Skip to content
glowfish
+49 89 55063107 Customer portal

Home · Help · Accessing Home Assistant remotely

Accessing Home Assistant remotely

Home Assistant runs in your home network and is initially reachable only there. For access on the go, for example with the Companion app on your smartphone, there are three options: Home Assistant Cloud, a VPN into your home network or port forwarding with DynDNS and encryption.

The three options compared

Option Advantage Disadvantage
Home Assistant Cloud (Nabu Casa) No port forwarding and no address of your own needed, also works with DS-Lite Paid subscription, access runs through the provider's servers
VPN with WireGuard No service exposed to the internet, the entire home network is reachable The VPN must be enabled on the smartphone
Port forwarding with DynDNS Direct access via a fixed name, no VPN app needed Home Assistant is exposed to the internet, encryption and updates are mandatory

Option 1: VPN with WireGuard

With a Fritz!Box running FRITZ!OS 7.50 or later, this is the simplest secure option. The Fritz!Box is the VPN endpoint, and Home Assistant itself remains unchanged.

  1. Set up a fixed name for your connection, with DynDNS or MyFRITZ!.
  2. In the Fritz!Box, create a WireGuard connection for the smartphone as described in Remote access to your Fritz!Box.
  3. In the Companion app, enter the internal address of Home Assistant, for example http://192.168.178.20:8123.
  4. When you are on the go, switch on the VPN in the WireGuard app. Home Assistant is then reachable as if you were at home.

Option 2: Port forwarding with DynDNS and encryption

With this option, Home Assistant is directly reachable from the internet. Never forward port 8123 unencrypted. You need a certificate for your name and a forwarding rule only for the encrypted access.

  1. Set up a fixed name, for example zuhause.dynipdns.de with DynDNS hosting.
  2. Obtain a certificate for this name, for example with the Let's Encrypt add-on or a reverse proxy in front of Home Assistant.
  3. In the Fritz!Box, create a port sharing rule for Home Assistant under Internet, Permit Access, Port Sharing that forwards external port 443 to the encrypted internal port of Home Assistant.
  4. In Home Assistant, go to Settings, System, Network and enter your name with https:// as the Internet URL.
  5. Enable two-factor authentication in your profile and keep Home Assistant up to date.
Connections without a dedicated IPv4 address: With DS-Lite, port forwarding is not possible over IPv4, only over IPv6. In that case, the VPN over IPv6 or Home Assistant Cloud are the more reliable options.

Option 3: Home Assistant Cloud

The subscription from Nabu Casa, the company behind Home Assistant, provides remote access through its own servers. It works without port forwarding and without a fixed name, and it helps fund the development of Home Assistant. You set it up under Settings, Home Assistant Cloud.

Frequently asked questions

Which option is the most secure?
The VPN. No service is exposed to the internet, and access is only possible with the key on the smartphone.
Do notifications also work without remote access?
Yes. Push notifications from the Companion app are delivered through services from Apple and Google. For control and live view on the go, you need one of the three options.
Do I need a fixed name for the VPN?
Yes, the smartphone has to find the Fritz!Box. MyFRITZ! is sufficient for this. A DynDNS name is easier to remember and also works with other routers.

See also: Accessing a Fritz!Box remotely Setting up DynDNS on a Fritz!Box DynDNS hosting

View DynDNS hosting