Wi-Fi & Network

Aussie Broadband CGNAT: Tailscale for remote access

On Aussie Broadband and cannot reach Plex, your NAS or Home Assistant from outside? Confirm CGNAT, use the free opt-out or a $5 static IP, or skip ports with Tailscale.

Problem summary

Aussie Broadband turns CGNAT on by default for residential nbn services, so a port forward you set on your own router never receives inbound traffic. Aussie Broadband's help centre documents two ways out: ask support to opt you out of CGNAT (no extra cost, a phone call) or add a static IP bolt-on ($5 a month, self-service in MyAussie). Both restore a real public IPv4, but Aussie Broadband also blocks inbound TCP 80 and 443, so a reverse proxy on the standard web ports still fails. Tailscale sidesteps all of that: every connection starts outbound through a DERP relay, then upgrades to a direct link when NAT traversal succeeds, and Tailscale's own engineers describe CGNAT as a run-of-the-mill double NAT their traversal handles. This page confirms CGNAT on an Aussie Broadband connection, sets out the ISP options with what they cost, then walks through Tailscale for a NAS, Home Assistant or a self-hosted app, and the Plex-specific path (Relay versus Tailscale).

Operator snapshotEvidence first

First proof

Read the WAN IPv4 on your router's status or Internet page.

Screen to open

Router admin > Internet/WAN status; then `curl -4 ifconfig.me` from a LAN device

Expected signal

A real public address, or an address between 100.64.0.0 and 100.127.255.255.

Stop boundary

Stop if the NAS admin page is reachable from the internet without Tailscale: that means a port is already exposed and should be closed before continuing.

Layer path

1Aussie Broadband states in its help centre that CGNAT is used on its broadband services and is typically enabled by default. Your router's WAN address is then a shared-space address in 100.64.0.0/10 (RFC 6598), and the public IPv4 that websites see belongs to an Aussie Broadband gateway, not to you. A port forward on your router waits for traffic that never arrives.

2Aussie Broadband documents two exits. The CGNAT opt-out is free: call support, it applies immediately, then power cycle the router; your public IPv4 changes and stays dynamic. The static IP bolt-on is $5 a month for residential services, is added from the Boltons section of the MyAussie app or portal, and automatically takes the service off CGNAT.

3A public IPv4 is not the whole story on this ISP. The same help article lists inbound TCP 80, 443 and 25, UDP 135 and 137 to 139, and TCP/UDP 11211 as blocked by Aussie Broadband. Anything that must answer on the standard web ports still fails after the opt-out; high ports and outbound-only tools do not.

4Tailscale needs no inbound port. Per Tailscale's connection-types reference, every peer connection starts relayed through a DERP server and then upgrades to a direct UDP path when NAT traversal succeeds; only a hard NAT on both ends leaves it relayed. Tailscale's NAT-traversal write-up treats CGNAT as an ordinary double NAT its traversal handles, minus UPnP and NAT-PMP port mapping.

Runbook

Step-by-step runbook

Start here. Do each check in order, compare it to the expected result, and stop when the evidence explains the failure or the safe stop point applies.

Prove it is CGNAT, not double NAT or a blocked port

Check: Router WAN address versus the public address, plus the traceroute above. Note whether the WAN address is 100.64 to 100.127.x (CGNAT) or private (double NAT).

Expected result: One clear verdict: CGNAT, double NAT, or a public address with a blocked port.

If not: Double NAT: bridge the extra router first and re-test. Public address but port closed: check Aussie Broadband's blocked-port list before anything else.

Write down who needs access and on which port

Check: Only your own devices (admin, files, Home Assistant, Plex for the household) versus a public URL for other people; and whether the service can use a high port.

Expected result: A short list that maps each need to Tailscale (own devices), the ISP opt-out or static IP (public inbound on an allowed port), or a tunnel (public URL on 80/443).

If not: If everything on the list is your own devices, stop here and go to the Tailscale steps; no ISP call is needed.

Install Tailscale at home and on the remote devices

Check: Synology: Package Center > Tailscale. Unraid: Apps > Tailscale. TrueNAS: Apps catalog > Tailscale. Or a Linux box, Mac mini or Windows PC that stays on. Sign every device in to the same account (the free Personal plan covers a household).

Expected result: `tailscale status` on each device lists the others with a 100.x.y.z address; a ping between them succeeds.

If not: A NAS package that runs but cannot be reached usually needs its host-side setup step (on Synology, the vendor's boot-time script for TUN). Check the package notes before assuming CGNAT is the cause.

Safe stop: Stop if the NAS admin page is reachable from the internet without Tailscale: that means a port is already exposed and should be closed before continuing.

Add a subnet router for devices that cannot run Tailscale

Check: On the always-on home device: `sudo tailscale set --advertise-routes=<your LAN>/24`, then approve the route in the admin console. Linux clients add `--accept-routes`.

Expected result: From mobile data, the remote device reaches LAN addresses such as a printer, a camera NVR or an older NAS by their normal 192.168.x address.

If not: No route: check approval and the access rule. Do not widen the range to 0.0.0.0/0 to make it work; that turns the device into an exit node and routes all internet traffic through home.

Wire Plex through the tailnet

Check: On the Plex server, Settings > Network > Custom server access URLs: `http://<tailscale-ip>:32400`. Leave Enable Relay on. Install Tailscale on the phones and TVs that stream away from home.

Expected result: Remote playback at the same quality as at home; the app no longer reports Relay.

If not: Playback still capped: the client is not on the tailnet, or the remote video paywall applies (Plex Pass or Remote Watch Pass), which no network change fixes.

Only if you need public inbound: take the Aussie Broadband opt-out or static IP

Check: Free: call 1300 880 905 and ask for CGNAT to be disabled, then power cycle the router. Fixed address: add Static IP ($5 a month) from Boltons in the MyAussie app or portal. Confirm the WAN address is now public.

Expected result: Router WAN address matches the public-IP check; a port forward on an allowed high port answers from mobile data.

If not: 80 or 443 still closed after the opt-out: that is Aussie Broadband's inbound block, not CGNAT. Use a high port or an outbound-only tunnel.

Safe stop: Stop before forwarding admin interfaces (NAS DSM, router pages, Home Assistant without MFA) to the internet. The opt-out makes them reachable by anyone; keep them behind Tailscale.

Confirm the path and record the state

Check: From mobile data: `tailscale status` shows `direct` (or a known relay), the NAS share mounts, Home Assistant loads, Plex streams at full quality. Note the WAN address type and any ISP change you made.

Expected result: Every need on your list has a working path, and you know whether it depends on the ISP setting.

If not: Anything still failing after a direct Tailscale path is a service or firewall problem, not CGNAT; troubleshoot that service on its own page.

Decision tree

If: Router WAN address is in 100.64 to 100.127.x and the public-IP check differs.

Then: CGNAT confirmed on Aussie Broadband.

Action: Decide what you need: your own devices reaching home (Tailscale, no ISP call) versus a service that must accept inbound connections from anyone on a port Aussie Broadband allows (opt out of CGNAT or add the static IP).

If: Router WAN address is private (192.168.x, 10.x, 172.16 to 31.x).

Then: Double NAT from a second router, modem-router or mesh base in router mode. Not CGNAT.

Action: Put the upstream device in bridge mode or the downstream one in access-point or bridge mode so a single device does NAT. Re-run the WAN check; only then decide about CGNAT.

Safe stop: Stop and read the device manual before changing modes on an ISP-supplied gateway: bridge mode can drop the Wi-Fi and phone features it provides.

If: You want a stable public IPv4 for DDNS, an allow-list, or a game server on a high port.

Then: Static IP bolt-on ($5 a month) is the fit.

Action: Add it from the Boltons section of the MyAussie app or portal (plus icon above Static IP). Aussie Broadband says the service then leaves CGNAT automatically; power cycle the router and re-check the WAN address.

If: You need a public IPv4 but not a fixed one, and do not want to pay.

Then: Free CGNAT opt-out.

Action: Call Aussie Broadband on 1300 880 905 and ask for CGNAT to be disabled; expect your public IPv4 to change. Power cycle the router, confirm the WAN address is public, then set the port forward and test it from mobile data.

If: You need your own phone and laptop to reach a NAS, Home Assistant or a self-hosted app; nobody else needs a public URL.

Then: Tailscale, no ISP change.

Action: Install Tailscale on the NAS or home server and on each remote device under one account. For devices that cannot run Tailscale, run one home device as a subnet router advertising the LAN. No exit node is needed for this.

If: Tailscale is up but `tailscale status` stays on relay from every location.

Then: Both ends are behind hard NAT, or UDP is blocked on the away network.

Action: Test from a different away network first (mobile hotspot). If it is still relayed, either set up a Tailscale Peer Relay on a device that can be reached, or take the free CGNAT opt-out so the home end has a public IPv4 and can accept direct UDP.

Evidence

Evidence table

Symptom	Evidence to collect	Likely layer	Next action
Router WAN IPv4 reads 100.64.x.x to 100.127.x.x.	Router admin > Internet or WAN status page.	ISP CGNAT (RFC 6598 shared space). Whirlpool's community wiki lists Aussie Broadband's per-state internal ranges inside this block; treat that list as community evidence.	Confirm with a public-IP check, then pick opt-out, static IP, or Tailscale.
Public-IP site shows a different address from the router WAN, and the WAN is 192.168.x or 10.x.	Public-IP site plus router status page.	Double NAT at home, not the ISP.	Bridge the extra router. A CGNAT opt-out will not fix this.
Port forward set, WAN address is public, canyouseeme.org still reports port 443 closed.	canyouseeme.org from a LAN device, or a test from mobile data.	Aussie Broadband's inbound block on TCP 80/443/25 and the other listed ports.	Move the service to a high port or use Tailscale. Do not keep re-doing the forward.
`tailscale status` shows `relay "syd"` for the home device.	Terminal on the remote device.	NAT traversal has not reached a direct path; DERP in Sydney is relaying the encrypted packets.	Wait and retry after traffic flows; test another away network; consider a Peer Relay or the CGNAT opt-out if it never goes direct.
Plex Remote Access reports not available; apps connect but playback is limited to about 2 Mbps.	Plex Web > Settings > Server > Remote Access, and the playback quality indicator in the app.	Plex fell back to Relay because the direct path is blocked by CGNAT.	Add the server's Tailscale URL to Custom server access URLs, or opt out of CGNAT so Plex's port mapping works.

Reference

Commands and settings paths

Compare the router WAN address with the public address

Router admin > Internet/WAN status; then `curl -4 ifconfig.me` from a LAN device

Where: Router UI in a browser, and a terminal on any home device.

Expected: Same address on both: not CGNAT. Router shows 100.64 to 100.127.x and curl shows something else: CGNAT.

Failure means: Router shows 192.168.x or 10.x: double NAT; find the upstream device before touching the ISP.

Safe next step: Record both values; you will need them if you phone Aussie Broadband.

Trace the first hops out of the home

`tracert -d 1.1.1.1` (Windows) or `traceroute -n 1.1.1.1` (macOS/Linux)

Where: Terminal on a LAN device.

Expected: Hop 1 is your router. On CGNAT, an early hop sits in 100.64 to 100.127.x before the path reaches public addresses.

Failure means: Early hops in 192.168.x or 10.x after your router point to double NAT (an ISP hop in 10.x can also be normal internal routing, so weigh it with the WAN check).

Safe next step: Keep the output; it is the fastest way to show support what your path looks like.

Check the Tailscale path type

`tailscale status` on the remote device; `tailscale ping <home-device>` for the negotiation

Where: Terminal on the laptop or phone that is away from home (the mobile apps show the same status in their UI).

Expected: `direct <ip>:<port>` next to the home device, or `tailscale ping` reporting a pong via a direct address after a few tries.

Failure means: `relay "syd"` or pongs only via DERP: the link is relayed. It works, but with added latency and lower throughput.

Safe next step: Generate some traffic and re-check; Tailscale keeps trying to upgrade. If it never upgrades from any network, see the relay branch above.

Advertise the home LAN from a subnet router

`sudo tailscale set --advertise-routes=192.168.1.0/24` (replace with your LAN), then approve the route in the admin console (Machines > the device > Edit route settings)

Where: On the always-on home device running Tailscale (Linux, macOS, Windows, or a NAS package).

Expected: The device shows a Subnets badge in the admin console; remote devices can reach LAN addresses that do not run Tailscale.

Failure means: Routes advertised but unreachable: the route was not approved, or Linux clients need `tailscale set --accept-routes`, or an access rule blocks the subnet.

Safe next step: Keep the advertised range to your actual LAN. Do not advertise 0.0.0.0/0; that is what an exit node is for and you do not need one here.

Publish the Plex server's Tailscale address

Plex Web > Settings > Network > (Show Advanced) > Custom server access URLs: `http://<tailscale-ip>:32400`

Where: Plex Web on the server, signed in as the server admin.

Expected: Plex apps on tailnet devices connect directly through Tailscale at full bitrate; the Relay indicator disappears.

Failure means: Still on Relay: the client device is not on the tailnet, or the Tailscale address was typed with the wrong port.

Safe next step: Leave Enable Relay on as a fallback unless you specifically want to prevent low-quality relayed streams.

Hardware boundary

Hardware and platform boundary

Change only when

Pay for the $5 a month Aussie Broadband static IP only when you need a fixed public IPv4 (DDNS you will not babysit, allow-lists, a game or voice server on an allowed high port). Own-device access to a NAS, Home Assistant or Plex is fully served by Tailscale at no cost.

Evidence that matters

A real public IPv4 that survives a reboot; whether the inbound port you need is on Aussie Broadband's blocked list; and, for Tailscale, an always-on home device (NAS, Mac mini, mini PC) that can run the client or a subnet router.

Evidence that does not matter

Router brand, mesh system, or Wi-Fi 7 do not change CGNAT; the NAT is upstream of all your equipment. A faster nbn tier does not help either.

Avoid

Do not forward NAS admin, router admin or Home Assistant to the internet after the opt-out just because you can. Do not advertise 0.0.0.0/0 from a subnet router to make a route work. Do not rely on Plex Relay for 1080p or 4K; it is capped at 2 Mbps.

Related tool/checklist

Use the linked tool when you need a guided plan from your exact symptoms instead of a static checklist.

NAS setup planner

Last reviewed

2026-09-07 · Reviewed by HomeTechOps. Built from Aussie Broadband's help centre (port forwarding and CGNAT, static IP bolt-on, IPv6 support) and its CGNAT explainer, Tailscale's 2026-validated connection-types and subnet-router references plus its NAT-traversal write-up, Plex Support's Relay and Network settings articles, and RFC 6598. Aussie Broadband's per-state CGNAT ranges are quoted from the Whirlpool community wiki and labelled as such. Prices and the blocked-port list are as published by Aussie Broadband on the dates cited; re-check before relying on them.

Sources/assumptions

Aussie Broadband residential nbn (or OptiComm) service with an Aussie Broadband-supplied or your own router. Business nbn plans include a static IP and are not on CGNAT, per Aussie Broadband.
Aussie Broadband facts (CGNAT on by default, free opt-out by phone, $5 a month static IP in MyAussie, blocked inbound ports) come from the Aussie Broadband help centre as published; the port-forwarding article was last updated 13 August 2023 and the static IP article 27 February 2024. Re-check them before relying on a price.
The 100.64.0.0/10 range is the RFC 6598 shared address space. The per-state Aussie Broadband CGNAT ranges quoted come from the Whirlpool community wiki, not from Aussie Broadband, and are labelled as community evidence.
Tailscale behaviour (DERP first, then direct; subnet routers; exit nodes) is taken from Tailscale's documentation validated in 2026. Plex Relay limits come from Plex Support.

Source-backed checks

HomeTechOps turns official docs and conservative safety rules into a shorter runbook. These links are the source trail for the page direction.

Aussie Broadband Help Centre: How to set up Port Forwarding and bypass CGNAT (last updated 13 August 2023)Used for CGNAT being enabled by default on Aussie Broadband broadband services, the free opt-out by phoning 1300 880 905 (applied straight away, then power cycle the router), a static IP automatically opting the service out, and the list of blocked inbound ports (TCP 80, 443, 25; UDP 135, 137 to 139; TCP/UDP 11211) and outbound TCP 25.Aussie Broadband Help Centre: How to get a static IP address (last updated 27 February 2024)Used for dynamic IP plus CGNAT being the default, the residential static IP bolt-on at $5 a month, and where to add it: the plus icon above Static IP in the Boltons section of the MyAussie app or portal, or by phone.Aussie Broadband Blog: What is CGNAT and how can I opt out? (last updated 27 February 2024)Used for the vendor's own description of CGNAT, the services it can break (port forwarding, cameras, home automation, remote access), business and static IP customers not participating in CGNAT, and the note that opting out changes your public IPv4 unless a static IP is applied.Aussie Broadband Help Centre: Does Aussie Broadband support IPv6? (last updated 27 February 2024)Used for IPv6 being automatically included on residential and business nbn plans (not OptiComm), delivered by DHCPv6 with a /48 delegated prefix that can occasionally change with CVC management.Whirlpool community wiki: Carrier Grade NAT on Aussie Broadband (community-maintained)Community evidence, not vendor documentation. Used only for the observation that Aussie Broadband's CGNAT internal ranges sit inside 100.64.0.0/10 (per-state /17 blocks) and the community's record that the opt-out is free.RFC 6598: IANA-reserved IPv4 prefix for shared address spaceUsed for the authoritative CGNAT detection rule: WAN IP in 100.64.0.0/10 means no port-forward is possible without a tunnel.Tailscale Docs: Connection types (direct, DERP relayed, peer relay; last validated 1 June 2026)Used for every connection starting relayed through DERP and upgrading to direct when NAT traversal succeeds, hard NAT on both ends preventing a direct path, reading `direct` versus `relay` in `tailscale status`, and the Peer Relay option.Tailscale Blog: How NAT traversal worksUsed for Tailscale's own account of CGNAT as a run-of-the-mill double NAT that its traversal handles, with UPnP, NAT-PMP and PCP port mapping being the techniques CGNAT takes away, and DERP as both side channel and fallback relay.Tailscale: Subnet routersUsed for VPN routing, subnet overlap, and local-network reachability assumptions.Tailscale Docs: Exit nodes (route all traffic)Used for what an exit node does (routes all of a device's internet traffic, 0.0.0.0/0 and ::/0, through the chosen device) so the page can say it is not needed for reaching home devices, where a subnet router or the client itself is the right tool.Plex Support: Accessing a Server through RelayUsed for Relay being on by default, the 2 Mbps per-stream cap that applies to Plex Pass and Remote Watch Pass subscribers alike, Downloads not working over Relay, and the Secure connections Preferred or Required requirement.Plex Support: Network (server settings)Used for the Custom server access URLs setting (a comma-separated list published to plex.tv for discovery, suggested for VPN or reverse-proxy setups) and the Enable Relay toggle.Plex Support: Troubleshooting remote accessUsed for Plex remote access failures, double-NAT/CGNAT checks, and server-network-public reachability assumptions.Tailscale Docs: DERP servers (last validated 21 January 2026)Used for DERP servers negotiating connections and acting as the last-resort relay, and for relayed traffic staying WireGuard-encrypted end to end (a DERP server cannot decrypt it).Tailscale: Connect to network attached storageUsed for VPN-style NAS remote-access planning instead of exposing admin or file-sharing ports.Tailscale: Pricing v4 (April 8, 2026)Used for the April 2026 Tailscale pricing change: free Personal plan = 6 users + unlimited user devices, 50 tagged resources, exit nodes free on all tiers.Plex Support: Requirements for remote playback of personal mediaUsed for the 2025-04-29 paywall: remote playback of personal VIDEO now requires the server admin or the viewer to hold a Plex Pass (or Remote Watch Pass); music and photos are exempt; a server-admin Plex Pass covers all that server's users.

Diagnostic rule

1. Check the simplest signal first.
2. Change one thing at a time.
3. Avoid unsafe electrical or data-loss steps.
4. Stop when the evidence says the risk moved.

FAQ

Is the Aussie Broadband CGNAT opt-out really free?

Yes, according to Aussie Broadband's own help centre article on port forwarding and CGNAT: you can opt out on request at no additional cost by calling 1300 880 905, the change applies straight away, and you power cycle your modem or router afterwards. The catch Aussie Broadband states in its CGNAT explainer is that opting out changes your public IPv4 address, and it stays dynamic. If you need the address to stay put (for DDNS you do not want to babysit, or an allow-list somewhere), the static IP bolt-on is $5 a month and automatically takes you off CGNAT.

I opted out of CGNAT but my reverse proxy on port 443 still does not answer from outside. Why?

Aussie Broadband's port-forwarding article lists inbound TCP 80, 443 and 25 (plus UDP 135, 137 to 139 and TCP/UDP 11211) as blocked on its network, separate from CGNAT. So a public IPv4 alone does not give you the standard web ports. Move the service to a high port, or keep the ports closed and use Tailscale, which needs no inbound port at all. If you want a browser-reachable hostname without any open port, Tailscale vs Cloudflare Tunnel compares the two outbound-only options.

Will Tailscale be slow behind CGNAT because it has to use a relay?

Usually not. Tailscale's connection-types reference explains that every connection starts through a DERP relay and then tries to upgrade to a direct UDP path; a relay is only the permanent path when both ends are behind a hard NAT. Tailscale's NAT-traversal write-up says CGNAT behaves like an ordinary double NAT and its traversal works through it, minus the UPnP and NAT-PMP port-mapping tricks. Check with `tailscale status`: `direct` next to the peer means you are not relayed; `relay "syd"` means the Sydney DERP is carrying the traffic. Relayed traffic is still end-to-end encrypted, just slower.

Do I need a Tailscale exit node to reach my NAS from my phone?

No. An exit node routes all of the phone's internet traffic through your home, which is a different job (privacy on public Wi-Fi). To reach the NAS, either install Tailscale on the NAS itself, or run one Tailscale device at home as a subnet router advertising your LAN (for example `192.168.1.0/24`) so devices without Tailscale become reachable. Tailscale's own subnet-router page draws exactly that line: exit nodes handle internet traffic, subnet routers handle access to a private subnet.

Plex works over Relay already. Is that good enough?

Plex Support caps Relay streams at 2 Mbps for everyone (Plex Pass included), which is fine for music and low-resolution video and not for 1080p or 4K, and the Downloads feature cannot run over Relay. With Tailscale on the Plex server and on the phone, add `http://<tailscale-ip>:32400` to Settings > Network > Custom server access URLs so Plex apps discover the server through the tailnet and stream at full quality. Remote playback of personal video still needs a Plex Pass or Remote Watch Pass; that rule is independent of the network path.

Does Aussie Broadband's IPv6 let me skip all of this?

Sometimes. Aussie Broadband includes IPv6 automatically on residential nbn plans (DHCPv6 with a delegated /48), though not on OptiComm services. IPv6 is not behind CGNAT, so an IPv6-only listener with a router firewall rule can be reached from any network that also has IPv6. The problem is the far end: many mobile and office networks still cannot reach IPv6 hosts, and the delegated prefix can change when Aussie Broadband reshuffles its nbn CVCs. Most people keep Tailscale as the reliable path and treat IPv6 as a bonus.