Affiliate disclosure: As an Amazon Associate, HomeNode earns from qualifying purchases at no additional cost to you. Product availability subject to change.
Port forwarding Home Assistant directly to the internet works, but it also puts a home automation server with control over locks and cameras directly in the path of internet scanners. Three genuinely better options exist, and each fits a different comfort level with self-hosting.
Nabu Casa: pay for it and stop thinking about it
Home Assistant’s official cloud service handles remote access, SSL certificates, and Google/Alexa integration for a flat monthly fee, with traffic routed through Nabu Casa’s infrastructure rather than exposing your home IP directly. For most non-technical households, this is the correct answer — it also directly funds Home Assistant’s open-source development.
Tailscale: free, fast, and genuinely simple to set up
Tailscale creates a private mesh VPN between your devices using WireGuard under the hood, and installing it on your Home Assistant server plus your phone gives you access that looks and feels local no matter where you actually are. No port forwarding, no public-facing attack surface, and the free tier covers a typical household’s device count without issue.
Self-hosted WireGuard: more setup, full control
Running your own WireGuard server, either on your router or a small dedicated device, gives you the same private-tunnel benefit as Tailscale without depending on a third-party coordination server. It takes real configuration work to get right, and firmware or router compatibility varies, but it’s the option with the fewest moving parts you don’t personally control.
- 【DUAL BAND AX TRAVEL ROUTER】Products with US, UK, EU Plug; Dual band network with wireless speed 574Mbps (2.4G)+2402Mbps (5G);…
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription re…
- 【OpenWrt 21.02 FIRMWARE】The Beryl AX is a portable wifi box and mini router that runs on OpenWrt 21.02 firmware. It supports mo…
What to actually avoid
Skip plain port forwarding with no VPN layer in front of it, and be cautious of any “remote access” browser extension or third-party relay service that asks for your Home Assistant credentials directly. If a service can see your login, it can be the weak link that gets your whole smart home compromised, not just inconvenienced.
- Raspberry Pi 5 with 8GB RAM: Model SC1112 featuring a quad-core ARM Cortex-A76 processor running at 2.4GHz. Enhanced Connectivi…
Nabu Casa is the right call if you want zero maintenance and don’t mind the subscription. Tailscale is the right call if you’re comfortable installing one more app and want it free. Self-hosted WireGuard is for the household that already runs its own router firmware and wants nothing routed through anyone else’s servers.