Secure Remote Access for Home Assistant: Beginner Setup Guide

1. Why You Should NOT Use Port Forwarding

Port forwarding (opening a port on your router and pointing it at your HA instance) is the oldest method of remote access — and the most dangerous. When you forward port 8123 to Home Assistant, your HA login page is directly exposed to the entire internet. Anyone can attempt to log in. Automated bots scan the entire IPv4 address space every few hours specifically looking for exposed Home Assistant instances.

In practice: within hours of enabling port forwarding, your HA will start receiving hundreds of brute-force login attempts per day. Even with a strong password and two-factor authentication (which you should have regardless), this is an unnecessary attack surface. A single vulnerability in HA's web stack — and HA releases security patches regularly for a reason — could expose your entire home network.

The three methods in this guide all avoid direct internet exposure entirely. Tailscale and Cloudflare Tunnel create encrypted tunnels; Nabu Casa routes traffic through their infrastructure. None of them open ports on your router.

2. Option 1: Tailscale (Recommended for Most People)

Tailscale creates a private virtual network (a "tailnet") between all your devices. Your phone, laptop, and HA instance become peers on this encrypted mesh network — they can reach each other directly using Tailscale-assigned IP addresses (100.x.x.x range), but nobody outside your tailnet can access them.

Step 1: Create a free Tailscale account

Go to tailscale.com and sign up for free. The personal plan supports up to 100 devices — more than enough.

Step 2: Install the Tailscale add-on in Home Assistant

1. Go to Settings → Add-ons → Add-on Store
2. Search for Tailscale and install it
3. Go to the add-on's Configuration tab — no changes needed for basic setup
4. Start the add-on
5. Go to the add-on's Web UI tab — you'll see a Tailscale login page
6. Log in with your Tailscale account credentials

Step 3: Authorize the device in Tailscale admin

After logging in, open tailscale.com/admin/machines. You'll see your HA instance listed as a new machine. Authorize it by clicking the three-dot menu → Approve.

Step 4: Note the Tailscale IP address

In the Tailscale admin console, find your HA machine's Tailscale IP — it starts with 100.. This is the address you'll use to access HA remotely: http://100.x.x.x:8123.

3. Accessing HA Remotely via Tailscale

Install the Tailscale app on your phone:

• iOS App Store
• Google Play Store

Log in with the same Tailscale account. Turn on Tailscale on your phone, then open the Home Assistant Companion app — or navigate to your HA's Tailscale IP in your phone's browser. It connects directly, with full encryption, as if you were on your home network.

In the HA Companion app, you can configure an "External URL" pointing to your Tailscale address. The app will use your local address when you're home and switch to the Tailscale address when you're away — automatically.

External URL: http://100.x.x.x:8123
(or with MagicDNS: http://homeassistant:8123)

4. Option 2: Nabu Casa / Home Assistant Cloud (Easiest, $6.50/mo)

Nabu Casa is the commercial product from the Home Assistant team. It's the simplest possible remote access solution: subscribe, click a button in HA, done. No add-ons, no accounts at third-party services, no configuration.

To set it up:

1. Go to Settings → Home Assistant Cloud
2. Sign up for a Nabu Casa account ($6.50/month, ~$65/year)
3. Log in — remote access enables automatically

Nabu Casa also enables Google Assistant and Amazon Alexa integration for free as part of the subscription. If you want voice control, the subscription pays for itself in convenience.

The trade-off: traffic routes through Nabu Casa's servers rather than peer-to-peer. This means slightly higher latency (20–100ms typically) and a dependency on their infrastructure. They have a strong privacy policy — they claim not to store or process your HA data — but if privacy is paramount, Tailscale's peer-to-peer approach is preferable.

5. Option 3: Cloudflare Tunnel (Advanced, Free)

Cloudflare Tunnel lets you expose HA to the internet via Cloudflare's network, using a domain name you control, with Cloudflare handling TLS and DDoS protection — all for free. It's the most powerful option but requires a domain name and some technical comfort.

High-level setup:

1. Register a domain name and add it to Cloudflare (free)
2. Install the Cloudflared add-on in HA
3. Create a Tunnel in the Cloudflare Zero Trust dashboard
4. Configure the tunnel to route ha.yourdomain.com to http://localhost:8123
5. Set up Cloudflare Access policies (email OTP or SSO) to add an authentication layer in front of HA

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 127.0.0.1
    - ::1

6. Comparing the Three Options

Recommendation: Start with Tailscale. It's free, private, fast to set up, and works for 95% of people's needs. If you want Google/Alexa voice integration or prefer not to manage any technical setup, add Nabu Casa. Consider Cloudflare Tunnel only if you want a public-facing URL on a domain you control.

7. Security Checklist

Regardless of which remote access method you use, run through this checklist:

• Enable two-factor authentication: In HA, go to your profile (click your username) → Multi-factor Authentication → Enable TOTP. Use Google Authenticator or Authy.
• Use a strong unique password: At least 16 characters, random, unique to HA. Use a password manager.
• Keep HA updated: Check for updates weekly. HA releases security patches regularly. Go to Settings → System → Updates.
• Disable unused integrations: Every integration is a potential attack surface. Remove ones you don't use.
• Review HA user accounts: Settings → People → Users. Delete any accounts that shouldn't have access. Use separate accounts for family members with appropriate permission levels.
• Never use port forwarding: As explained above — there's never a good reason to directly expose HA to the internet.

8. Keeping HA Online: Why a UPS Matters

Remote access is only useful if HA is actually running. A power cut while you're away means no access — and no automations. A UPS (uninterruptible power supply) keeps your HA hardware running during brief outages (typically 15–60 minutes depending on capacity).

For a Raspberry Pi or HA Green, a small desktop UPS (500VA or 650VA) is sufficient and costs £40–£80. Connect your router and HA host to the UPS — both need power for remote access to work. Some UPS models integrate with HA directly to report battery status and trigger a graceful shutdown before power runs out.

9. Troubleshooting

Tailscale connected but HA not reachable

Make sure Tailscale is authorized in the admin console (login.tailscale.com/admin/machines) and that you're connecting to the correct Tailscale IP on port 8123. Also check that HA is running — log into your local network first to confirm it's up.

Nabu Casa shows "connected" but Companion app can't connect remotely

The Companion app's External URL must be set to the Nabu Casa address (Settings → Companion App → Server → External URL). This is usually auto-configured during app setup, but check it's not pointing to your local IP.

Cloudflare Tunnel works in browser but not Companion app

The Companion app may not trust Cloudflare's SSL certificate chain on some Android versions. Try using the https:// URL manually in the app settings. Also ensure use_x_forwarded_for is configured in HA — without it, HA rejects the requests.

Remote access works but is very slow

Tailscale's peer-to-peer connection might be falling back to relay (DERP) servers due to NAT traversal issues. Check the Tailscale admin console — if the connection shows "relay" instead of "direct", your router's NAT type is blocking direct connections. Enable UPnP on your router or switch to Nabu Casa which always uses relay by design.

10. FAQ

SmartWired participates in the Amazon Associates Programme. We may earn a commission from qualifying purchases at no extra cost to you.