Networking

Home Assistant on Tailscale: drop the cloud remote

Reach Home Assistant from your phone anywhere over Tailscale, with no port forwarding and no cloud remote, plus the one setting that trips everyone up.

Some hardware links on this page are affiliate links. As an Amazon Associate I earn from qualifying purchases. We may earn a commission if you buy through them, at no extra cost to you. See the affiliate disclosure.

Port forwarding puts your Home Assistant login page on the open internet. A cloud remote is easier, but it is another account and another subscription. Tailscale gives your phone a private, encrypted path back to your house, and nothing is exposed to the internet. It is free for personal use.

This is how we run it: the Tailscale app on the Home Assistant host, the Companion app on our phones, and no open ports on the router.

How it works

Tailscale builds a private network (a tailnet) out of the devices you sign in. Your phone and your Home Assistant box each get a stable Tailscale address. When your phone is connected to Tailscale, it can reach Home Assistant at that address from anywhere, the same way it does on your home Wi-Fi.

1. Install the Tailscale app

  1. In Home Assistant, go to Settings → Apps → App store (called Add-ons on older versions), search for Tailscale, and install it.
  2. Start it and open its web UI. It gives you a login link.
  3. Sign in with the account you will use on your phone.
  4. In the Tailscale admin console, open the Home Assistant machine and disable key expiry. Otherwise the box drops off the tailnet in a few months and you find out when you are away from home.

2. Connect your phone

  1. Install Tailscale on your phone and sign in with the same account.
  2. In the admin console, copy the Home Assistant machine’s Tailscale address or its MagicDNS name.
  3. Open http://THAT_ADDRESS:8123 in the phone’s browser with Wi-Fi off. If the login page loads, the path works.

3. Point the Companion app at it

In the Home Assistant Companion app, open Settings → Companion app → (your server):

  • Internal URL: your LAN address, used on your home Wi-Fi.
  • External URL: the Tailscale address or name from step 2.

The app switches between them on its own. Push notifications still work, because they don’t depend on how the app reaches your server.

A browser treats the LAN address and the Tailscale address as two different sites, so you log in once on each. That is normal.

4. Optional: HTTPS

Plain HTTP over Tailscale is already encrypted end to end. If you want a proper https:// address anyway (some browser features need it), turn on the app’s proxy option. It uses Tailscale Serve to give the box an HTTPS name on your tailnet. Home Assistant then has to trust the proxy: in configuration.yaml, under http:, set use_x_forwarded_for: true and add the loopback address to trusted_proxies. The app’s Documentation tab shows the exact block to paste.

Restart Home Assistant after the change. Leave Funnel off. Funnel publishes the site to the whole internet, which is the thing we are trying to avoid.

5. Drop the old remote access

Only after you have tested from your phone on mobile data:

  1. Delete the port-forward rule for 8123 (or 443) on your router.
  2. Turn off any cloud remote you used before.
  3. Test again on mobile data, with Tailscale on and then off. With it off, the app should not connect. That means nothing is exposed.

The setting that trips everyone up

By default the app runs Tailscale in userspace networking mode. Your phone can reach Home Assistant, but Home Assistant cannot reach other Tailscale devices. If you add an integration for a computer or a server that is only reachable over Tailscale, it will time out.

Two fixes:

  • Use the device’s LAN address in the integration, if it has one. This is what we do.
  • Or turn off userspace networking in the app’s configuration and restart it. Home Assistant can then reach tailnet addresses directly.

Optional: reach the rest of your network

The app can also advertise your home subnet, so your phone can reach a printer’s web page or a NAS through the same connection. Turn on the subnet routes in the app, then approve them in the admin console. Routes do nothing until they are approved. If you would rather keep that off the Home Assistant box, a small always-on Raspberry Pi can be the subnet router instead.

Troubleshooting

  • Works at home, not away. Tailscale is off on the phone. On iPhone, turn on VPN On Demand in the Tailscale app so it reconnects by itself.
  • Box dropped off the tailnet. Key expiry was left on. Log in again from the app’s web UI, then disable expiry.
  • Integration to a tailnet device times out. Userspace networking (see above).
  • HTTPS name gives a 400 error. The trusted_proxies block is missing or Home Assistant was not restarted.

Keep your tailnet name, machine names and addresses in your own notes. Don’t post them in screenshots or forum questions.