Out of the box, Home Assistant only listens on your local network. That is the safest state it will ever be in, and every way of reaching it from outside changes that. The official documentation lists four routes: Home Assistant Cloud, a VPN, a reverse proxy and plain port forwarding. They differ in what ends up visible on the internet, what you have to maintain, and whether they work on your connection at all.

Check your connection first

Port forwarding, a reverse proxy and a self-hosted WireGuard server all need a public IPv4 address on your router. Many providers no longer hand those out. They put customers behind carrier-grade NAT (CG-NAT) or DS-Lite, and then no port forward on your router is reachable from outside.

To check, compare the WAN address on your router's status page with the address a "what is my IP" website reports. If they differ, or the router shows an address from 100.64.0.0/10 (the range RFC 6598 reserves for carrier-grade NAT), you are behind CG-NAT. The Companion app documentation leaves two options in that case: ask your provider for a public address, or use Home Assistant Cloud. A mesh VPN such as Tailscale also works, because both ends connect outward and Tailscale relays the traffic when a direct connection is impossible.

Check the port too. Since Home Assistant 2026.8 the default is 80 on Home Assistant OS and still 8123 on Home Assistant Container. The port your install actually uses is shown under Settings > System > Network.

Option 1: Home Assistant Cloud

Home Assistant Cloud is the paid service from Nabu Casa, and the documentation calls it "the easiest and safest option for most people". You open no ports and need no domain or certificate of your own, and the subscription funds Home Assistant development.

Nabu Casa does not see your traffic. When you enable remote access, Home Assistant requests a Let's Encrypt certificate for its unique remote URL and keeps the private key only on your system. Your instance holds an outgoing connection to a Nabu Casa proxy, which routes requests by the server name in the TLS handshake and passes the encrypted data through. Decryption happens on your Home Assistant. The flip side, according to Nabu Casa's support pages: if you lose that key and your own access, Nabu Casa cannot restore it.

  1. Go to Settings > Home Assistant Cloud and log in. Right after the first login you may see a message that remote access is being prepared. Wait a few minutes and refresh.
  2. Under Remote access, turn on the toggle. The first certificate can take up to 60 seconds.
  3. Note the URL shown there. That is your address away from home.
  4. Optionally, turn on Allow external activation of remote access. Then you can switch remote access on from your Nabu Casa account page even if it was off when you left.

For automations there are two actions, cloud.remote_connect and cloud.remote_disconnect, so the remote URL can exist only when nobody is home, for example.

The remote URL is reachable by anyone who knows it. They only get a login page, but that page is public, so the account hardening below applies here too.

Option 2: a VPN

With a VPN nothing in your house answers strangers. Only devices that have joined the VPN can reach Home Assistant. The price is a VPN client on every phone and laptop you use, and one side effect the documentation mentions: when the Companion app has no VPN connection, its sensors stop updating in Home Assistant.

Tailscale

On Home Assistant OS, Tailscale is the simplest choice because there is a community app for it. According to the app documentation, Tailscale is free for personal and hobby projects, up to 100 clients/devices on a single user account.

  1. Install the Tailscale app from Settings > Apps and start it.
  2. Open the app's Web UI and log in to link Home Assistant with your Tailscale account. The documentation recommends doing this in Chrome on a computer, because some browsers fail at this step.
  3. Check the app's logs to confirm it connected.
  4. Install Tailscale on your phone and laptop, log in with the same account and open Home Assistant at its Tailscale address.
  5. In the Tailscale admin console, disable key expiry for the Home Assistant machine, as the app documentation suggests. Otherwise you lose the connection when the key expires.

Devices try to connect directly. When NAT or a firewall prevents that, traffic goes through Tailscale's DERP relay servers. Tailscale's documentation says relayed traffic stays encrypted with WireGuard and the private keys never leave your devices, so the relays cannot read it.

Browsers may warn that a plain http:// address is unencrypted, because they cannot know the tunnel is encrypted. The app's share_homeassistant option fixes that with Tailscale Serve, which gives Home Assistant a valid HTTPS certificate on your tailnet. It needs MagicDNS and HTTPS certificates enabled in the Tailscale admin console, and in Home Assistant Trust X-Forwarded-For turned on with 127.0.0.1 added to Trusted proxies (both under Settings > System > Network > HTTP server).

The same option can switch on Tailscale Funnel instead. Funnel publishes Home Assistant to the whole internet through Tailscale's relays, so it is no longer a private VPN. Treat a Funnel URL like any other public address.

WireGuard on Home Assistant

The WireGuard community app runs a WireGuard server on Home Assistant, with your phone and laptop as clients. It needs a public address: set the host option to a hostname pointing at your home (a DuckDNS name, for example) and forward UDP port 51820 to Home Assistant. Give the VPN an address range different from your home network. The app generates a configuration and a QR code for each client in /ssl/wireguard/<peer name>/qrcode.png, which you scan with the WireGuard app on the phone. Behind CG-NAT this option is out.

Option 3: a reverse proxy or port forwarding with TLS

This route gives you your own domain with no third party in between. It also puts the Home Assistant login page directly on the internet, and keeping it safe is your job.

Never forward the plain HTTP port. In the documentation's words: "Just putting a port up is not secure." You need a hostname and a TLS certificate:

  • The DuckDNS app keeps a free DuckDNS name pointed at your changing IP and gets a Let's Encrypt certificate through the DNS challenge, so port 80 does not have to be open for validation. A free DuckDNS account is limited to five subdomains.
  • A reverse proxy such as NGINX, Caddy, Traefik or HAProxy terminates HTTPS in front of Home Assistant, which stays on plain HTTP inside your network.

Since 2026.8, HTTP server settings live in the UI under Settings > System > Network > HTTP server. An old http: block in configuration.yaml is imported on the first start after the upgrade, and a repair issue reminds you to delete it. Behind a proxy, turn on Trust X-Forwarded-For and add the proxy to Trusted proxies. For a network, use the network address (192.168.1.0/24), not a host address with a mask (192.168.1.50/24). Without these settings, Home Assistant blocks requests from the proxy.

Saving HTTP settings restarts Home Assistant, and an administrator has 5 minutes to confirm them. If nobody does, Home Assistant returns to the previous settings, which saves you if a wrong value locks you out. Finally, enter your public address in the Internet field under Home Assistant URL in Settings > System > Network.

If the public address does not load from inside your home, your router probably lacks hairpin NAT (NAT loopback). The Companion app documentation suggests split DNS: a local DNS server, such as the AdGuard Home app, answers your domain with Home Assistant's internal address.

Harden the accounts before anything is reachable

Unless you use a private VPN, someone on the internet can reach your login page. Before you open anything:

  • Strong, unique passwords and multi-factor authentication. In User profile > Security, under Multi-factor authentication modules, enable the authenticator app module and scan the QR code. If configuration.yaml has no auth_mfa_modules section, this module is loaded automatically. The codes are time-based, so if they keep failing, check the Home Assistant clock.
  • Administrator rights only for those who need them.
  • Local-only accounts. For an account that only works at home, such as a wall tablet, turn on Can only log in from the local network in its user settings under Settings > People. Test it from a phone on mobile data, especially behind a proxy.
  • IP banning. Turn on Enable IP banning in the HTTP server settings and set Login attempts before ban (1 to 1000). Bans go into ip_bans.yaml in the configuration folder and never expire. To lift one, delete the entry and restart. With Home Assistant Cloud, a ban applies to the client's real address and does not affect other cloud connections.
  • Refresh tokens. User profile > Security lists one per signed-in device. If a phone is lost, delete its token.
  • Webhooks. Webhook triggers only accept requests from your local network (and Nabu Casa cloud webhooks) unless you turn off local_only. A webhook needs no login, only its ID, so treat the ID like a password. The documentation advises against using webhooks for locks or garage doors at all.
  • The www folder. Files in /config/www/, served under /local/, need no login. Keep nothing private there.
  • Updates. Home Assistant ships a release every month, and the security checklist asks you to keep up.

Set up the Companion app

The app can switch addresses depending on where you are. Enter an internal URL (such as http://homeassistant.local:8123, or without the port on newer Home Assistant OS installs) and an external one. To tell that you are home, the app reads the Wi-Fi network name, which Android and iOS only allow with location access set to "Allow all the time" or "Always". With Home Assistant Cloud you can tick Connect via Cloud instead of typing an external address. With one public hostname and split DNS, the same address works everywhere.

Which one to choose

  • Home Assistant Cloud if you want the Companion app to work everywhere with nothing to maintain. It also works behind CG-NAT.
  • Tailscale if nothing in your home should be reachable from the internet and you can install a client on your devices. It copes with CG-NAT too.
  • WireGuard on Home Assistant if you have a public IP and prefer not to depend on an outside coordination service.
  • A reverse proxy only if you already run one or want your own domain, and you will keep the proxy, certificates and Home Assistant updated.

Common problems

  • The remote address does not work even on mobile data. Look for CG-NAT, and check that the forwarded port matches the one in Settings > System > Network.
  • Requests through the proxy are rejected. Trust X-Forwarded-For is off, or the proxy is missing from Trusted proxies.
  • You banned yourself. Remove your address from ip_bans.yaml and restart.
  • Authenticator codes are rejected. The Home Assistant clock is off.
  • Tailscale stopped working after a while. Check whether the machine key expired. If so, log in again and disable key expiry for Home Assistant.
  • The Companion app stops updating sensors away from home. With a VPN, the tunnel on the phone is off.