Remote access allows us to connect to Home Assistant from outside our local network using an authenticated and encrypted channel.
Without an external URL, a VPN, or the Home Assistant Cloud service, the app cannot open your instance from a mobile network. Push notifications may still arrive, but you won’t be able to view the dashboard or control your home.
For home automation to be truly useful, you need to be able to reach it from anywhere in the world. However, exposing a local server to the Internet is one of the most critical architectural decisions in terms of cybersecurity. If done incorrectly, you are opening your home network to botnets and automated attacks.
Let’s analyze the main methods, both free and paid, and the problem introduced by CG-NAT in home connections.
The Problem of Opening Ports Without HTTPS
The most basic (and dangerous) way to access an internal server from the outside is Port Forwarding on your router.
This means telling the router: “Any external request arriving at my public IP on port 8123, send it to Home Assistant’s local IP”.
To do this correctly, we need to implement HTTPS (SSL/TLS) encryption. Traditionally, this was done via the Classic Method.
You must never do this with Home Assistant without encryption. If you expose port 8123 in plain text (HTTP), anyone intercepting your traffic on a public WiFi network can read your password. Furthermore, bots continuously scanning the range of Internet IPs will find your server in less than 5 minutes and attempt to brute-force their way in.
Method 1: DuckDNS, NGINX, and Let’s Encrypt
This has been the standard method of the maker community for years. Since most Internet providers assign us a dynamic public IP (it changes every time we restart the router), we need a dynamic DNS service to always know “where” our home is.
- DuckDNS: Provides us with a free subdomain and an application that updates our public IP.
- Reverse Proxy: We install an application like NGINX Proxy Manager.
- Certificates (Let’s Encrypt): The proxy requests a free SSL certificate from Let’s Encrypt to encrypt the connection.
- Router: We open port 443 (HTTPS) on our router and redirect it to NGINX. NGINX receives the encrypted request, decrypts it, and passes it to Home Assistant on the local network.
The Obstacle of CG-NAT
Although the classic method is excellent for learning, it currently faces an insurmountable technical problem in many Spanish homes.
Due to the exhaustion of IPv4 addresses, many operators use CG-NAT (Carrier-Grade NAT). In this case, we don’t have our own public IPv4 address; instead, we share the operator’s outgoing connection with other clients.
If we are behind CG-NAT, opening ports on our router does not allow receiving connections from the Internet, because the operator’s NAT is in front. You will need a public IP, a VPN, or an outgoing tunnel.
Method 2: Cloudflare Tunnel
If we cannot open ports from the outside in, the solution is to initiate the connection from the inside out.
Using the cloudflared application, our server initiates a persistent encrypted outgoing tunnel to Cloudflare.
When you, from outside, type your home address on your phone, you do not connect to your router. You connect to Cloudflare. And Cloudflare, through the already open tunnel, routes you to your Home Assistant.
Advantages of Cloudflare Tunnel
- No need to open ANY port on the router. Your home firewall remains locked down.
- It seamlessly bypasses CG-NAT, as it is an outgoing connection, just like browsing a website.
- The public IP remains hidden: Incoming connections terminate at Cloudflare and travel through the tunnel to Home Assistant.
- SSL certificate management is handled automatically by Cloudflare.
The Only Drawback
For this setup, you need a domain that you can manage in Cloudflare. The price depends on the extension and the registrar; it’s also worth checking the renewal cost, as first-year offers are often much cheaper than subsequent years.
Method 3: A VPN with WireGuard or Tailscale
There is a third method for users who don’t want to buy a domain and, furthermore, don’t want their Home Assistant to be publicly accessible on the Internet via any URL.
The solution is to set up a VPN (Virtual Private Network). One of the most interesting options is WireGuard, a modern, fast, and lightweight protocol that connects our devices using key pairs.
Direct WireGuard
We can install a WireGuard server on our network and configure a profile for each authorized mobile device or computer. It is an efficient solution under our control, but it requires one of its endpoints to be accessible from the Internet: typically, a public IPv4 address with a forwarded UDP port or an accessible IPv6 address with the appropriate firewall rule.
If your connection is behind CG-NAT, direct WireGuard cannot receive incoming connections via IPv4. You would need to request a public IP from your operator, use IPv6 if available, or rely on an external server like a VPS. Therefore, WireGuard alone does not solve the problem we saw earlier.
Additionally, you need to exchange keys, assign addresses, and maintain the configuration for each device. It’s not overly complex, but it requires understanding which machine acts as the server and how traffic reaches it.
Tailscale: WireGuard Without Manual Network Configuration
Tailscale uses WireGuard to encrypt traffic but adds authentication, device discovery, and automatic coordination of connections. It attempts to establish a direct connection through NAT traversal, and when it can’t, it uses DERP servers as a relay without decrypting our traffic.
This allows using a WireGuard-based VPN even behind CG-NAT, without opening ports or deploying your own VPS.
How Deployment with Tailscale Works
- You install the Tailscale application on Home Assistant and authorize the new device in your account.
- You install the Tailscale App on your phone and authenticate with the same account.
- Tailscale creates a virtual private network over the Internet. Your Home Assistant gets assigned a special private IP (e.g.,
100.85.x.x).
When you’re out and about, your phone can maintain the Tailscale connection and access Home Assistant via its IP or name within the tailnet. There’s no need to turn the VPN on and off for each use if you prefer to leave it always connected.
The server is not published under a URL open to the Internet, nor does it expose a port on the router. In exchange, each device from which you want to connect must belong to your Tailscale network.
The Official Paid Method: Nabu Casa
Although this article focuses on free (maker) methods, we cannot ignore the official solution.
Nabu Casa offers Home Assistant Cloud for €7.50 per month or €75 per year in the European Union. It provides remote access without configuring domains or additional applications. In addition to giving you secure remote access without opening ports, the subscription allows native integration with Alexa and Google Assistant, and directly funds the development of Home Assistant. If you don’t want to deal with networks and DNS, this is the option you should choose.
