The safest way to reach Home Assistant from outside your home is to use Home Assistant Cloud, a VPN, or a correctly configured HTTPS reverse proxy. Do not simply forward an unencrypted Home Assistant port to the internet. For a self-hosted HTTPS endpoint, DuckDNS supplies a hostname, Let’s Encrypt supplies the certificate, and an NGINX proxy terminates HTTPS before forwarding traffic internally. If you prefer Home Assistant itself to handle encryption, configure its HTTP integration with the certificate and key paths instead.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What HTTPS changes in a Home Assistant setup
HTTPS encrypts the connection between the remote browser or Companion app and the endpoint that accepts the connection. It is not the same thing as opening a router port. A forwarded port only creates a path into your home network; the path must still be protected with HTTPS, a VPN, or a managed encrypted tunnel.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Home Assistant remote access is therefore an architecture decision. You can let Home Assistant Cloud provide the encrypted endpoint, keep Home Assistant private behind a VPN or SSH tunnel, place an NGINX reverse proxy at the internet-facing edge, or make Home Assistant serve TLS directly. Each approach has different setup work, exposure, certificate handling, and behavior when your ISP uses carrier-grade NAT (CG-NAT).
Choose the right HTTPS pattern
| Pattern | Setup effort | Router port exposure | Certificate and proxy work | CG-NAT compatibility |
|---|---|---|---|---|
| Home Assistant Cloud | Lowest; enable remote access in the Home Assistant interface | No inbound router port is required | Managed for you; no reverse proxy or certificate files to maintain | Works because it does not depend on inbound forwarding |
| DuckDNS + Let’s Encrypt + NGINX | Moderate; domain, certificate app, proxy app, YAML, and router configuration | Normally forward external TCP 443 to the NGINX proxy | You configure the proxy and certificate file names; the DuckDNS app writes the certificate files | Usually fails when the ISP blocks inbound connections with CG-NAT |
| Direct TLS in Home Assistant | Moderate; install certificate files and edit the HTTP integration | Forward the HTTPS port to Home Assistant itself, if remote access is needed | Home Assistant terminates TLS; you must avoid conflicts with other HTTP or proxy settings | Usually fails when inbound forwarding is unavailable |
| VPN or SSH tunnel | Varies with the VPN or tunnel you choose | No Home Assistant web port needs to be publicly exposed | The private connection is the security boundary; no public reverse proxy is required | Use a design that can establish an outbound connection when CG-NAT prevents inbound access |
For most households, Cloud is the shortest route to working remote access. Choose the DuckDNS and NGINX design when you specifically want a self-hosted public hostname and control over the proxy. Choose direct TLS when Home Assistant itself should listen for HTTPS and there is no separate proxy architecture. Choose a VPN or tunnel when Home Assistant should remain private rather than reachable as a public web service.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Option 1: Home Assistant Cloud
Home Assistant’s remote-access documentation describes Cloud as remote access that requires neither router port forwarding nor certificate setup. A single setting in the Home Assistant interface generates an encrypted remote URL.
Enable the remote URL
- Open Home Assistant and go to the Cloud or remote-access area in Settings.
- Enable remote access.
- Wait for Home Assistant to display the generated encrypted URL.
- Open that URL from a device outside your home network, such as a phone using cellular data.
- Use the same external URL in the Companion app when configuring its external connection.
This route removes the most common self-hosting failure points: no inbound 443 rule, no public DNS record to maintain, no certificate path in YAML, and no reverse-proxy trust range. It is also the practical fallback when your ISP uses CG-NAT.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Option 2: DuckDNS, Let’s Encrypt, and NGINX
This is the standard self-hosted HTTPS arrangement. DuckDNS gives you a hostname under duckdns.org and points it at your current public IP. The DuckDNS app obtains a trusted Let’s Encrypt certificate and writes the certificate files into Home Assistant’s /ssl directory. NGINX accepts HTTPS traffic, presents the certificate, and forwards the request to Home Assistant on the internal network.
Before you start
- You need a DuckDNS account, a subdomain, and its token.
- Your router must have a reachable public address. Confirm this before spending time on port-forwarding rules; CG-NAT can make inbound forwarding impossible.
- Home Assistant must be able to install and run the DuckDNS and NGINX apps.
- You need access to
configuration.yamland permission to restart Home Assistant after changing it. - Choose the public hostname you will use consistently, such as
your-domain.duckdns.org.
1. Register the hostname
- Create a DuckDNS subdomain.
- Point the subdomain at the router’s public IP address.
- Keep the DuckDNS token available; the Home Assistant app uses it to update the hostname and request the certificate.
If your public IP changes, the dynamic-DNS app must update the hostname. Test the hostname from outside your LAN rather than assuming that a local DNS lookup proves the public route works.
Rank #2
- Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM)
- Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
- CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
- CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply (US Plug) with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K60p)
- CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)
2. Install and configure the DuckDNS app
- In Home Assistant, open the app store under Settings. The exact menu label can vary by Home Assistant release.
- Install the DuckDNS app.
- Enter the DuckDNS domain and token.
- Accept the Let’s Encrypt terms in the app configuration.
- Start the app and inspect its log for certificate-issuance errors.
A successful setup normally creates /ssl/fullchain.pem and /ssl/privkey.pem. Use those exact file names when configuring the proxy unless your app configuration deliberately uses different names.
3. Install the NGINX Home Assistant SSL proxy
- From the same Home Assistant app store, install NGINX Home Assistant SSL proxy.
- Open its configuration panel.
- Set
domainto your fully qualified hostname, for exampleyour-domain.duckdns.org. - Set
certfiletofullchain.pem. - Set
keyfiletoprivkey.pem. - Save the configuration and start the app.
The proxy needs to be able to read the files created in /ssl. If the app log reports that a certificate or key cannot be found, check the file names and wait until the DuckDNS app has completed certificate startup before starting NGINX.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches4. Trust the proxy in Home Assistant
When a reverse proxy forwards a request, Home Assistant must be told which intermediary is allowed to provide forwarding headers. Add this block to configuration.yaml and replace the example network with the proxy’s actual address or CIDR:
http:
use_x_forwarded_for: true
trusted_proxies:
- 172.30.33.0/24use_x_forwarded_for enables Home Assistant to use the client information supplied by the proxy. trusted_proxies limits that behavior to the proxy network. Do not copy the example range blindly: an incorrect or unnecessarily broad range can allow an untrusted client to spoof forwarding headers. After saving the file, restart Home Assistant and check the configuration result.
Rank #3
- Pi5 8GB Pack: RasTech Pi 5 8GB kit includes 1 x Pi5 8GB board ,1 x 64GB Card, 2 x Card Readers,1 x Active Cooler,1 x Case for Pi5, 2 x 4K Micro HD Out Cable,1 x GaN 27W 5A USB-C Power supply,1 x Screwdriver and 1 x instructions.
- Pi5 8GB Board: The Pi5 board is equipped with a 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz and an 800MHz VideoCore VII GPU with support for OpenGL ES 3.1 and Vulkan 1.2, which delivers a significant increase in graphics performance. Dual HD Out 4Kp60 display outputs and a built-in dual 4-channel MIPI camera/display transceiver provide state-of-the-art camera support. The Pi 5 offers a 2-3 times increase in CPU performance compare to Pi4.
- Important Graphics Features: Equipped with an 800MHz VideoCore VII GPU and providing better graphics performance, suitable for multimedia applications,gaming,and graphics intensive tasks.Provides 1 UART interface,1 card slot that supports high-speed operation, 2 USB. 3 0.5 ports that support synchronous 0Gbps operation,2 USB 2.0 port ports,2 4Kp60 display outputs that support HDR.Built-in dedicated dual 4-channel 1Gbps MIPI DSI/CSI connectors,triple the total bandwidth.
- Cooling Kit for Pi 5: Compatible with Active Cooler for Raspberry Pi5, It can provide Pi 5 board with better cooling effect in using. The Case can accurately access usb-c power jack,Micro HD Out ports, usb ports, Ethernet jack, card slot, power button, 4-lane MIPI DSI/CSI connectors and so on, and it also supports installation of cooling fan.
- 64GB Card Kit and GaN 27W USB-C Power Supply: With extra 64GB card to store more files and card readers for multiple medium, keep better performance for Raspberry Pi 5, 27W USB C Power Supply is Compatible with Pi5 8GB, offers a variety of output voltage options, including 5.1V at 5A, 9.0V at 3.0A, 12.0V at 2.25A, and 15.0V at 1.8A, providing for different device requirements.
5. Forward only the HTTPS edge port
- Open the router’s port-forwarding page.
- Forward external TCP port 443 to the NGINX proxy, not directly to an unencrypted Home Assistant listener.
- Use the proxy’s internal address and the internal HTTPS port expected by the NGINX app.
- Verify Home Assistant’s current internal port under Settings > System > Network. The common default is 8123, but do not assume it has not been changed.
The public connection should terminate at NGINX. Sending the public port straight to a plain HTTP Home Assistant port defeats the purpose of the certificate and can also bypass the proxy trust design.
6. Start, observe, and set the external URL
- Start the NGINX app.
- Read its log until certificate and proxy startup complete.
- In Home Assistant, open Settings > System > Network.
- Enter
https://your-domain.duckdns.orgin the Internet or external URL field and save. - Test from outside the home LAN. A phone on cellular data is a simple test; testing only from inside the LAN can hide router loopback or DNS problems.
Once the endpoint works, update the Companion app’s external URL as well. A changed hostname, scheme, or port in Home Assistant does not automatically correct an old value stored in the app.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Option 3: Direct TLS in Home Assistant
With direct TLS, Home Assistant itself listens for HTTPS and uses the certificate and private key. The HTTP integration accepts absolute paths, so a minimal configuration is:
http:
ssl_certificate: /ssl/fullchain.pem
ssl_key: /ssl/privkey.pemWhen direct TLS is appropriate
- Use it when Home Assistant should be the TLS endpoint rather than a reverse proxy.
- Make sure the certificate and key exist at the specified absolute paths.
- Forward the HTTPS port to Home Assistant only if you have deliberately chosen direct public access.
- Do not combine direct-TLS settings with incompatible proxy port or certificate settings.
A missing certificate, invalid path, or occupied port can prevent the new configuration from starting. Home Assistant’s HTTP behavior can fall back to the last known-good configuration in that situation, so inspect the startup log and correct the underlying error before trying repeated restarts.
Rank #4
- Complete Official Raspberry Pi 5 Kit: Includes the latest Raspberry Pi 5 board, official Raspberry Pi case with active cooling, official 27W USB-C power supply, and a 128GB microSD card preloaded with Raspberry Pi OS. Everything you need to start building right out of the box.
- Ready to Use in Minutes: Skip the complicated setup. The included 128GB microSD card comes pre-installed with Raspberry Pi OS, allowing beginners, students, developers, and makers to power on and start creating immediately.
- Official Cooling for Maximum Performance: The official Raspberry Pi 5 case features an integrated active cooling fan, helping maintain stable performance during AI projects, Home Assistant, Docker, media servers, programming, robotics, and other demanding applications.
- Official 27W USB-C Power Supply Included: Designed specifically for Raspberry Pi 5, the official PD power supply delivers reliable power for SSDs, AI accelerators, cameras, USB peripherals, and other expansion devices while ensuring stable system performance.
- Built by Seeed Studio, Trusted by Makers Worldwide: Every component is carefully selected and fully optimized for Raspberry Pi 5. Backed by Seeed Studio’s 1-year warranty, professional technical support, and reliable customer service for a worry-free building experience.
Direct TLS versus NGINX
Direct TLS has fewer moving parts: there is no separate proxy to configure and no proxy network to trust. NGINX provides a separate edge layer, which is useful when you want the proxy to terminate HTTPS and forward internally. Pick one termination point for a given design; mixing both without a deliberate port plan commonly causes bind errors, certificate confusion, or incorrect forwarding headers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Option 4: VPN or SSH tunnel
A VPN or SSH tunnel keeps Home Assistant off the public web. You establish the private connection first, then access Home Assistant through its internal address as though you were connected to the home network.
Use a VPN when privacy is the priority
- No Home Assistant web port has to be exposed publicly.
- The remote device must connect to the VPN before opening Home Assistant.
- The VPN design must account for your ISP’s connectivity model; an outbound-capable design is important when CG-NAT blocks unsolicited inbound connections.
Use an SSH tunnel for controlled, temporary access
An SSH tunnel forwards a local port through an authenticated SSH connection to the home network. It is useful for an administrator who needs occasional access, but it is less convenient for an always-on Companion app because the tunnel must remain established. Keep the tunnel’s SSH authentication and account permissions separate from Home Assistant’s web login.
Why port forwarding fails under CG-NAT
With CG-NAT, the address shown by the router may not be a uniquely reachable public address. The ISP shares a public address among customers and does not deliver unsolicited inbound traffic to your router. In that situation, a correct-looking 443 rule can still receive no connection.
Signs that CG-NAT is involved
- The router’s WAN address differs from the public address reported by an external IP-check service.
- Port-forwarding rules appear correct, but an outside test cannot connect.
- Your ISP confirms that inbound ports are unavailable or that your connection is behind carrier-grade NAT.
What to do instead
Do not keep changing internal port numbers when the ISP is blocking the inbound path. Use Home Assistant Cloud, or use a VPN/tunnel architecture that can establish connectivity without requiring an unsolicited inbound connection. If your ISP offers a public address option, that is a separate service decision outside Home Assistant’s configuration.
Security checklist before exposing remote access
- Encrypt the path: use HTTPS, a VPN, or an encrypted cloud tunnel. An open router port by itself is not a security measure.
- Enable multi-factor authentication: turn it on for Home Assistant accounts wherever the account supports it.
- Limit administrator access: give administrator privileges only to accounts that need them.
- Scope proxy trust narrowly: list only the NGINX proxy’s correct IP or CIDR in
trusted_proxies. - Confirm the public endpoint: test from outside the home LAN and verify that the certificate matches the hostname you entered.
- Check CG-NAT first: establish that inbound connectivity is possible before troubleshooting router rules.
- Keep client settings aligned: update the Companion app’s external URL after changing the Home Assistant URL, scheme, or port.
Troubleshooting by symptom
| Symptom | Likely area | Check |
|---|---|---|
| The hostname does not resolve to your home connection | DuckDNS update or domain configuration | Check the DuckDNS app token, domain spelling, app log, and current public IP. |
| Certificate files are missing | DuckDNS/Let’s Encrypt startup | Confirm that terms were accepted, the domain is correct, and the app completed issuance before starting NGINX. |
| NGINX starts with a certificate or key error | Proxy file names or paths | Use fullchain.pem and privkey.pem when those are the files in /ssl; check the NGINX log. |
| Home Assistant rejects requests from the proxy | Proxy trust configuration | Enable use_x_forwarded_for and replace the example CIDR with the proxy’s actual address range. |
| The router rule works internally but not from outside | External testing, CG-NAT, or ISP filtering | Test on cellular data, verify the external port is 443, and determine whether the ISP uses CG-NAT. |
| Home Assistant fails after enabling direct TLS | Certificate path, key, or port conflict | Check the absolute paths, inspect the startup log, and remove conflicting proxy or port settings. |
| The web browser works but the Companion app does not | Stale external URL in the app | Replace the app’s external URL with the current HTTPS hostname and port. |
A practical decision sequence
- Check the ISP first. If CG-NAT prevents inbound traffic, skip port-forwarding designs and choose Cloud or an appropriate VPN/tunnel.
- Decide whether Home Assistant should be public. If not, use a VPN or SSH tunnel. If yes, continue with Cloud or a self-hosted HTTPS endpoint.
- Choose the maintenance level. Cloud minimizes certificate and router work; DuckDNS plus NGINX gives self-hosted control; direct TLS removes the proxy layer but places TLS configuration in Home Assistant.
- Configure one TLS termination architecture. Do not mix direct TLS and reverse-proxy settings without a specific port and trust plan.
- Set and test the external URL. Save it under Settings > System > Network, test from outside the LAN, then update the Companion app.
Home Assistant’s securing guidance summarizes the goal: “If you want to reach Home Assistant from outside your home network, set up a secure method for remote access rather than exposing it directly to the internet.” The remote-access guidance describes Cloud as access “without opening any ports on your router and without exposing your home network to the internet.” Those principles apply regardless of which architecture you select: provide encryption, keep trust boundaries narrow, and verify the route from a genuinely external network.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
