Remote Access

“I give myself very good advice, but I very seldom follow it.”  ~  Alice 

Remote access to Home Assistant is required if you would like the Google Home integration to "see" devices that HA controls. It is of course also required if you need to see what's going on at home while you're away. You would also need a Dynamic DNS client to know the current internet address of your home network (unless you use Cloudflare Tunnels). By far the easiest way to allow access is to open ports in your home network's firewall. The are only two rules that apply here:

1. Do not open ports in your firewall

2. Do not open ports in your firewall

So how the hell do I access my Home Assistant instance remotely?

Introducing Cloudflare Tunnels. Cloudflare offers a free service that creates an encrypted "tunnel" from the Internet to Home Assistant (or any other application on your network). 

Cloudflare requires that you own an internet domain name that you can access and point the domain's DNS servers to servers owned by Cloudflare. Cloudflare sells domain names at cost and if you buy from them, they will automatically configure the DNS server addresses for you. I wanted to keep my tunnels separate from WT4Y.com so I purchased a .ORG domain with an obscure name. The .ORG domains seem to be cheaper than most other high level domain names (around $10 per year). 

Cloudflare needs a CloudflareD service (CloudflareD = Cloudflare Daemon) running on your home network. It is open source and free. CloudflareD can run as an integration on the Home Assistant machine if that's the only machine you have that runs 24/7. I run my daemon in a Docker container on my NAS which also runs 24/7. You have the option to run the service  on these platforms:

CloudflareD "phones home" to Cloudflare  and is used to establish the tunnel between Cloudflare and your home network. It does not matter what I.P. address your router receives from your ISP therefore you do not need a Dynamic DNS service.

Here is one tip I can give you. When you create the "Application Routes" on Cloudflare (one tunnel, as many routes as necessary), you point the application route to a sub-domain. For example, to Home Assistant the name might be HA-3462764.yourdomain.org and to your NAS it could be NAS-8375194.yourdomain.org. If you point the route directly to yourdomain.org, you will end up with many "Attempted Login" alerts in your logs from bots and hackers. These sub-domain names are created inside Cloudflare and are just DNS names that Cloudflare provides to the internet. Think of them as "virtual" sub-domains. Share your sub-domain names with friends and family if you want, but do not publish them on the Internet. If a sub-domain is compromised, you can change it at will and the new names can be resolved a few minutes later. This is called "security through obscurity" and provides another barrier to bots and hackers.

If you're really brave and decide to host a web server on your home network, Cloudflare provides the certificate so your users connect to https://yourdomain.org instead of the scary http://yourdomain.org .  As a matter of fact, any web based application that runs on your home network (Plex, Jellyfin, NAS management, etc.)  will have a valid certificate when accessed through a tunnel.

Follow this tutorial and you'll be up and running quickly:  Cloudflare Tunnel Easy Setup

Step-by-Step Connection Flow:

• Tunnel Creation
  The cloudflared daemon on your Home Assistant server wakes up and initiates an encrypted outbound HTTPS/QUIC connection to the nearest Cloudflare data center.

• Firewall Negotiation
  Because the connection starts inside your network, your router's firewall automatically allows it. No ports (like 8123 or 443) need to be forwarded or opened to the public.

• Public Routing
  With Cloudflare, assign a public hostname (e.g., ha.yourdomain.com) to the Home Assistant Application Route. When you type this URL, your request hits Cloudflare's edge first, not your home IP.

• Traffic Delivery
  Cloudflare verifies the request (checking SSL and Cloudflare's Zero Trust policies) and then pushes the data down the established tunnel to your Home Assistant instance.

“Never let anyone drive you crazy; it is nearby anyway and the walk is good for you.”  ~  Cheshire Cat