Why Remote Access Requires Care
Home Assistant is the control center of the entire home. If accessed by an attacker remotely, they can unlock doors, disable cameras, or take control of the whole system. Directly port-forwarding to HA without strong authentication is the most dangerous mistake.
3 Remote Access Methods Ranked by Security
Method 1: Nabu Casa (Easiest, Good Security)
- Cost: $6.50/month or $65/year
- Operates as an encrypted tunnel through Nabu Casa servers
- No port forwarding, no custom domain, no complex configuration
- Automatically supports Google Assistant and Alexa
- Disadvantage: depends on a third-party server — if Nabu Casa discontinues, remote access is lost
Method 2: Tailscale VPN (Free, Highest Security)
- Free for personal use up to 3 devices
- Uses WireGuard Protocol with end-to-end encryption
- Install Tailscale Add-on in HA OS in 15 minutes
- Access HA via Tailscale IP as if on local network
- Advantage: no third-party sees your data — maximum privacy
Method 3: NGINX Reverse Proxy + SSL (Advanced)
- For those wanting a custom domain like home.yourdomain.com
- Requires domain, Cloudflare DNS, and SSL certificate (free via Let Encrypt)
- Complex setup but full control
- Requires opening Port 443 on router and configuring Fail2Ban against brute force
Never Do: Direct Port Forwarding to HA
Forwarding Port 8123 directly from router to HA server is the most common dangerous mistake:
- HA login page exposed directly to the internet
- Shodan.io can easily find exposed HA instances
- Brute force attacks succeed quickly against weak passwords
Multi-Factor Authentication: A Critical Defense Layer
Even when using Nabu Casa or Tailscale, always enable MFA in HA:
- Go to Profile → Multi-factor Authentication
- Select TOTP (Time-based One-Time Password)
- Scan QR code with Google Authenticator or Authy
- Every login from a new device requires a 6-digit time-based code
Quarterly Security Audit
Every 3 months, review:
- Login logs in HA (Settings → System → Logs)
- Revoke any tokens no longer in use
- Update HA and all add-ons to latest versions
- Review entities exposed to Google/Apple/Alexa — expose only what is needed
- Change admin account password every 6 months
Summary: Good Remote Access Balances Convenience and Security
For typical users: Nabu Casa is best — easy, sufficiently secure, and supports voice assistants. For maximum privacy: Tailscale is free and most secure. For advanced users: NGINX + SSL + Fail2Ban offers full control.