Guide

Home Assistant Remote Access Behind CGNAT

For most people the right answer is Home Assistant Cloud at about $6.50 a month. It is cheaper than what we sell, it works through carrier-grade NAT without any configuration, it brings Alexa and Google Assistant and the Assist voice engines with it, and the money funds the project you are already running for free. If your only problem is reaching your dashboard from outside, stop here and buy that. The rest of this page is for the cases it does not cover: a self-hosted setup you want on your own address, webhooks on ports it does not carry, or an integration that needs to reach your instance directly.

First, is CGNAT actually your problem?

Run this on the machine Home Assistant is on, or any machine on the same network:

curl -s https://api.ipify.org; echo

Compare it with the WAN address your router shows. If they differ and the router's address falls between 100.64.0.0 and 100.127.255.255, that is the range reserved for carrier-grade NAT and no port forward on your own router can work. The Raspberry Pi guide covers the check in more depth, and most Home Assistant boxes are a Pi.

Option 1: Home Assistant Cloud

The official remote access, run by Nabu Casa, who employ the core Home Assistant developers.

Roughly $6.50 a month or $65 a year depending on region and billing period. Your instance dials out, so CGNAT is irrelevant and there is nothing to configure. It also carries the things that are genuinely hard to self-host: Alexa and Google Assistant integration, the text-to-speech and speech-to-text engines behind Assist, cloud backups, and webhook delivery.

We sell a public IP for $10. For a Home Assistant user who wants remote access, Cloud is cheaper, less work, and comes with voice. I would rather say that than sell you something worse.

Option 2: Tailscale, if it is only you

Free at the scale a household needs, works through CGNAT, exposes nothing to the internet. Install it on the Home Assistant host and on your phone, and the app reaches your instance wherever you are.

There is an official Tailscale add-on for Home Assistant OS, installable from the add-on store, which is the least painful route on a supervised install.

What it does not do: Alexa, Google Assistant and any external service that has to originate a connection to you. Those need an endpoint reachable from the public internet, which is precisely what a private mesh is not. If voice control is part of why you want this, Tailscale alone will not get you there.

Option 3: a public address of your own

This is what we sell, so weigh it accordingly.

The cases where it genuinely fits: you want the instance on an address you control rather than a vendor's; you need webhooks from services that will not traverse a relay; you are running self-hosted voice and want the endpoint to be yours; or you already hold a public address for other things and would rather not add a second subscription.

A daemon on the Home Assistant host holds a link to our network and we route a public IPv4 address to it. Any port works. The home connection is unchanged.

curl -fsSL https://tunnelnet.io/install.sh | sudo bash
sudo tnet status

# open ONLY the port Home Assistant actually listens on -- see below,
# because the default changed and it is not what most guides say
sudo tnet ports allow tcp 8123
sudo tnet ports mode

The two things people get wrong

These are the reason a working tunnel still gives you a blank page or a login loop, and most guides on the internet are now out of date on both.

The port is probably not 8123 any more

As of Home Assistant 2026.8 the default differs by install method:

Check what yours actually listens on before opening a port to it:

sudo ss -lntp | grep -iE 'home|hass|python'

Home Assistant blocks proxied requests until you tell it not to

This is the one that wastes an evening. If anything sits between the internet and Home Assistant — a reverse proxy, a tunnel, a load balancer — Home Assistant refuses those requests until it is told the proxy is trusted. The symptom is a connection that clearly reaches the box and still fails, which reads like a networking fault and is not one.

This moved to the UI in 2026.8. Guides telling you to edit use_x_forwarded_for and trusted_proxies in configuration.yaml were right for years and are now describing a legacy path that gets migrated automatically. The current place is:

Settings → System → Network, where you enable Trust X-Forwarded-For and add the proxy's address under Trusted proxies.

One detail that catches people: when you give a network rather than a single host, use the network address — 192.168.1.0/24, not 192.168.1.5/24. A host address with a mask is silently not what you meant.

If you put Home Assistant on a public address, harden it first

Home Assistant holds the locks, the cameras and the alarm. It deserves more care than a blog.

Choosing, honestly

Get a public IP — $10/mo See all plans

Sources

Related