How to Configure UGREEN NAS Firewall Rules

UGOS Pro firewall rules control which devices can reach your NAS based on the network interface, source IP address, service port, and permission. For the strongest protection, create allow rules for trusted devices and required services, then set unmatched inbound traffic to Deny Access.

Key Takeaways:

• Use an allowlist with Deny Access as the default when you want only trusted devices and services to reach the NAS.
• Rule order matters because UGOS Pro applies the first matching firewall rule, so specific allow rules should come before broader deny rules.
• Reserve IP addresses for the NAS and trusted devices before creating IP-based rules, or the rules may stop working after DHCP changes.
• Test local access, SMB, Docker apps, backups, and remote access before closing your current admin session.
• If a rule blocks access, check the source IP, port, interface, and rule priority before disabling the firewall or using the five-second reset.

Which Firewall Policy Should You Use?

An allowlist policy with Deny Access as the default provides stronger control. A blocklist policy with Allow Access as the default is easier to configure, but every device not specifically blocked can still attempt to connect.

How to Configure the UGREEN NAS Firewall Safely

Open Control Panel > Security > Firewall to manage firewall profiles. UGOS Pro supports up to 10 custom profiles.

For every incoming connection, UGOS Pro checks:

1. Rules under All Interfaces
2. Rules assigned to the network interface receiving the connection
3. The default action for that interface

Rule order matters because UGOS Pro stops evaluating rules after the first match.

Place narrow rules above broad rules. For example, a rule allowing one administrator computer should appear above a rule that denies an entire subnet.

Rules under All Interfaces have higher priority than rules assigned to an individual interface. Avoid placing a broad allow rule there unless it genuinely needs to apply to every network connection.

Before You Configure the Firewall

Record these four details before changing any rules:

1. NAS IP address: For example, 192.168.1.10
2. Administrator computer IP address: For example, 192.168.1.25
3. Network interface: Such as LAN 1, LAN 2, or a bonded interface
4. Required services: Such as UGOS Pro management, SMB, NFS, WebDAV, SSH, or a Docker application

Create DHCP reservations for the NAS and administrator computer in your router. A firewall rule tied to 192.168.1.25 stops working as intended if the router later assigns that address to another device.

Keep your current UGOS Pro session open while applying and testing new rules. Do not close it until you have confirmed that another trusted device can connect.

Example 1: Allow Only a Trusted IP Range to Access the NAS

This example allows devices with addresses from 192.168.1.1 through 192.168.1.100 to access all enabled NAS services. All other inbound connections are denied.

Use this approach only when every device in the permitted range is trusted.

1. Go to Control Panel > Security > Firewall.
2. Under Select Firewall Configuration, click Add.
3. Click + New Rules and enter the following values:

Note: This rule grants the specified IP range access to every enabled NAS service on every port. If guest, smart-home, or other untrusted devices use addresses within this range, use narrower service-specific rules instead.

4. Confirm the rule and select Enable for the firewall configuration.
5. Under the default action for the selected interface, choose Deny Access when none of the rules match.
6. Click Apply.
7. Test the NAS from one device inside and one device outside the permitted range.

The completed policy behaves like this:

If your home network uses a full /24 subnet, you can enter 192.168.1.0/24 instead of an address range. That subnet includes addresses from 192.168.1.0 through 192.168.1.255, including addresses that may belong to your router, guest devices, or IoT hardware. Use the narrower range when you do not trust the entire subnet.

Example 2: Let One Computer Manage UGOS Pro While Other Devices Use SMB

This configuration separates administrator access from ordinary file sharing.

In this example:

• Administrator computer: 192.168.1.25
• Trusted household range: 192.168.1.1 – 192.168.1.100
• UGOS Pro HTTPS management port: 9443
• File-sharing service: SMB

1. Go to Control Panel > Security > Firewall.
2. Add a firewall configuration or edit the profile created earlier.
3. Create these two rules in the order shown:

4. Enable both rules.
5. Set unmatched traffic for the interface to Deny Access.
6. Click Apply.

The policy now produces these results:

UGOS Pro uses HTTP port 9999 and HTTPS port 9443 by default. If you changed the management port, enter the configured value instead. Prefer HTTPS for routine administration.

The built-in SMB service includes the ports UGOS Pro requires for SMB access and discovery. Selecting the built-in service is less error-prone than manually entering each port.

If household devices also need another service, create a separate rule for that service. Do not replace the narrow rules with one all-ports rule unless those devices genuinely need access to everything.

Example 3: Block One Device from Accessing the NAS

This example blocks the device at 192.168.1.77 while allowing all other unmatched devices to connect.

Use it when one known computer, phone, television, or IoT device should not access the NAS.

1. Go to Control Panel > Security > Firewall.
2. Create or edit the firewall configuration.
3. Click + New Rules and enter:

Note: This rule blocks the specified device from reaching all NAS services. Reserve 192.168.1.77 for that device in your router. Otherwise, the device could receive a different address and stop matching the rule.

4. Enable the rule.
5. Set the default action to Allow Access when none of the rules match.
6. Click Apply.
7. Confirm that the blocked device cannot open UGOS Pro, access shared folders, or connect to NAS applications.

The resulting behavior is:

This is a blocklist configuration. It stops one known device but does not prevent access from unknown or newly connected devices. Use the allowlist configuration from the earlier examples when the objective is to permit only explicitly trusted sources.

Do not use 192.168.1.0 as the example address for one blocked device. On a typical /24 home network, that address identifies the subnet rather than an individual host.

Test the Rules Before Closing Your Session

After applying the configuration, verify each expected path.

UGOS Pro firewall rules control connections attempting to reach services on the NAS. They do not create outbound internet-access rules. NAS-initiated connections such as cloud uploads, Docker image downloads, system update checks, and NTP time synchronization continue to work after unmatched inbound traffic is denied.

If two-factor authentication codes fail after a firewall change, check the NAS clock, DNS settings, gateway, and internet connection. Opening another inbound port will not correct inaccurate system time.

Test remote access separately

A successful mobile-app test while the phone remains on Wi-Fi proves only that local access works.

If you use remote access:

1. Turn off Wi-Fi on the phone.
2. Connect through cellular data.
3. Sign in using the configured UGREENlink ID or other approved remote-access method.
4. Confirm that only the intended applications and services are available.

If remote access is intentionally disabled, confirm that the NAS cannot be reached over cellular data.

Do not add a broad allow rule for 0.0.0.0/0 simply to make remote access work. That source represents every IPv4 address. Use our UGREEN NAS remote-access guide to configure UGREENlink, DDNS, or a private-network connection without unnecessarily exposing NAS services.

CISA recommends blocking inbound SMB traffic from the internet. Keep SMB limited to trusted local or private-network sources. CISA’s exposure-reduction guidance explains why unnecessary public access should be removed.

How to Fix Firewall Rules That Block NAS Access

Match the symptom to the likely configuration error before disabling the firewall.

If multiple unbonded network ports connect to the same subnet, firewall rules may not behave as expected. When link aggregation is enabled, the firewall applies the rules associated with the first network interface in the aggregation group.

Firewall rules and the Block Management whitelist are different

The whitelist under Block Management exempts an IP address from automatic blocking after repeated failed login attempts. It does not create a firewall allow rule.

An address can therefore appear in the Block Management whitelist and still be denied by the firewall. It can also be allowed by the firewall and later blocked by automatic login protection.

Use logs without expecting a packet trace

Check Log Center and the affected application’s own logs for related events. Services such as WebDAV and Docker applications can provide connection, transfer, or application errors.

A connection rejected before it reaches the service may not produce an application log. If the logs do not identify the cause:

1. Create one temporary allow rule for the affected device and service port.
2. Move it above broader rules.
3. Test the connection again.
4. Narrow the source, port, or interface until the failing condition is identified.
5. Remove the temporary rule when troubleshooting is complete.

Do not leave an all-ports or all-sources troubleshooting rule enabled.

Use the Five-Second Reset Only as a Last Resort

If every local management path is blocked and you cannot correct the firewall through an existing session, the five-second reset can restore access.

Before using it, verify:

• The NAS IP address
• The administrator computer’s current IP address
• HTTP and HTTPS management ports
• Rule priority
• Selected network interface
• Direct access from the trusted local network

The five-second reset affects more than the firewall. It resets administrator and network access settings, restores the default web ports, clears the blocked-IP list, and disables automatic startup for Docker containers and virtual machines.

After access is restored, review the firewall profile and check Docker and virtual-machine startup settings before assuming every service has returned.

Review Firewall Rules When the Network Changes

Review the firewall after:

• Replacing the router
• Changing the local subnet
• Adding a guest network or VLAN
• Changing the administrator computer
• Publishing a new Docker port
• Changing a service port
• Enabling IPv6
• Adding or bonding Ethernet interfaces
• Removing a service
• Changing the remote-access method

Delete obsolete rules instead of leaving them enabled in case they are needed later. Review router port forwarding and UPnP mappings separately because the NAS firewall does not remove ports that the router continues to expose.

For the account, router, certificate, and backup controls that work alongside the firewall, follow our home NAS network-security guide.