Replicating WD2go's functionality on hardware under my control

Hello there, 

I’d like to securely access my disk remotely without using the WD2go software, for compatibility’s sake. I already activated dynamic DNS service, but lack information on techniques used by its software to actually establish the connection. I know UPnP is already used to map ports 80 and 443 through the firewall (though I can’t exactly understand why, as access to the Web interface is disabled by default for security reasons).

Still, UPnP is disabled in my router for security reasons, yet I can access the drive’s content from outside. Technically, how does the MBL allow for such a communication? Of course no documentation is provided about the exact daemon name, nor its usage.

NAT-PMP?

UDP hole-punching?

And how would I reproduce this behavior using only free software under my control, not WD’s? As we’ve seen recently, WD is not immunue to downtime, and in the past, Blackberry wasn’t either.

It’s using OpenVPN relay via WDs infrastructure.

Ok, that only answers the question partly. Would I absolutely need a publicly-reachable system to relay OpenVPN? 

What would be the correct way to make it work without a 3rd party?