Remote Access
“I give myself very good advice, but I very seldom follow it.” ~ Alice

Remote access to Home Assistant is required if you would like the Google Home integration to "see" devices that HA controls. It is of course also required if you need to see what's going on at home while you're away. You would also need a Dynamic DNS client to know the current internet address of your home network (unless you use Cloudflare Tunnels).

While the most common method of remote access is opening ports in your firewall, it is also the most dangerous. For your security, there are only two rules:

Do not open ports in your firewall
Do not open ports in your firewall

So how the hell do I access my Home Assistant instance remotely?

Introducing Cloudflare Tunnels. Cloudflare offers a free service that creates an encrypted "tunnel" from the Internet to Home Assistant (or any other application on your network).

Cloudflare requires that you own an internet domain name that you can access and point the domain's DNS servers to servers owned by Cloudflare. Cloudflare sells domain names at cost and if you buy from them, they will automatically configure the DNS server addresses for you. I chose to keep my tunnels in a separate, obscure .ORG domain rather than using this primary domain. The .ORG domains are cost-effective at around $10 per year.

Cloudflare needs a cloudflared service (cloudflared = Cloudflare Daemon) running on your home network. It is open source and free. cloudflared can run as an integration on the Home Assistant machine if that's the only machine you have that runs 24/7. I run my daemon in a Docker container on my NAS which also runs 24/7. You have the option to run the service on these platforms:

Cloudflared "phones home" to Cloudflare and is used to establish the tunnel between Cloudflare and your home network. It does not matter what IP address your router receives from your ISP therefore you do not need a Dynamic DNS service.

Here is one tip I can give you. When you create the "Application Routes" on Cloudflare (one tunnel, as many routes as necessary), you point the application route to a sub-domain. For example, to Home Assistant the name might be HA-3462764.yourdomain.org and to your NAS it could be NAS-8375194.yourdomain.org. If you point the route directly to yourdomain.org, you will end up with many "Attempted Login" alerts in your logs from bots and hackers. This stops automated bots scanning for common names (like ha.yourdomain.com), it is not a replacement for strong authentication (like MFA), as DNS records can sometimes be discovered through other means. These sub-domain names are created inside Cloudflare and are just DNS names that Cloudflare provides to the internet. Think of them as "virtual" sub-domains. Share your sub-domain names with friends and family if you want, but do not publish them on the Internet. If a sub-domain is compromised, you can change it at will and the new names can be resolved a few minutes later. This is called "security through obscurity" and provides another barrier to bots and hackers.

If you're really brave and decide to host a web server on your home network, Cloudflare provides the certificate so your users connect to https://yourdomain.org instead of the scary http://yourdomain.org . As a matter of fact, any web based application that runs on your home network (Plex, Jellyfin, NAS management, etc.) will have a valid certificate when accessed through a tunnel.

Follow this tutorial and you'll be up and running quickly: Cloudflare Tunnel Easy Setup

Step-by-Step Connection Flow:

Tunnel Creation
The cloudflared daemon on your Home Assistant server wakes up and initiates an encrypted outbound HTTPS/QUIC connection to the nearest Cloudflare data center.
Firewall Negotiation
Because the connection starts inside your network, your router's firewall automatically allows it. No ports (like 8123 or 443) need to be forwarded or opened to the public.
Public Routing
With Cloudflare, assign a public hostname (e.g., ha.yourdomain.com) to the Home Assistant Application Route. When you type this URL, your request hits Cloudflare's edge first, not your home IP.
Traffic Delivery
Cloudflare verifies the request (checking SSL and Cloudflare's Zero Trust policies) and then pushes the data down the established tunnel to your Home Assistant instance.

“Never let anyone drive you crazy; it is nearby anyway and the walk is good for you.” ~ Cheshire Cat

Remote Access“I give myself very good advice, but I very seldom follow it.” ~ Alice

Step-by-Step Connection Flow:

Remote Access
“I give myself very good advice, but I very seldom follow it.” ~ Alice