Home Assistant Remote Access: 5 Methods Compared (Which Is Safest in 2026)

TL;DR - which method for whom#

If you don't feel like reading 1500 words - here's the cheat sheet:

Now the details of each method - what, how, when, and where to watch out.

The problem: Home Assistant works at home, dead outside#

You've set up Home Assistant. Raspberry Pi 4 on a shelf, HACS with integrations, automations for lighting, alarm with cameras. At home - heaven.

You leave for work. You want to check if your partner forgot to turn off the oven. You open HA Companion - connection error. You forgot that homeassistant.local:8123 only works from inside the network.

That's the classic moment where HA users start looking for remote access. There are 5 realistic methods to choose from. Each has its strengths and weaknesses.

Method 1: Router port forwarding#

How it works#

You open port 8123 on your router (or 443 + nginx reverse proxy) and expose Home Assistant publicly. From now on http://your-public-ip:8123 lets you reach HA from the internet.

Pros#

• Free
• No additional software
• Works with any app, any browser

Cons#

• Security: your HA is publicly visible. Automated port scanners find it within hours. Any new vulnerability in HA, Supervisor, or an add-on (ESPHome, Frigate, HACS) = a path into your home network.
• No HTTPS out of the box: you have to set up a Let's Encrypt certificate yourself, which needs a public domain and DDNS.
• CG-NAT blocks it: mobile ISPs and some cable providers use CG-NAT - you don't have a public IP, port forwarding won't work.
• Dynamic IP: if your ISP changes your IP, you must update DNS.

When to pick#

Practically never. The only sensible scenario: a temporary test setup on an isolated network. For a production home HA - it's risk out of proportion to the benefit.

Method 2: WireGuard or OpenVPN#

How it works#

You set up a VPN server (WireGuard on a pfSense/OPNsense router, or WireGuard in a Docker container on HA). You install a VPN client on every device - phone, laptop. When the VPN is active, you're "inside the home network" and HA is reachable as if local.

Pros#

• Full encryption: WireGuard uses modern algorithms (ChaCha20, Poly1305, Curve25519).
• Self-hosted: nothing passes through a third-party server.
• Free (open-source software).
• Access to the whole network: not just HA, but also NAS, printer, everything.

Cons#

• Setup difficulty: generating keys, router settings, debugging MTU, DNS split-tunneling. Not for beginners.
• Client on every device: you need to install a WireGuard app on every family member's phone/laptop. Grandparents won't manage.
• Battery drain on phones: VPN open 24/7 drains the battery and sometimes drops when switching WiFi↔LTE.
• CG-NAT problem: the VPN server also requires a public IP or a paid VPS as relay.

When to pick#

You're a technical user, you don't trust the cloud, you have a public IP, you want access to your WHOLE home network (not just HA). Ideal for r/selfhosted perfectionists.

Method 3: Tailscale (or Headscale for self-host)#

How it works#

Tailscale is a managed layer on top of WireGuard. You create an account, install the Tailscale client on HA and on each device, and they all see each other in one private network. No port config, no key management.

Headscale is the self-hosted open-source backend for Tailscale - same protocol, but with the coordinator on your VPS.

Pros#

• Very easy setup: curl -fsSL https://tailscale.com/install.sh | sh + OAuth login. 5 minutes.
• Free tier: unlimited devices, up to 6 users - free of charge.
• Works behind CG-NAT: Tailscale uses DERP relays when P2P fails.
• Magic DNS: you connect via ha-raspberry.tailnet-name.ts.net instead of an IP.

Cons#

• Client required: every device wanting to access HA must have Tailscale installed. For a family that's 4 phones × install + login.
• No public URL: you can't send a link to grandma - she also needs to install the client.
• Closed ecosystem: your subdomain in tailnet-*.ts.net isn't public (Funnel beta changes this, but with its own limits).

When to pick#

You have several of your own devices (work laptop, home NAS, HA, a second Raspberry) and want to connect them all. Perfect for a solo self-hoster. Weak when you want to share HA with someone non-technical.

Method 4: Nabu Casa (Home Assistant Cloud)#

How it works#

The official cloud service from the HA team. You pay ~$7.50/mo, enable it in HA (literally one click), get a URL like https://abcd1234.ui.nabu.casa that works everywhere.

Pros#

• Zero configuration: one click in the HA UI, done.
• Google Assistant + Alexa: cloud integration with voice assistants is included - say "OK Google, turn off the living room lights" and it works without extra config.
• You fund the HA project: Nabu Casa belongs to the Open Home Foundation - your money goes into HA development.
• Official support: forum questions get priority.

Cons#

• Home Assistant only: won't help with Domoticz, Node-RED, Jellyfin, or Grafana.
• Long random URL: abcd1234.ui.nabu.casa - impossible to memorize. Grandma won't type it.
• Subscription only: no pay-as-you-go for vacations.
• US/GCP infrastructure: for some users a GDPR concern.

When to pick#

You use ONLY Home Assistant, you want Google Assistant/Alexa cloud, you value financially supporting the HA project. A very good choice for a regular user.

Method 5: Reverse SSH tunnel (SmartHomeEntry and alternatives)#

How it works#

An agent on your HA opens an outbound connection (outbound SSH) to a relay server. The relay gives you a public HTTPS subdomain (e.g. your-home.smarthomeentry.com). Nothing is installed on the viewer's device - they just use a browser.

This is the same model used by ngrok, Cloudflare Tunnel, Tailscale Funnel (beta), and SmartHomeEntry.

Pros#

• Public URL: send a link to family/clients, it opens in a browser. Zero installation on the recipient's side.
• Short subdomain: your-home.smarthomeentry.com is easier to remember than a Nabu Casa token.
• Multi-service: one machine can serve HA + Domoticz + Jellyfin + Nextcloud + NAS. Each service runs its own agent with its own tunnel and subdomain, and your plan sets how many you get.
• Works behind CG-NAT: the agent only makes outbound connections, no public IP needed.
• Pay-as-you-go: SmartHomeEntry has Vacation Access ($3 / 7 days, $8 / 30 days, $18 / 90 days) - ideal for a single trip.
• Installer plans: 5-20 installations in one panel with alerts and SLA PDF reports.

Cons#

• Managed service: traffic passes through a third-party server. If you're paranoid - not for you (alternative: self-hosted Cloudflare Tunnel or your own reverse tunnel on a VPS, but much harder).
• Additional latency: the tunnel adds ~15-25 ms round-trip. Unnoticeable for UI, but for transferring large files (> 1 GB) native WireGuard P2P will be faster.
• No SSH/RDP: SmartHomeEntry only tunnels HTTP/HTTPS, not other ports.

When to pick#

Most real-world scenarios:

• Family is supposed to use HA remotely (and doesn't want to install a VPN)
• You have many services on the same server (HA, Jellyfin, NAS)
• You want pay-as-you-go for vacation instead of a permanent subscription
• You're a Smart Home installer managing 5-20 clients
• You want to share a Grafana dashboard with a business client

Decision matrix - how to pick in 30 seconds#

Answer yourself 3 questions:

1. Do other people (family, clients) also need access?

• Yes → SmartHomeEntry or Nabu Casa (public URL, zero install on recipient side)
• No, only me → Tailscale (free tier)

2. Do you use only Home Assistant, or also other services (Jellyfin, NAS, Grafana)?

• HA only → Nabu Casa (if you also want Google Assistant) or SmartHomeEntry (if you prefer shorter URL / lower price)
• Multiple services → SmartHomeEntry (multi-service in one subscription) or Tailscale (if only for you)

3. What's your budget and usage horizon?

• Occasional (a trip) → SmartHomeEntry Vacation Access ($3-$18)
• Always on, one home → SmartHomeEntry Home ($7/mo) or Nabu Casa (~$7.50/mo)
• Always on, many clients (installer) → SmartHomeEntry Pro/Business ($25-$60/mo)
• Free, only for yourself → Tailscale free tier

FAQ#

Can you use two methods in parallel?#

Yes. A common setup: Tailscale for your own devices + SmartHomeEntry for public HA sharing with family. Or: Nabu Casa for Google Assistant + SmartHomeEntry for cheaper remote access. No conflict at the HA level.

Which method is the most secure?#

Tailscale and WireGuard are the least "publicly visible" (require a client + auth on every device). SmartHomeEntry and Nabu Casa give you a public URL protected by your HA password - security depends on HA password quality and whether MFA is on. Port forwarding is the weakest.

Does Home Assistant Companion app (Android/iOS) work with each method?#

Yes - you enter the server address in the app, the rest works identically. With Tailscale you enter the tailnet IP, with Nabu Casa the long URL, with SmartHomeEntry your short subdomain, with VPN the local IP (after VPN is up).

Do voice commands (Google Assistant / Alexa) work with SmartHomeEntry?#

Not directly. SmartHomeEntry is a tunnel to the web panel - not a bridge to voice assistants. If you need Google/Alexa, use Nabu Casa in parallel (both work without conflict) or HA Voice (local, open-source alternative in HA 2024+).

Which methods work behind CG-NAT on mobile ISPs?#

• Port forwarding: doesn't work (no public IP).
• WireGuard / OpenVPN self-host: doesn't work (VPN server needs public IP).
• Tailscale: works (DERP relay).
• Nabu Casa: works (cloud relay).
• SmartHomeEntry: works (outbound-only agent).

What about GDPR / data location?#

Tailscale: coordinator in the US (you can self-host via Headscale). Nabu Casa: mostly US/GCP. SmartHomeEntry: servers in the EU (OVH Warsaw). WireGuard self-host: yours. The choice depends on your compliance requirements.

Summary#

There's no single "best" method - there's the best for your case. If you're a solo technical user wanting full control → Tailscale or WireGuard. If you want peace of mind and Google Assistant → Nabu Casa. If your setup is HA + Jellyfin + NAS + a family that doesn't get VPN - SmartHomeEntry.

Each of the described methods is a real option - just avoid Port Forwarding (without a specific reason) and keep a healthy skepticism of free tunnels (ngrok free tier changes the URL on every restart).