The Skill Mill

Home Assistant remote access without Nabu Casa is one of the most searched topics in the HA community — and one of the most poorly served. Most articles either quietly nudge you toward the subscription or bury the free alternatives in a wall of caveats. This post does neither. Below are five methods for home assistant remote access without nabu casa that actually work, compared honestly so you can pick the one that fits your setup and your skill level.

Quick framing before we dive in: Nabu Casa is not a bad product. It funds the Home Assistant project and genuinely makes remote access effortless. But it is a subscription, and paying for remote access is not required. The HA community figured that out a long time ago.

Why Remote Access Is Trickier Than It Looks

Your HA instance lives on a local network — a Raspberry Pi or mini PC sitting behind your router. That router almost certainly uses a dynamic IP address, meaning your internet provider can change it at any time. It also sits behind NAT (network address translation), which means the outside world cannot simply knock on the door and get in.

Every method below solves those two problems differently. Some punch a tunnel outward so you never expose a port. Others use dynamic DNS to track your changing IP. Some route all traffic through a third-party server; others keep everything peer-to-peer. The tradeoffs are real, and they are worth understanding before you pick one.

5 Methods for Home Assistant External Access, Compared

Method	Difficulty	Port Forwarding Required	Data Routes Through Third Party	Cost
Tailscale	Beginner	No	Minimal (coordination only)	Free tier available
Cloudflare Tunnel	Beginner–Intermediate	No	Yes (Cloudflare edge)	Free
DuckDNS + Let’s Encrypt	Intermediate	Yes	No	Free
Nginx Reverse Proxy	Intermediate–Advanced	Yes	No	Free
WireGuard VPN	Advanced	Yes (one port)	No	Free

The Two Easiest Starting Points: Tailscale and Cloudflare Tunnel

Tailscale is where most beginners in the HA community land first, and for good reason. You install the Tailscale add-on from the HAOS add-on store, log in with a Google or GitHub account, and your HA instance appears on a private mesh network alongside your phone or laptop — no port forwarding, no dynamic DNS headaches. Traffic travels peer-to-peer wherever possible, meaning your data is not sitting on someone else’s server.

The free tier covers personal use comfortably for most home setups. The main limitation is that every device you want to reach HA from also needs Tailscale installed. For a household where you control all the devices, that is barely an inconvenience. For sharing access with family members who are less technical, it adds a setup step.

A Cloudflare Tunnel (previously called Argo Tunnel) solves the sharing problem elegantly. Once configured, your HA dashboard is reachable via a regular HTTPS URL — any browser, any device, no client software required. The Cloudflare add-on for HAOS handles most of the configuration. The tradeoff is that your traffic does route through Cloudflare’s edge network. For most home automation use cases that is acceptable; for anyone who wants their smart home data to stay entirely off third-party infrastructure, it is worth noting.

If you want a step-by-step walkthrough of either method alongside the broader context of setting up HAOS from scratch, the Home Assistant Smart Home for Beginners guide covers both in the remote access chapter, including the YAML entries you need and the add-on settings that trip people up.

Going Deeper: DuckDNS, Nginx, and WireGuard for Full Local Control

If local control is a core value for you — and in this community, it often is — the three remaining methods keep your traffic entirely on infrastructure you control.

DuckDNS is a free dynamic DNS service. It gives your home a stable hostname (something like yourhome.duckdns.org) that automatically updates whenever your ISP changes your IP. Paired with a Let’s Encrypt SSL certificate (which the DuckDNS add-on can request automatically), you get a properly secured HTTPS connection. The catch: you must open a port on your router, which is a real attack surface if not handled carefully. Use a non-standard port, keep HA updated, and enable two-factor authentication on your HA account before you expose anything to the internet.

An Nginx reverse proxy sits in front of HA and handles the HTTPS termination, letting you run multiple services on one IP without opening multiple ports. It is the right choice if you are already running other self-hosted services and want everything behind one front door. The configuration lives in YAML (naturally), and getting the proxy_pass and header settings right takes some patience — but it is a satisfying setup once it clicks.

WireGuard VPN is the gold standard for people who want remote access that is functionally identical to being on the local network. You open a single UDP port on your router, configure a WireGuard server (there is a well-regarded add-on for HAOS), generate client keys, and your phone or laptop tunnels directly into your home network. Every entity, every integration, every local-only feature behaves exactly as it does when you are sitting at home. The setup is more involved than Tailscale, but the result is completely self-hosted with no third-party involvement.

For a broader look at how these remote access decisions fit into the larger architecture of a well-built HA setup, see our post on Home Assistant vs SmartThings vs Hubitat, judged on local control — it puts the whole cloud-vs-local debate in context.

Which Method Should You Actually Choose

The honest answer depends on two things: how much time you want to spend on setup, and how strongly you feel about keeping your data off third-party networks.

If you want something working in under an hour and you are new to HAOS, start with Tailscale. If you need family members to access HA without installing anything on their devices, Cloudflare Tunnel is the next best step. If local control is non-negotiable and you are comfortable with a longer setup session, WireGuard is the destination most experienced HA users eventually reach.

None of these require a subscription. All of them are actively used and discussed in the HA community. And all of them are, in the honest community spirit, examples of things that “just work until they don’t” — so document your configuration, and keep a backup. Speaking of which, if you have never tested restoring your HA backup, that is a separate problem worth fixing: see our post on the Home Assistant backup you have never restored.

For further reading on home network security practices relevant to any of the port-forwarding methods above, the resources at CISA.gov and NIST.gov are solid general references on securing internet-connected devices at home.

If you are setting up HA for the first time and want a structured path through hardware, integrations, add-ons, and remote access in one place, the Home Assistant Smart Home for Beginners guide from The Skill Mill is written exactly for that stage — practical, honest about the rough edges, and structured so you build a working system rather than a collection of half-finished experiments.

Frequently Asked Questions

Is Tailscale really free for personal Home Assistant use?
Tailscale offers a free tier that covers personal use with a reasonable number of devices. Check their current pricing page directly, as tiers and limits can change — but for a single home HA setup, most users comfortably stay within the free plan.

Does using a Cloudflare Tunnel mean Cloudflare can see my smart home data?
Yes, in the sense that your traffic routes through Cloudflare’s edge infrastructure. For most home automation data — light states, thermostat readings, motion triggers — this is a tradeoff many users accept. If you have privacy concerns about that, WireGuard or Tailscale are better fits.

Do I need a static IP address from my ISP to use any of these methods?
Not for Tailscale or Cloudflare Tunnel — they handle the dynamic IP problem for you. For DuckDNS, Nginx, or WireGuard, you need DuckDNS or a similar dynamic DNS service to track your changing IP automatically.

Is it safe to open a port on my router for HA remote access?
It introduces real risk if not done carefully. Use a non-standard port, enable two-factor authentication on your HA account, keep HAOS updated, and use HTTPS with a valid certificate. Many experienced users prefer tunnel-based methods precisely because they avoid open ports entirely.

Which of these methods are you running, or planning to try — and what stopped you from getting remote access set up sooner? Drop your experience in the comments.

{“@context”:”https://schema.org”,”@type”:”BlogPosting”,”headline”:”5 Ways to Get Home Assistant Remote Access Without Nabu Casa”,”description”:”Skip the subscription. Here are 5 proven methods for Home Assistant remote access without Nabu Casa — from Tailscale to Cloudflare Tunnel, compared honestly.”,”keywords”:[“home assistant remote access free setup”,”home assistant VPN remote connection guide”,”home assistant Cloudflare tunnel configuration”,”home assistant external access without subscription”,”home assistant Tailscale remote setup tutorial”,”home assistant Nginx reverse proxy remote access”,”home assistant DuckDNS dynamic DNS configuration”,”home assistant self-hosted remote connection methods”,”home assistant WireGuard VPN setup guide”,”home assistant secure remote access alternatives”],”datePublished”:”2026-08-24T17:47:06.556Z”,”dateModified”:”2026-08-24T17:47:06.556Z”,”author”:{“@type”:”Organization”,”name”:”The Skill Mill”},”mainEntityOfPage”:”https://blog.theskillmillbooks.com/5-ways-to-get-home-assistant-remote-access-without-paying-fo/?utm_source=skillmillblog&utm_medium=blog&utm_campaign=home-assistant-smart-home&utm_content=5-ways-to-get-home-assistant-remote-access-without-paying-fo”}

Tools that help: our Vault & Press spreadsheet · MineStock Pro.