Home Assistant Remote Access Without Port Forwarding

Opening your Home Assistant dashboard while you're out and about shouldn't mean poking holes in your router's firewall. Home Assistant remote access without port forwarding is not only possible, it's become the normal way to do things, mostly because opening ports to your home network is one of the riskier moves you can make. This guide compares the main options: Nabu Casa, Tailscale, WireGuard and Cloudflare Tunnel, so you can pick the one that suits your setup and comfort level.

Expect to spend 20 to 60 minutes getting any of these running, depending on which route you choose. None of them need advanced networking knowledge, though WireGuard asks a bit more of you than the others.

What You'll Need

• A working Home Assistant installation (Home Assistant OS, Supervised, Container or Core)
• A phone or laptop to test remote access from
• An account with whichever service you choose (Nabu Casa, Tailscale or Cloudflare, free tiers work for most households)
• Admin access to your router, only if you go the WireGuard route
• 20 to 60 minutes, depending on the method

Step 1: Decide Which Method Fits You

Before touching any settings, it helps to know what each option actually does.

Nabu Casa is Home Assistant's own paid cloud service. You pay a small monthly or yearly fee, and it handles remote access, Google/Alexa integration and even backups. No networking knowledge needed.

• Pros: dead simple setup, supports official Home Assistant features like voice assistants, money goes back to the project
• Cons: costs money every year, you're relying on a third party's servers for access

Tailscale creates a private mesh network between your devices using WireGuard underneath, but with a much friendlier setup process. You install an app on your phone and on the machine running Home Assistant, and they can talk to each other as if they were on the same network.

• Pros: free for personal use, no port forwarding, works almost anywhere, easy phone app
• Cons: you're trusting Tailscale's coordination servers (though your actual traffic is encrypted end to end), one more app to keep updated

WireGuard, set up yourself on your router or a dedicated device, gives you a proper VPN server for Home Assistant without relying on anyone else's infrastructure.

• Pros: free, fully under your control, fast, works for accessing your entire home network, not just Home Assistant
• Cons: more setup steps, you manage your own keys and configs, slightly more to troubleshoot if something breaks

Cloudflare Tunnel routes traffic through Cloudflare's network to your Home Assistant instance, without opening any inbound ports.

• Pros: free, works well if you already use a domain through Cloudflare, no VPN app needed on your phone
• Cons: more fiddly initial setup, your traffic passes through Cloudflare's servers, not ideal if you want full control of the path your data takes

If you want a wider comparison of all remote access approaches, including options beyond Home Assistant specifically, the guide on the best way to access your home network remotely is worth a read before you commit.

Step 2: Set Up Nabu Casa (the Easy, Paid Route)

1. Open Home Assistant and go to Settings > Home Assistant Cloud.
2. Click Start Your Free Trial (Nabu Casa typically offers a free trial period before billing starts).
3. Sign in or create an account when prompted.
4. Once subscribed, remote access, Google Assistant and Alexa integration all switch on automatically.
5. Test it by opening the Home Assistant app away from your home Wi-Fi.

That's genuinely most of it. Nabu Casa is built by the same team behind Home Assistant, so it tends to "just work" with new features as they arrive. If you want zero fuss and don't mind the subscription, this is the path of least resistance.

Step 3: Set Up Tailscale (Free and Beginner Friendly)

1. Create a free account at tailscale.com.
2. Install the Tailscale add-on from the Home Assistant Add-on Store (search "Tailscale" under Settings > Add-ons > Add-on Store), or install the Tailscale app directly on the machine running Home Assistant if you're not using the Supervisor.
3. Start the add-on and authenticate it with your Tailscale account when prompted.
4. Install the Tailscale app on your phone or laptop and log into the same account.
5. Once both devices show as connected in your Tailscale admin console, open a browser on your phone and go to http://<home-assistant-tailscale-ip>:8123.
6. Bookmark that address so you don't need to remember it.

Tailscale is a great middle ground. It's genuinely free for personal use, doesn't need router changes, and the setup takes most people under 20 minutes. If you've looked at mesh VPN options from other providers, it's worth comparing against what's covered in the piece on whether NordVPN can access your home network through Meshnet, since the concept is similar but aimed at a different audience.

Step 4: Set Up Your Own WireGuard VPN Server

If you'd rather not depend on any third-party coordination service, running your own WireGuard VPN server for Home Assistant puts you fully in charge. Many routers now support WireGuard natively.

1. Check whether your router supports WireGuard. ASUS, TP-Link/Omada and UniFi/Ubiquiti gear all have built-in support on recent firmware.
2. Enable the WireGuard server on your router and create a client profile for your phone or laptop.
3. Install the WireGuard app on your device and import the config, either by scanning a QR code or pasting the file.
4. Connect to the VPN from outside your home network, then open http://<home-assistant-local-ip>:8123 in your browser as if you were at home.

The exact steps vary by router brand, so it's worth following a guide specific to your hardware:

• Setting up WireGuard on an ASUS router
• Setting up WireGuard on TP-Link and Omada routers
• Setting up WireGuard on UniFi and Ubiquiti gear

If you want to understand what's actually inside a WireGuard config file before you start editing one, the breakdown in WireGuard config files explained clears up what each line does.

This method gives you remote desktop from Home Assistant style access to your whole network too, not just the Home Assistant web interface, since once you're on the VPN you can reach any device on your home LAN, including NAS devices and other network hardware if you have remote desktop software running on them.

Step 5: Set Up Cloudflare Tunnel (No VPN App Needed)

Cloudflare Tunnel works differently. Instead of connecting your phone to your home network, it creates an outbound-only connection from your Home Assistant server to Cloudflare, and Cloudflare serves requests to your dashboard through a normal web address.

1. Sign up for a free Cloudflare account and add a domain to it (you'll need to own a domain name for this one).
2. Install the Cloudflared add-on from the Home Assistant Add-on Store, or run cloudflared as a separate service if you're on Container or Core.
3. Authenticate the add-on with your Cloudflare account and create a new tunnel.
4. Point the tunnel at your Home Assistant instance's internal address, typically http://homeassistant.local:8123 or the local IP.
5. Add a DNS record in Cloudflare pointing a subdomain, such as ha.yourdomain.com, to the tunnel.
6. Visit that subdomain from anywhere to reach your dashboard.

This route suits people who already manage a domain through Cloudflare and want a clean web address rather than a VPN connection. It takes a bit longer to set up than Tailscale, mostly because of the domain and DNS steps.

Common Mistakes to Avoid

• Still forwarding a port "just in case." If you've set up any of these methods, there's no reason to leave port 8123 forwarded on your router. Close it.
• Using weak or reused passwords on your Home Assistant account. Remote access makes a weak login more exploitable, so set a strong, unique password and enable two-factor authentication if you can.
• Forgetting to update the Home Assistant app or add-ons. Outdated software is one of the more common ways people run into security issues with remote access.
• Skipping local DNS checks before troubleshooting. If Tailscale or WireGuard connects but the dashboard won't load, confirm you're using the correct local IP or hostname, not an old or cached one.
• Mixing up VPN and tunnel approaches. Tailscale and WireGuard put your device on the home network virtually; Cloudflare Tunnel exposes just the Home Assistant service. Don't expect Cloudflare Tunnel to give you access to your printer or NAS the way a VPN would.

Conclusion

There's no single correct answer for Home Assistant remote access without port forwarding, it genuinely depends on how much setup time you want to spend versus how much control you want over your own data. Nabu Casa is the easiest and supports the project financially. Tailscale is free, quick and friendly for most households. WireGuard gives you a self-hosted VPN server for Home Assistant and full network access, including remote desktop from Home Assistant to other machines at home. Cloudflare Tunnel suits people already comfortable managing a domain. Whichever you pick, you'll end up with safer, more flexible access than opening a port ever gave you.

If you're still weighing up the bigger picture of remote access to your home, the beginner's guide to accessing your home network remotely is a good next read, and if your router ever needs a reboot while you're away, it helps to know how to restart your router remotely too.

FAQ

Is Nabu Casa worth paying for?

If you want the simplest setup with no technical steps, yes. It also supports Home Assistant's development directly and adds voice assistant integration without extra configuration. If you're comfortable with a bit more setup, Tailscale or WireGuard give you the same remote access for free.

Can I use Tailscale and WireGuard together?

There's no real need to, since Tailscale is built on WireGuard anyway. Running both at once can cause routing conflicts, so pick one.

Do I need a static IP address for any of these methods?

No. All four options are designed to work around changing home IP addresses. Nabu Casa, Tailscale and Cloudflare Tunnel handle this automatically, and most router-based WireGuard setups support dynamic DNS if your IP changes.

Can I get remote desktop access to other devices through Home Assistant's VPN?

Yes, if you use WireGuard or Tailscale. Since these put your phone or laptop virtually on your home network, you can reach other devices too, including using remote desktop software on a home PC, not just the Home Assistant dashboard.

Is it safe to skip port forwarding entirely?

Yes, and it's actually safer. Port forwarding opens a direct path into your network that's visible to anyone scanning for it. All four methods in this guide avoid that entirely, which is the main reason they've become the standard approach.

Which option is fastest to set up?

Nabu Casa and Tailscale are both quick, usually under 20 minutes. WireGuard and Cloudflare Tunnel take a bit longer because of router configuration or domain setup, but neither is difficult once you follow the steps in order.