Remote access to Home Assistant: Nabu Casa, Cloudflare Tunnel, VPN or port forwarding?
Remote access lets you control your home, check alarms, receive notifications and use the Home Assistant app away from your own Wi-Fi network.
No single method is right for everyone. Security, convenience, CGNAT, your own domain and whether access should be public or private all matter.
A secure, maintainable solution matters more than simply making the connection work.
What should you choose?
- I want the simplest option: Nabu Casa.
- I want my own domain without traditional port forwarding: Cloudflare Tunnel.
- Access should be limited to me and my devices: Tailscale.
- I understand networking and want to manage HTTPS, firewall and forwarding myself: port forwarding.
This is not a ranking. Each method solves a slightly different problem.
Home Assistant Cloud: the simplest method
Home Assistant Cloud, provided by Nabu Casa, is officially associated with the Home Assistant project. Remote UI can be enabled in settings without traditional port forwarding or maintaining your own reverse proxy.
It is convenient for beginners and anyone who wants minimal administration. It works smoothly with the mobile app and does not require your own domain.
Downsides: it is a paid subscription and depends on an external service. In return, you get simplicity, official support and a solution you do not need to build yourself.
Your own domain without traditional port forwarding
Cloudflare Tunnel creates an outbound connection from your home network to Cloudflare. A public hostname such as ha.example.com routes through the tunnel to local Home Assistant without a conventional router port forward.
This suits users who want their own domain and can manage DNS, the tunnel and Home Assistant settings. Reverse proxy handling must be correct, including use_x_forwarded_for and a precise trusted_proxies range.
A tunnel does not make the whole setup automatically secure. You still need a strong Home Assistant password, MFA, updates and appropriate access rules. Incorrect proxy settings can block login or misidentify the source of traffic.
Private access for your own devices
Tailscale creates a private network between approved devices. Your phone or laptop connects to Home Assistant through that network, while the dashboard does not need to be a public web service.
This is a strong choice for the owner and a small number of trusted people. Tailscale uses NAT traversal and generally works without a public IP and behind CGNAT. If a direct connection cannot be established, traffic can use an encrypted relay.
Limitation: a device accessing Home Assistant must belong to the private tailnet and be connected. It is less convenient when a normal public URL must serve a larger group of users or services.
Direct port forwarding
Port forwarding sends incoming traffic from the router's public address to Home Assistant or a reverse proxy on the local network. It requires public connectivity from the ISP, correct DNS, HTTPS and certificates, firewall rules and regular updates.
A dynamic public IP may require dynamic DNS. With CGNAT, conventional port forwarding normally cannot work unless the ISP changes the service.
Simply exposing Home Assistant port 8123 without correct HTTPS and security is not recommended. The method can be secure, but it requires knowledge and ongoing maintenance. It is not my default recommendation for a beginner.
Why might port forwarding fail?
CGNAT means that multiple ISP customers share one public IPv4 address. Your home router does not control the complete path for incoming traffic, so adding a local port-forward rule may not expose Home Assistant to the internet.
You can ask the ISP for a public IP, but it may not be available or may cost extra. Nabu Casa, Cloudflare Tunnel and Tailscale initiate the needed connections from inside or use their own networking layer, making them practical with CGNAT.
Using Home Assistant at home and away
Nabu Casa offers the simplest app connection through Home Assistant Cloud. Cloudflare Tunnel and correctly secured port forwarding use a public HTTPS address configured as the External URL.
With Tailscale, the phone must be connected to the private network. The app can use an address reachable through the VPN, but internal and external address behaviour should be tested on both home Wi-Fi and mobile data.
Do not use an unsecured HTTP address as a public External URL. Remote app connections should use properly secured HTTPS or an active VPN.
Rules that apply to every method
- Use a strong, unique password for Home Assistant and intermediary services.
- Enable multi-factor authentication.
- Keep Home Assistant, apps, integrations and the host system updated.
- Limit public exposure to what is genuinely required.
- Use correct HTTPS wherever traffic crosses a public network.
- Never publish tunnel tokens, API keys or login details.
- Create regular backups and keep a copy away from the Home Assistant device.
Updates and backups are part of maintaining the system. See the Home Assistant maintenance guide for more.
Four methods in practice
| Method | Ease | Cost | Own domain | CGNAT | Open ports | Best use |
|---|---|---|---|---|---|---|
| Nabu Casa | Ease: very easy | Cost: subscription | Domain: not needed | CGNAT: works | Ports: no | Best for: simple official access |
| Cloudflare Tunnel | Ease: moderate | Cost: can be free | Domain: yes | CGNAT: works | Ports: no | Best for: own domain and public URL |
| Tailscale | Ease: easy or moderate | Cost: plan depends on needs | Domain: not needed | CGNAT: works | Ports: usually no | Best for: private access from your devices |
| Port forwarding | Ease: difficult | Cost: usually free, public IP may cost | Domain: recommended | CGNAT: usually no | Ports: yes | Best for: a deliberately managed network |
Which method is right for you?
Choose Nabu Casa when you simply want official remote access. Choose Cloudflare Tunnel when your own domain matters and you accept extra configuration. Choose Tailscale when private access from your own devices is the priority.
Reserve port forwarding for cases where you understand HTTPS, DNS, firewalls and the consequences of publicly exposing a service. The right method is one you can keep secure after future updates as well.
Frequently asked questions
Does Home Assistant need port 8123 open?
No. Nabu Casa, Cloudflare Tunnel and Tailscale do not require a traditional router forward for port 8123.
Does Cloudflare Tunnel work behind CGNAT?
Yes. The tunnel connection is initiated from the local network towards Cloudflare.
Does Tailscale work without a public IP?
Yes. It uses NAT traversal and can fall back to encrypted relays when a direct connection is not possible.
Does Nabu Casa require router configuration?
No conventional port forwarding is required. Remote access is enabled in Home Assistant Cloud settings.
Is port forwarding secure?
It can be when the entire setup is correct and maintained. Opening a port without HTTPS, MFA and updates is risky.
Can I use the Home Assistant app away from home?
Yes. Nabu Casa is the simplest, public solutions use an External URL, and Tailscale connects the phone through a private VPN.
Do I need my own domain?
Not for Nabu Casa or Tailscale. It is required or strongly useful for Cloudflare Tunnel and your own public HTTPS setup.
What is simplest for a beginner?
Nabu Casa. If access is strictly private and a VPN app is acceptable, Tailscale is also worth considering.
Need help with remote access to Home Assistant?
If you are not sure which method to choose, remote access is not working, or configuring Cloudflare, VPN, your domain or network is too complicated, I can review your situation and help you choose a secure solution.
Contact me.The initial assessment is free and without obligation. → click hereSources and currency
Checked on 17 August 2026 against current official materials: