The Skill Mill

Home assistant remote access without Nabu Casa is not just possible — for many HA owners it is the better choice. Nabu Casa is a genuinely good product that funds the project, but the community has built several rock-solid free paths to access your instance from outside your home network. This post lays them out as a real comparison, not a gentle nudge toward the subscription.

Before anything else: the reason this matters is local control. Most people who land on HAOS did so precisely because they wanted to stop depending on someone else’s cloud. Reaching for a paid relay service as the only remote-access option would be a funny ending to that journey. It is not the only option.

Four Ways to Access Home Assistant Outside Your Home Network

Each method below solves the same problem — your HA instance sits on a private LAN, and your phone is on a mobile network — but they solve it differently. The right pick depends on how comfortable you are with networking and how much ongoing maintenance you want to accept.

Method	Technical lift	Opens a port to the internet	Cost
Tailscale	Low	No	Free (personal plan)
Cloudflare Tunnel	Medium	No	Free
WireGuard VPN	Medium–High	One UDP port only	Free
DuckDNS + Port Forwarding	Medium	Yes	Free

None of these methods is universally best. A reader who manages servers for fun will set up WireGuard in an afternoon and never look back. A reader who wants “it just works until it doesn’t” with minimal fuss will probably land on Tailscale.

Home Assistant Tailscale Remote Access: The Lowest-Friction Start

Tailscale turns your devices into a private mesh network using WireGuard under the hood, without requiring you to configure WireGuard yourself. You install the Tailscale add-on from the HA add-on store, authenticate with a Tailscale account, and your instance gets a stable private IP that follows it everywhere.

From that point, the Companion app on your phone connects over Tailscale exactly as if you were on your home Wi-Fi. No open ports, no dynamic DNS, no certificate headaches. The personal plan covers a number of devices that is more than enough for a home setup — check Tailscale’s own site for current limits, as they adjust these periodically. For home assistant self hosted remote access that you want working by tonight, this is the realistic first choice.

The one honest caveat: Tailscale’s coordination server is a third-party dependency. The actual traffic is peer-to-peer, but the handshake goes through their infrastructure. For most home users that is an acceptable trade. If it is not acceptable to you, keep reading.

Home Assistant Cloudflare Tunnel Remote Access: Zero Open Ports, Public URL

A Cloudflare Tunnel (formerly Argo Tunnel) runs a lightweight connector on your HA host that opens an outbound connection to Cloudflare’s edge. Cloudflare then routes traffic inbound through that tunnel. Your router never has an open port — the connection is initiated from the inside, not the outside.

The result is a real public HTTPS URL with a valid certificate, which means the Companion app and the web UI work without any certificate warnings. This also means family members who do not have Tailscale installed can reach a dashboard you deliberately expose. That is a meaningful advantage if you want to share a Lovelace view with someone who is not technical.

The setup involves creating a free Cloudflare account, adding your domain (or using a Cloudflare-provided subdomain), installing the cloudflared add-on, and wiring the tunnel to your HA internal address. It is not hard, but it is more steps than Tailscale. There is a dedicated community thread on the HA forums that walks through it if you get stuck — search “Cloudflare Tunnel Home Assistant” and you will find it immediately.

Home Assistant WireGuard VPN Setup and DuckDNS: The Classic Routes

WireGuard VPN is what Tailscale wraps in a friendlier interface. Running it yourself means you own every piece of the stack — no third-party coordination server at all. You open one UDP port on your router, forward it to the WireGuard add-on on your HA host, and generate peer configs for each device that should connect.

The WireGuard add-on in HA makes the server side manageable. The harder part is that your home IP address changes unless your ISP gives you a static one, which most do not. That is where home assistant DuckDNS remote access enters the picture: DuckDNS gives you a free subdomain that updates automatically whenever your home IP changes, so your WireGuard clients always have a stable hostname to connect to.

DuckDNS pairs with the HA DuckDNS add-on, which handles the IP update automatically. You can also combine DuckDNS with the Let’s Encrypt add-on for a valid HTTPS certificate — the add-on documentation covers the combined setup step by step. This is the home assistant port forwarding external access path, and it does open a port to the public internet, so keeping your HA instance patched matters more here than with the tunnel approaches.

For a deeper walkthrough of how all these pieces — integrations, add-ons, YAML, helpers — fit together in one place, the Home Assistant Smart Home for Beginners guide covers the architecture clearly enough that the networking sections in the HA docs start to make sense instead of feeling like a wall of jargon.

If you are still getting comfortable with HA concepts generally, your first Home Assistant automation from start to finish is a good post to read before diving into remote networking. And once remote access is sorted, the backup you have never restored is not a backup is the natural next step — because none of this work matters if the SD card dies and you have no restore point.

For further reading on network security fundamentals relevant to self-hosted setups, CISA (Cybersecurity and Infrastructure Security Agency) publishes practical guidance for home and small-network users. The Home Assistant project’s own documentation lives at home-assistant.io, which is the authoritative source for add-on configuration details that change with every release. For a broader overview of VPN protocols and tunneling technologies, the EFF’s Surveillance Self-Defense guides offer vendor-neutral explanations that apply directly to self-hosted home network setups.

Frequently Asked Questions

Is Nabu Casa worth it even if free options exist?

Absolutely — if you want zero configuration and you want to support the project financially, Nabu Casa is a clean, well-maintained service. The free methods require more initial setup and occasional maintenance. Neither choice is wrong; they serve different priorities.

Which method is safest from a security standpoint?

Tailscale and Cloudflare Tunnel both avoid opening ports to the public internet entirely, which reduces your attack surface compared to port forwarding. WireGuard with DuckDNS opens one UDP port — narrow, but still public-facing. Whatever method you choose, keep HAOS updated and use a strong password or MFA on your account.

Will my ISP block any of these approaches?

Some ISPs on CGNAT (carrier-grade NAT) make traditional port forwarding impossible because you do not have a real public IP. Tailscale and Cloudflare Tunnel both work fine on CGNAT because they use outbound connections. If port forwarding does not work on your connection, one of those two is the practical answer.

Do I need a domain name for Tailscale or Cloudflare Tunnel?

Tailscale does not require a domain — it assigns stable internal addresses automatically. Cloudflare Tunnel can work with a Cloudflare-provided subdomain at no cost, so a purchased domain is optional there too. DuckDNS gives you a free subdomain, so none of these paths require paying for a domain.

Can the Home Assistant Companion app work with all four methods?

Yes. The Companion app connects to whatever URL or IP you give it. For Tailscale you use the Tailscale IP; for Cloudflare Tunnel you use your public HTTPS URL; for WireGuard or DuckDNS you use the DuckDNS hostname. The app handles the connection the same way regardless of which method gets the traffic to your instance.

What if remote access stops working after a router reboot?

This is the classic “it just works until it doesn’t” moment. Port-forwarding rules sometimes lose their static IP assignment if DHCP reassigns your HA host’s local address. Fix it by setting a DHCP reservation for your HA host’s MAC address in your router — that pins the local IP permanently and port-forward rules stay valid across reboots.

Which of these four paths fits your setup best depends on your router, your ISP, and honestly how much an evening of networking sounds like fun versus frustration. Drop a comment below and describe your situation — CGNAT, rented router, ISP that blocks ports — and the community here can help you narrow it down.

{“@context”:”https://schema.org”,”@type”:”BlogPosting”,”headline”:”Home Assistant Remote Access Without Nabu Casa: Free Methods Compared”,”description”:”Set up home assistant remote access without Nabu Casa — Tailscale, Cloudflare Tunnel, DuckDNS, and WireGuard compared honestly so you can pick the right fit.”,”keywords”:[“home assistant remote access free”,”access home assistant outside home network”,”home assistant VPN remote access setup”,”home assistant Cloudflare tunnel remote access”,”home assistant Nabu Casa alternative”,”home assistant DuckDNS remote access”,”home assistant self hosted remote access”,”home assistant port forwarding external access”,”home assistant Tailscale remote access”,”home assistant WireGuard VPN setup”],”datePublished”:”2026-08-25T12:24:01.946Z”,”dateModified”:”2026-08-25T12:24:01.946Z”,”author”:{“@type”:”Organization”,”name”:”The Skill Mill”},”mainEntityOfPage”:”https://blog.theskillmillbooks.com/home-assistant-remote-access-without-paying-for-nabu-casa/?utm_source=skillmillblog&utm_medium=blog&utm_campaign=home-assistant-smart-home&utm_content=home-assistant-remote-access-without-paying-for-nabu-casa”}

Tools that help: our Vault & Press spreadsheet · MineStock Pro.