Accessing a Fritz!Box remotely

Remote access to your Fritz!Box, a NAS, a camera or Home Assistant requires two things: an address at which your home connection can be reached, and a way into your home network. MyFRITZ! or a DynDNS service provides the address, and a VPN or port forwarding provides the way in.

The address: MyFRITZ! or DynDNS

Your internet connection is regularly assigned a new IP address. A fixed name that always points to the current address solves this.

• MyFRITZ! is the service from AVM. It is free of charge and requires a MyFRITZ! account. The address is an automatically assigned string under myfritz.net.
• DynDNS assigns a name of your choice, for example zuhause.dynipdns.de, with IPv4 and IPv6. The name also works with other routers and can be stored in devices that need a fixed address. You set up our DynDNS hosting in the Fritz!Box under Internet, Permit Access, DynDNS, as described in the guide to DynDNS on the Fritz!Box.

The way into your home network: VPN or port forwarding

VPN with WireGuard

A VPN connects your smartphone or laptop to your home network as if they were at home. All devices in the home network are then reachable without individual ports being open to the outside. WireGuard is included in the Fritz!Box from FRITZ!OS 7.50 onward. This is the recommended way to access the entire home network.

Port forwarding

Port forwarding makes a single service in your home network reachable from outside, for example a web server. In the Fritz!Box, you find it under Internet, Permit Access, Port Sharing. Only forward what really needs to be reachable from outside, and keep the device behind it up to date and protected with a strong password.

Step by step: DynDNS and WireGuard

1. Set up DynDNS in the Fritz!Box as described in the guide.
2. In the Fritz!Box, open Internet, Permit Access and the VPN (WireGuard) tab.
3. Create a new connection and select in the wizard that a single device is to be connected. The exact labels depend on the FRITZ!OS version.
4. Install the WireGuard app on your smartphone and scan the QR code that the Fritz!Box displays.
5. Test the connection over the mobile network, not over your own Wi-Fi.

The generated configuration lists the address at which the Fritz!Box can be reached as the endpoint, either your DynDNS name or the MyFRITZ! address. Both work.

Connections without a dedicated IPv4 address (DS-Lite)

With some cable and fiber connections, the connection shares an IPv4 address with other customers ("DS-Lite"). It is then reachable from outside only over IPv6. This works on the go if the mobile network or the third-party Wi-Fi network also supports IPv6, which is common with the major mobile networks. For access over IPv4, ask your provider for a dedicated IPv4 address.

Frequently asked questions

Isn't MyFRITZ! enough?

For access to the Fritz!Box itself, MyFRITZ! is enough. A DynDNS name is worthwhile if you want a name that is easy to remember, use a different router or store the name in devices such as cameras or a mail server.

Is port forwarding insecure?

It opens exactly one service to the outside. That is acceptable if this service is kept up to date and well protected. For access to several devices, a VPN is the more secure way.

Do I need my own server for this?

No. A Fritz!Box, DynDNS and WireGuard are sufficient. A vServer only becomes an option if a service needs to run around the clock independently of your home connection.

See also: Setting up DynDNS on a Fritz!Box Accessing Home Assistant remotely DynDNS hosting

View DynDNS hosting