NAS. The router firewall controls traffic entering or moving through the home network. Configure both.

For the router:

• Replace the default administrator password.
• Install current router firmware.
• Use WPA3 when supported, or WPA2 with a strong Wi-Fi password.
• Disable remote router administration unless it is required.
• Remove unused port forwards.
• Disable UPnP unless a required application depends on it.
• Review both IPv4 and IPv6 firewall settings.

Hiding the Wi-Fi network name does not add meaningful protection and can make device setup less reliable. The NSA’s home-network security guidance recommends disabling unnecessary UPnP and does not recommend hiding the SSID as a security control.

IPv6 deserves a separate check. A router can have no IPv4 port-forwarding rule while still assigning the NAS a globally routable IPv6 address. Confirm that the router’s IPv6 firewall blocks unsolicited inbound connections unless you have deliberately created an exception.

Separate Guests and IoT Devices

Smart TVs, cameras, plugs, speakers, and other IoT devices often receive slower security updates than computers and phones. If the router supports a guest network or VLAN, place untrusted devices there and block that network from reaching NAS management services.

A practical arrangement is:

• Trusted computers and phones on the main network
• Guests on a guest network with client isolation
• IoT devices on a separate network or VLAN
• NAS administration allowed only from trusted devices
• Specific media access allowed only where a TV or player needs it

If an isolated TV needs Jellyfin, Plex, or DLNA access, allow only the required connection to that media service. Do not give the entire IoT network access to the UGOS Pro administration interface.

Use HTTPS for Browser and Remote Connections

HTTPS protects data while it travels between the client and the service. It does not encrypt the NAS storage pool.

UGREENlink automatically applies a certificate to its remote connection. If you use DDNS and your own domain, import a valid certificate under:

Control Panel > Security > Certificates

After importing the certificate, open its configuration and assign it to the correct web, FTPS, or other supported service.

The domain entered in the browser must match the certificate. A warning can indicate an expired certificate, a hostname mismatch, an incomplete certificate chain, or an intercepted connection. Do not train household users to ignore these warnings.

For a self-managed DDNS certificate:

1. Record the expiration date after installation.
2. Schedule a reminder at least 30 days before expiration.
3. Renew the certificate and any required intermediate certificates.
4. Import the renewed certificate.
5. Reassign it to the appropriate service.
6. Test the connection from outside the home network.

For services such as WebDAV, use HTTPS outside the home network. Do not expose unencrypted HTTP WebDAV to the internet.

Encryption of network traffic and encryption of stored files solve different problems. See the current guide to UGREEN NAS encryption and privacy controls for the storage-side protections and limitations.

Install Security Protection and Turn On Alerts

Install the Security application from App Center and enable Real-time Protection. This adds scanning for suspicious files stored on or passing through the NAS. It does not replace endpoint security on the computers that open those files.

Keep the operating system and applications current:

1. Open Control Panel.
2. Go to Update & Restore.
3. Check the System Update page.
4. Install the current stable security update after confirming that important data is backed up.
5. Review App Center and Docker applications separately.

Configure Log Notifications

On NAS firmware 1.16.0.0042 and later, the UGREEN NAS PC client can generate system notifications from matching log events.

Open the Logs application, select Notification, and enable the automatic notification policy. Rules can filter by:

• Keyword
• Severity level
• Module
• User

Then open Notifications > Settings from the UGOS Pro top bar and allow the Logs application to send notifications.

After configuring the policy, trigger a harmless event that matches the rule and confirm that it appears under Notification Records. A notification feature that has never been tested should not be treated as an active security control.

Test the Setup from Inside and Outside Your Home

Security settings are incomplete until you confirm that intended connections work and unintended ones fail.

Run this verification sequence:

1. Sign in locally with the administrator account.
2. Sign in with a Standard User account and confirm that administrative settings are unavailable.
3. Verify that the Standard User can access only the intended Shared and Personal Folders.
4. Review account activity, trusted devices, and recent login records one more time.
5. Turn off Wi-Fi on a phone and test the selected remote-access method over cellular data.
6. Confirm that services without remote access cannot be reached.
7. Review the router’s active port-forwarding and UPnP tables.
8. Check both IPv4 and IPv6 exposure.
9. Review the UGOS Pro firewall log for unexpected traffic.
10. Confirm that a failed-login test triggers the expected block or alert.
11. Restore one noncritical file from an independent backup.

Repeat the access, firewall, certificate, and notification checks after changing the router, network interfaces, remote-access method, firewall configuration, or imported certificate.

Know What Network Hardening Cannot Protect

Network controls reduce unauthorized access, but they do not recover deleted, corrupted, or encrypted files.

RAID can keep data available after supported drive failures. It does not recover data deleted by an administrator, overwritten by synchronization, or encrypted by ransomware. Snapshots can shorten recovery when they are supported and protected, but an attacker with sufficient administrator control may be able to delete them.

Keep an independent backup that uses separate, limited credentials and is not continuously deletable from the source NAS. Test the restore process before an incident.