Three Secure Ways to Access Home Assistant From Anywhere

This post may contain affiliate links. As an Amazon Associate we earn from qualifying purchases. Disclosure.

The fastest way to get remote access to Home Assistant is through Nabu Casa, which is quick to set up and requires no networking knowledge. For users who want free alternatives, DuckDNS with Let's Encrypt HTTPS or a WireGuard VPN both provide secure access without a monthly subscription. This guide explains all three methods with step-by-step instructions so you can control your smart home from anywhere. The comparison below comes from the Home Assistant, Nabu Casa, and WireGuard documentation rather than a hands-on bake-off, and it's weighted toward ease, cost, and security. Everything here applies to a Raspberry Pi 4 install as much as to any other host.

Bottom line: Use Nabu Casa ($6.50/month) for the easiest setup with built-in voice assistant support. Use DuckDNS with HTTPS for a free option if you are comfortable with port forwarding. Use WireGuard VPN for maximum security since it never exposes Home Assistant to the public internet.

Remote access lets you check camera feeds, adjust thermostats, trigger automations, and monitor sensors remotely while you are away from your local network. This kind of external access - reaching Home Assistant from the internet rather than your home Wi-Fi - is what lets you check on the house from a phone on cellular data or a laptop at the office. Each method below gives you that access from the internet with different trade-offs between ease of setup, ongoing cost, and security level. Choose based on your technical comfort and whether you need voice assistant integration from outside your home. If you haven't set up the platform yet, our Home Assistant getting-started guide walks through the install first.

Method 1: How Do You Use Home Assistant Cloud Through Nabu Casa?

Nabu Casa is the official cloud service for Home Assistant, built by the same team that develops the platform. One naming note before the steps: Nabu Casa announced on October 2, 2026 that Home Assistant Cloud becomes Home Assistant Link, with the new name becoming official in the 2026.12 release in December. It's the same service with the same features, so expect to see either name in menus and documentation during the switch. It creates an encrypted tunnel between your Home Assistant instance and a relay server, so your dashboard becomes accessible from any browser or the Home Assistant mobile app without opening ports on your router.

Setting up Nabu Casa takes three steps. Open Home Assistant, go to Settings, then Home Assistant Cloud, and create an account. The service activates immediately after signup, and your instance becomes available at a unique URL. The mobile app detects the cloud connection automatically when you log in with your Nabu Casa credentials. There is no port to forward, no certificate to renew and no dynamic DNS record to keep alive, which is the entire proposition: you are paying a subscription to never think about any of that again. Worth being clear-eyed about what the money buys, though. It is convenience, not capability, and it puts a company between you and your own house.

Nabu Casa Pricing and Voice Assistant Support

Nabu Casa lists Home Assistant Cloud at $6.50 per month or $65 per year in the US, and 7.50 EUR per month or 75 EUR per year in the EU (prices differ by region, and local tax may be added). New accounts get a 31-day free trial with no card required, so you can test it before paying. The subscription also unlocks direct Alexa and Google Assistant integration without any manual configuration. According to the Home Assistant docs, subscriptions help fund the development of Home Assistant itself, so the subscription supports the open-source project.

Nabu Casa advantages:

• Quick setup with no networking knowledge required
• Works behind carrier-grade NAT (CGNAT) where port forwarding is not possible
• Automatic TLS encryption on all connections
• Built-in voice assistant integration with Alexa and Google Assistant
• Supported by the Home Assistant team with guaranteed compatibility

The main limitation is the recurring cost. If you run Home Assistant on a Raspberry Pi and want to keep the entire setup free, the methods below avoid monthly fees.

Method 2: How Do You Set Up DuckDNS With Let's Encrypt HTTPS?

DuckDNS provides a free dynamic DNS service that maps a subdomain (like yourhome.duckdns.org) to your home IP address. Paired with a Let's Encrypt SSL certificate, this gives you encrypted remote access without a subscription. Let's Encrypt is a free, automated, and open Certificate Authority run by the Internet Security Research Group that has issued billions of certificates since 2015.

The setup process requires some networking knowledge but follows a well-documented path. Install the Duck DNS app from the Home Assistant App Store (Home Assistant renamed add-ons to apps in the 2026.2 release, so older guides call it the add-on). Create a free account at duckdns.org and register a subdomain. Enter your DuckDNS token and subdomain into the app configuration. Set lets_encrypt.accept_terms to true in the same app to automatically obtain and renew SSL certificates, which land in the /ssl/ folder as fullchain.pem and privkey.pem.

After configuring the add-on, you need to set up port forwarding on your router. Forward external port 443 to your Home Assistant IP address on port 8123. The exact steps depend on your router model, but most routers have a port forwarding section under advanced settings or firewall configuration.

Important security considerations for this method:

• Always use HTTPS, never expose Home Assistant over plain HTTP
• Turn on "Enable IP banning" under Settings, then System, then Network, and set a login attempts limit so repeated failed logins get blocked (bans don't expire on their own)
• Use strong passwords and enable multi-factor authentication
• Restrict port forwarding to only port 443 and do not forward any other ports
• Check your configuration regularly: Let's Encrypt certificates are valid for 90 days today, and the default drops to 64 days on February 10, 2027 (45 days in 2028), so a certificate that fails to renew will bite sooner than it used to

This method does not work if your internet service provider uses carrier-grade NAT (CGNAT), which is common with fiber and mobile broadband providers. According to RFC 6598, CGNAT uses address ranges 100.64.0.0/10 to conserve public IPv4 addresses. To check, compare your router WAN IP address with the IP shown at whatismyip.com. If they differ, your ISP uses CGNAT and you need Nabu Casa or a VPN with an external relay instead.

DuckDNS is a solid free option for users comfortable with basic networking. The ongoing maintenance is minimal since certificates renew automatically and the DuckDNS add-on updates your IP address whenever it changes. Once configured, the add-on handles renewal and keeps the hostname pointed at your current address, so there is little to babysit.

Method 3: How Do You Set Up WireGuard VPN for Remote Access?

A VPN creates an encrypted tunnel between your phone or laptop and your home network. Unlike DuckDNS, the VPN approach does not expose Home Assistant directly to the internet. Your Home Assistant instance stays on the local network, and you access it through the VPN tunnel as if you were at home.

WireGuard is the recommended VPN protocol for Home Assistant because it is faster, simpler to configure, and more battery-friendly on mobile devices compared to OpenVPN. The WireGuard documentation describes it as a modern VPN protocol designed for simplicity and performance.

Install the WireGuard app from the Home Assistant App Store (a community app from the Home Assistant Community Add-ons project, formerly called an add-on). Set server.host to your external address, such as a DuckDNS hostname, and note that it can't be a Nabu Casa URL. The app generates server keys automatically unless you supply your own. Configure a peer for each device you want to connect from, which generates a client configuration file and QR code under /ssl/wireguard/<name>/. Install the WireGuard app on your phone or laptop and scan the QR code to add the connection profile. WireGuard tends to reconnect quickly, because its design is deliberately small: one UDP port, key-based peers, and no long session negotiation. What you pay for that is the setup itself, plus a router port that has to stay open and a key per device to keep track of.

On your router, forward UDP port 51820 (the app's default, changeable in its Network section) to your Home Assistant IP address. It's UDP, not TCP, which trips people up. This single port handles all VPN traffic. Once connected, your device acts as if it is on your home network, meaning you access Home Assistant at its normal local address (typically homeassistant.local:8123).

Benefits of the VPN approach:

• Home Assistant is never exposed to the public internet
• You can access other devices on your home network through the same tunnel, including network shares, printers, and other services
• WireGuard uses modern cryptography (Curve25519, ChaCha20, Poly1305) that is considered secure by independent audits
• Battery impact on mobile devices is minimal compared to older VPN protocols
• No recurring cost beyond the one-time setup time

The downside is that VPN setup requires more technical steps than Nabu Casa, and you must remember to connect the VPN before accessing Home Assistant. Some users automate this by configuring the WireGuard app to connect automatically when the phone leaves the home Wi-Fi network.

Which Remote Access Method Should You Choose?

Each method serves different user profiles. Here is how they stack up across the factors that matter most:

• Setup difficulty: Nabu Casa is the easiest, DuckDNS is moderate, WireGuard is the most involved (plan on an evening the first time)
• Monthly cost: Nabu Casa costs $6.50, DuckDNS and WireGuard are both free
• Security level: WireGuard is the most secure because Home Assistant stays unexposed, Nabu Casa is secure through its relay, DuckDNS requires careful port forwarding configuration
• Voice assistant support: only Nabu Casa includes built-in Alexa and Google Assistant remote integration
• CGNAT compatibility: Nabu Casa works behind CGNAT, DuckDNS does not, WireGuard requires an external relay server if behind CGNAT

For most users, Nabu Casa offers the best balance of simplicity and functionality while supporting the Home Assistant project financially. For technically inclined users who want maximum security, WireGuard provides the strongest protection. DuckDNS with HTTPS fills the middle ground for users who want free access and are comfortable with port forwarding.

How Do You Troubleshoot Common Remote Access Issues?

Connection problems after setup usually fall into a few categories. If you cannot connect at all, verify your router port forwarding is pointing to the correct internal IP address. Home Assistant IP addresses can change if your router assigns addresses dynamically, so consider setting a static IP or DHCP reservation for your Home Assistant device.

SSL certificate errors with DuckDNS typically mean the Let's Encrypt certificate failed to renew. Check the Duck DNS app logs in Settings, then Apps, then Duck DNS, then Log. The app proves ownership through a DNS challenge (the Home Assistant docs mention ACME DNS-01 and a TXT record on your subdomain), so look for errors about the TXT record or an unreachable DuckDNS service before touching your router. Community threads also show failures after adding aliases to the domain list; clearing them and restarting the app is a known workaround.

If WireGuard connects but you cannot reach Home Assistant, check the AllowedIPs setting in your client configuration (client_allowed_ips in the app). The app's default is 0.0.0.0/0, which sends all of the phone's traffic through your home connection; if you narrowed it to a split tunnel, make sure it still includes your home network subnet and the VPN address range.

Nabu Casa routes your traffic through a relay, so it adds a hop compared with a direct connection. If speed matters, DuckDNS or WireGuard connect straight to your home network and can feel quicker for dashboard interactions.

Always keep your Home Assistant installation updated, enable multi-factor authentication regardless of which remote access method you use, and review your access logs periodically through Settings, then System, then Logs to check for unauthorized access attempts.

What Are the Security Best Practices for Remote Home Assistant Access?

Regardless of which remote access method you choose, several security measures apply universally. These recommendations align with the NIST Cybersecurity Framework, which emphasizes identifying, protecting, detecting, responding to, and recovering from cybersecurity threats. Start by enabling multi-factor authentication in your Home Assistant user profile. This adds a time-based one-time password (TOTP) requirement through apps like Google Authenticator or Authy, preventing unauthorized access even if your password is compromised.

Use strong, unique passwords for your Home Assistant account. Password managers like Bitwarden or 1Password generate and store complex passwords so you do not need to remember them. Avoid reusing passwords from other services since a breach on one platform could expose your smart home controls.

Keep your Home Assistant installation updated to the latest version. Security patches ship with each monthly release, and running an outdated version leaves known vulnerabilities unpatched. Enable automatic update notifications in Settings, then System, then Updates to stay informed when new versions become available.

Review your trusted networks configuration. Home Assistant allows you to specify local IP ranges that skip authentication, which is convenient at home but dangerous if misconfigured. Verify that only your actual home network subnet appears in the trusted networks list and that no public IP ranges are accidentally included. The docs add two warnings: without the standard Home Assistant login as a fallback, anyone on a trusted network can sign in by picking a username, and logins through this provider skip multi-factor authentication entirely.

For households with multiple users, create separate Home Assistant accounts for each person rather than sharing a single login. Individual accounts provide separate access logs, allow different permission levels, and make it easier to revoke access if a device is lost or stolen. The Home Assistant user management panel under Settings, then People handles account creation and permission assignment.

The honest tradeoff is setup time versus control. Nabu Casa needs no router configuration at all. WireGuard costs nothing ongoing, but you have to get port forwarding right, and that gets harder behind a double-NAT ISP router. Skip Nabu Casa if you're already comfortable with VPNs and want to avoid a recurring fee; skip WireGuard if your router doesn't expose port forwarding or you don't want to think about DNS again.