Table of Contents
Why Remote Access Matters
Home Assistant lives on your local network by default. That's great for security, but it means the moment you leave home, you lose direct access. Want to check if you left the garage door open? Trigger an automation while travelling? Let a friend in remotely? You need remote access.
There are three main approaches, each with very different trade-offs around cost, complexity, security, and reliability. In this guide we'll break down all three so you can make an informed choice for your setup.
Option 1: Nabu Casa (Home Assistant Cloud)
Nabu Casa is the official remote access solution from the team behind Home Assistant. For $6.50/month (or $65/year), you get a managed cloud relay that handles all the complexity for you — and your subscription directly funds Home Assistant development.
How It Works
Nabu Casa runs a cloud relay server. Your HA instance maintains an outbound connection to this relay. When you access your HA remotely, traffic routes through the Nabu Casa cloud — your router never needs any special configuration or open ports.
Setup
It takes about 90 seconds: go to Settings → Home Assistant Cloud, create a Nabu Casa account, and sign in. That's it. You immediately get a *.ui.nabu.casa URL you can bookmark or add to the HA app.
Pros
- Easiest setup possible — no router configuration required
- Works through CGNAT (carrier-grade NAT) and restrictive ISPs
- Enables Alexa and Google Assistant integration at no extra cost
- Automatic HTTPS with a managed certificate
- Subscription funds HA development (pay it forward)
- Official support from Nabu Casa team
Cons
- Ongoing cost ($6.50/month) — adds up over years
- Traffic routes through a third-party server (privacy consideration)
- If Nabu Casa servers are down, remote access is down
- Latency slightly higher than direct VPN connections
Option 2: VPN (WireGuard / Tailscale)
A VPN creates an encrypted tunnel between your remote device and your home network. Once connected, your phone or laptop behaves as if it's sitting on your home Wi-Fi — you can access HA (and everything else on your network) via its local IP address.
WireGuard
WireGuard is a modern, fast VPN protocol with excellent performance. Home Assistant OS includes a WireGuard add-on that makes server setup straightforward. You'll need a static IP or a dynamic DNS service (like DuckDNS), and you need to forward a UDP port on your router.
WireGuard gives you a direct, private tunnel — traffic never touches a third-party server. Performance is excellent, especially for video streams.
Tailscale (Recommended VPN Option)
Tailscale is a managed mesh VPN built on WireGuard. It's dramatically easier to set up than raw WireGuard because there's no port forwarding required and no static IP needed. Install Tailscale on your HA server (via the Tailscale add-on) and on your phone/laptop, and they form a private mesh network automatically.
Tailscale's free tier supports up to 3 users and 100 devices — more than enough for most households. It also supports Funnel (public HTTPS tunnels) and HTTPS certificates for your HA instance.
Pros of VPN
- No ongoing cost (Tailscale free tier is very generous)
- Traffic stays private — never passes through a cloud relay
- Full local network access, not just Home Assistant
- Excellent performance (WireGuard is fast)
- Works offline/without internet for local access
Cons of VPN
- Requires connecting to VPN before accessing HA remotely
- WireGuard requires port forwarding and a static/dynamic DNS
- Tailscale requires creating and trusting a Tailscale account
- May not support Alexa/Google Assistant voice integration
- More complex to share access with other family members
Option 3: Cloudflare Tunnel
Cloudflare Tunnel (formerly Argo Tunnel) creates an outbound-only encrypted tunnel from your HA server to Cloudflare's global network. Your HA is then accessible via a custom domain (or a free *.trycloudflare.com URL) through Cloudflare's CDN — with no open ports required.
How It Works
You install cloudflared on your HA server (via the Cloudflare Tunnel add-on in HACS or as a standalone add-on). It establishes a persistent outbound connection to Cloudflare. Incoming requests to your domain are proxied through Cloudflare to your HA instance. Traffic is encrypted end-to-end.
Setup Overview
- Create a free Cloudflare account and add your domain (or use a free tunnel URL)
- Install the Cloudflare Tunnel add-on in HA
- Create a tunnel in the Cloudflare dashboard and paste the token into the add-on
- Configure a public hostname pointing to
http://homeassistant.local:8123 - Add your Cloudflare domain to HA's
trusted_proxiesconfiguration
Pros
- Free (Cloudflare's tunnel service is genuinely free)
- No port forwarding required
- Works with CGNAT and restrictive ISPs
- Automatic HTTPS with Cloudflare-managed SSL
- Cloudflare Access can add additional authentication layers (MFA, email verification)
- Your own custom domain looks professional
Cons
- Traffic passes through Cloudflare's servers (trust issue for some users)
- Setup is more complex than Nabu Casa — requires a domain and DNS knowledge
- Cloudflare's ToS technically prohibits high-bandwidth video proxying on the free plan
- If Cloudflare has an outage, remote access fails
- No built-in Alexa/Google Assistant integration
Head-to-Head Comparison
| Feature | Nabu Casa | Tailscale VPN | Cloudflare Tunnel |
|---|---|---|---|
| Cost | $6.50/mo | Free | Free |
| Setup Difficulty | Very Easy | Easy | Moderate |
| Port Forwarding Needed | No | No | No |
| Works with CGNAT | Yes | Yes | Yes |
| Alexa/Google Integration | Yes | No | No |
| Traffic Privacy | Nabu Casa relay | Direct/private | Cloudflare relay |
| Performance | Good | Excellent | Good |
| Custom Domain | No | With Funnel | Yes |
| HA App Compatibility | Native | Yes | Yes |
Our Recommendation
Pick Based on Your Priorities
For beginners or if you use Alexa/Google: Nabu Casa is worth every penny. The setup takes 90 seconds and works flawlessly. You're also supporting the open-source project you depend on.
For privacy-focused users or tech-savvy folks: Tailscale is the sweet spot — free, private, and nearly as easy as Nabu Casa once set up. We use it ourselves.
For power users with a domain: Cloudflare Tunnel is a genuinely impressive free solution, especially when combined with Cloudflare Access for extra security. Great for those who want more control.
All three methods are secure and reliable in daily use. The "best" option depends entirely on your budget, technical comfort level, and whether voice assistant integration matters to you. Many users even run two methods simultaneously — Nabu Casa for voice integration and Tailscale for private direct access.
SmartWired participates in the Amazon Associates Programme. We may earn a commission from qualifying purchases at no extra cost to you.