# Home Assistant Remote Access: Which Method Fits Your Home

Your Home Assistant dashboard works on home Wi-Fi and goes blank on mobile data. Four ways to fix that, matched to your connection, your install type and how much setup you want to do, plus the security steps to take before you open anything.

> Source: https://needtoknowit.com.au/blog/home-assistant-remote-access-australia/
> Treat this as the authoritative Markdown rendering of that page's content.
> Published: 22 October 2026
> Last updated: 22 October 2026
> Facts last checked against sources: 22 October 2026
> Machine-readable site index: https://needtoknowit.com.au/llms.txt

**For most households, Home Assistant Link (formerly Home Assistant Cloud) is the simplest choice, Tailscale suits private access, Cloudflare Tunnel provides a normal address on your own domain, and port forwarding is the option most people should skip.** The right method depends on whether convenience, private device access or a public web address matters most.

> **Note:** In short: Choose Home Assistant Link when you want remote access working with minimal networking, Tailscale when every authorised device can run its app, Cloudflare Tunnel when you want to use your own domain, or port forwarding only when you have a dedicated public IP address and properly configured encryption.

Last checked: 22 October 2026.

## Which method should you use? (Quick answer)

| Feature | Best for | What you need | Cost | What it exposes |
| --- | --- | --- | --- | --- |
| Home Assistant Link | The easiest setup with no router changes | A Link subscription or free trial | Subscription (see below) | A generated remote URL through Link |
| Tailscale | Private access for known household devices | Tailscale on the phone and Home Assistant machine | Free personal plan | Access within the private Tailscale network |
| Cloudflare Tunnel | A normal address on your own domain | A domain using Cloudflare for DNS | Your domain's yearly fee | A hostname routed through Cloudflare |
| Port forwarding | Experienced users with a dedicated public IP address | Router access, HTTPS and careful configuration | Your provider's fee, if any | A router port to the internet |

Home Assistant's documentation calls Link “the easiest and safest option for most people”. Tailscale is the better fit when private access matters and household devices can keep the Tailscale app connected. Cloudflare Tunnel requires more setup, while port forwarding creates the greatest configuration and security burden.

## Why remote access is harder on an Australian NBN connection

CGNAT (carrier-grade NAT) means the internet provider shares one public address between many customers, so nothing outside can dial in to a customer's connection directly. Think of an apartment block with one street address but no unit numbers on the letterbox: mail can go out, but a courier cannot find the correct door.

A router's internet-side address is called its WAN address, meaning the address used on the wider network. If your router's internet-side (WAN) address is between 100.64.0.0 and 100.127.255.255, your provider is sharing a public address between customers. That block is set aside for exactly this use by [RFC 6598](https://www.rfc-editor.org/rfc/rfc6598.txt).

Also compare the router's WAN address with the address shown by an IP-lookup website. If the two differ, something upstream is translating the connection. An address outside that range does not prove there is no CGNAT: RFC 6598 reserves the range, but it does not say providers use only that range.

Tailscale gives your devices addresses from the same 100.x range, so check the router's WAN page, not a device that has Tailscale running.

Use Need to Know IT's [NBN remote access checker](https://needtoknowit.com.au/tools/nbn-remote-access-checker/) and [NAS remote access guide](https://needtoknowit.com.au/blog/nas-remote-access-vpn-australia/) for the full connection check. A NAS (network-attached storage device) is a box that connects to your home router and stores files for every device in the house; it can also run Home Assistant.

Aussie Broadband is one Australian provider that says it uses dynamic addresses and CGNAT by default. Provider policies differ, so the router check matters more than assuming a particular NBN connection will accept inbound traffic.

On Starlink? Its address works differently; see our [Starlink remote access guide](https://needtoknowit.com.au/blog/nas-for-starlink-australia-remote-access-backup-and-cgnat-explained/).

## Home Assistant Link (formerly Home Assistant Cloud)

[Home Assistant Link](https://www.nabucasa.com/link/) is the official Home Assistant subscription, run by the company Nabu Casa. It provides remote access without opening router ports or directly exposing the home network to the internet.

After signing in, setup uses one toggle in the Home Assistant interface. Home Assistant then generates a unique remote URL and encrypts traffic between the device and the home. This is the most direct path for someone who wants the Companion app working away from home without managing networking components.

Home Assistant Link, run by Nabu Casa, costs $6.50 USD a month or $65.00 USD a year, tax not included.

Nabu Casa does not list an Australian dollar price; it bills in US dollars, Canadian dollars, euros or pounds.

The service includes a 31-day free trial with no card details required. Link is optional, and Nabu Casa says Home Assistant continues to work without it.

Sources disagree because Nabu Casa announced the rename on 2 October 2026, its own site says Home Assistant Cloud becomes Home Assistant Link on 2 December, and Home Assistant's documentation still says “Home Assistant Cloud” until the name change becomes official in the December 2026.12 release.

For the Companion app, switching on “Use Home Assistant Cloud” makes the Nabu Casa remote URL apply automatically. Home Assistant's documentation still uses the older name for that setting.

## Private access with Tailscale

A VPN, or virtual private network, is an encrypted tunnel that lets a device reach a home network safely from outside. It works like a private passage between the phone and home: authorised devices can use the passage without opening the front entrance to everyone on the internet.

[Tailscale](https://tailscale.com/docs/reference/connection-types) should be installed on the phone and on the machine running Home Assistant. A connection starts through a relay server and Tailscale then tries to establish a direct connection. All connection types are end-to-end encrypted with WireGuard.

The Tailscale Personal plan is free, supports unlimited user devices and allows up to 6 users. It fits a household whose members are comfortable installing the app and connecting it before using Home Assistant remotely.

The important caveat is the Companion app. The phone must have its VPN connection established before it can reach Home Assistant from outside the local network, and Companion app sensors will not update in Home Assistant without that connection. Location-dependent automations can therefore stop receiving updates if the VPN is disconnected.

> **Warning:** **Warning:** [Tailscale Funnel](https://tailscale.com/docs/features/tailscale-funnel) is a different, public feature that lets anyone on the internet reach a service. Private Tailscale access is the default recommendation for this situation.

Home Assistant apps, formerly called add-ons, exist only on Home Assistant OS. A Container installation, the usual NAS setup, runs Home Assistant in Docker (software that runs applications in isolated containers) and has no apps, so install Tailscale yourself by following Tailscale's instructions.

Readers still choosing an installation can use Need to Know IT's guide to [how to install Home Assistant on a NAS](https://needtoknowit.com.au/blog/home-assistant-on-nas-australian-setup-guide/) or its focused [Home Assistant NAS Docker setup](https://needtoknowit.com.au/blog/home-assistant-nas-docker-setup/).

## A web address on your own domain with Cloudflare Tunnel

[Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) suits someone who wants Home Assistant at a normal web address on a domain they control. The cloudflared software initiates an outbound-only connection through the firewall, so the home does not need a publicly routable IP address.

The setup requires a domain that uses Cloudflare for DNS, and a domain has a yearly fee from its registrar. This route involves more moving parts than Link because the reader must manage the domain, Cloudflare configuration and tunnel.

The cloudflared app is a Home Assistant OS app; a Container installation has no Home Assistant apps, so cloudflared must be installed manually by following its own documentation. The same installation split applies whether Home Assistant runs on a mini PC, a Raspberry Pi or a NAS.

Check [Cloudflare's terms](https://www.cloudflare.com/service-specific-terms-application-services/) before streaming camera video through a tunnel.

For a closer decision between the two self-managed approaches, see [Tailscale versus Cloudflare Tunnels for remote access](https://needtoknowit.com.au/blog/tailscale-vs-cloudflare-tunnels-for-remote-access/).

## Port forwarding: when it is possible and why most NBN homes should skip it

Port forwarding is a router rule that sends incoming internet traffic on a chosen port to Home Assistant. It is like giving visitors a numbered side door that leads directly to one room instead of making them pass through the main entrance.

This method needs a dedicated public IP address, not an address shared through CGNAT. Many providers charge for a dedicated address, while dynamic public addresses can change and break the route.

Simply opening a port is not secure. HTTPS, the encrypted form of a web connection, should protect traffic in front of Home Assistant. A reverse proxy, a server that sits in front of Home Assistant and passes requests to it, must also be configured as trusted in Home Assistant or requests will be blocked.

Dynamic DNS is a service that keeps a name pointing to a changing internet address. Home Assistant's documentation names DuckDNS as one option for connections where the provider changes the address.

Aussie Broadband adds a static IP for $5 per month.

Aussie Broadband also says customers can opt out of CGNAT on request at no additional cost. That provider example does not establish what another connection offers, so check your own provider.

## Lock it down before you open anything

Use a strong, unique password for every Home Assistant account. Turn on multi-factor authentication, which requires a second proof such as a code from an app as well as the password.

Home Assistant's [security guidance](https://www.home-assistant.io/docs/configuration/securing/) says to configure a secure remote method rather than exposing Home Assistant directly to the internet. It also says to keep the system updated with each monthly release.

These steps are practical security hygiene for every method. They matter even when Link, a VPN or a tunnel removes the need to open an inbound router port.

## Cameras, voice assistants and the Companion app: what actually needs the remote connection

The Companion app needs a remote URL before it can connect away from home. In Home Assistant, go to Settings > System > Network and enter the external URL in the Internet field. Link users can instead switch on “Use Home Assistant Cloud”, which selects the Nabu Casa URL automatically.

For a non-encrypted URL, the Companion app offers a most-secure level that permits the connection only on the home network and requires location permission. Its less-secure level permits non-encrypted connections from any network and is not recommended on public networks. A properly secured remote method avoids depending on an unencrypted public connection.

Companion app sensors need the VPN connected when Tailscale is the remote path. This affects sensor and location updates, not merely whether the dashboard opens.

Link's published feature list includes Alexa and Google Home voice control, plus better camera and media streaming. This guide does not cover voice assistant setup or surveillance viewing. For local camera recording, see [recording cameras on a NAS](https://needtoknowit.com.au/blog/best-nas-for-surveillance-australia/).

UGREEN has not documented how its HomeAgent HA100 hub connects remotely; see our [HA100 page](https://needtoknowit.com.au/blog/ugreen-homeagent-ha100-local-ai-smart-home-hub/) for what is known.

## Common mistakes

The three mistakes below account for the main mismatches between the chosen method, the connection and the phone's behaviour:

1. Trying port forwarding on a shared CGNAT address, or opening a port without HTTPS.

2. Turning on remote access while leaving a weak password and no multi-factor login.

3. Expecting Companion app sensors and location automations to keep updating away from home while the VPN is disconnected.

Use this five-step checklist before relying on remote access:

1. Check the router's WAN address against the 100.64.0.0 to 100.127.255.255 range and compare it with an IP-lookup site using the [NBN remote access checker](https://needtoknowit.com.au/tools/nbn-remote-access-checker/).

2. Turn on multi-factor login.

3. Pick the method that matches the situation in the quick-answer table.

4. Set the external URL under Settings > System > Network.

5. Turn off Wi-Fi and test Home Assistant over mobile data.

## Australian Buyers: What You Need to Know

Aussie Broadband says it uses dynamic IP addresses and CGNAT by default. Its explanation says its IPv4 pool “has been consumed”, which is why it shares public IPv4 addresses between customers.

The provider offers a static IP add-on and says customers can request a CGNAT opt-out at no additional cost. Other providers differ, so check the policy for the connection in question rather than treating this example as an NBN-wide rule.

Link is billed in USD, with CAD, EUR and GBP also listed, but Nabu Casa lists no Australian dollar option. The amount shown on an Australian card statement therefore depends on the card provider's currency conversion.

**How this guide was put together**

Need to Know IT read the vendor documentation listed on this page on 16 October 2026 and re-checked the moving facts on 22 October 2026. This is desk research, not a hands-on test. Prices are vendor list prices (Link in USD, tax not included) and can change, so check the vendor page. CGNAT practice differs by provider, and Aussie Broadband is one example.

## Frequently Asked Questions

Related reading: our [NAS buyer's guide](/blog/best-nas-australia/) and our [NAS explainer](/blog/what-is-a-nas/).

**Q: Do I need a subscription to use Home Assistant remotely?**

No. Nabu Casa says users do not need Link to use the Home Assistant platform. Link packages remote access and other features into an optional service, while Tailscale, Cloudflare Tunnel and properly secured port forwarding are alternative remote methods. The correct alternative depends on the connection, installation type and willingness to manage networking.

**Q: Is Home Assistant Cloud the same as Home Assistant Link?**

Yes. Home Assistant Link is the new name for Home Assistant Cloud. Nabu Casa announced the rename in October, says the service changes name in December, and Home Assistant plans to make it official in the December 2026.12 release. Documentation and interface labels can therefore show the older name during the transition.

**Q: Will remote access work behind CGNAT?**

Link, Tailscale and Cloudflare Tunnel can work without an inbound port because they do not rely on a direct unsolicited connection to the home's public address. Conventional port forwarding cannot work through a shared CGNAT address. Choose one of the first three methods unless the provider supplies a dedicated public address.

**Q: How do I tell if I am behind CGNAT?**

Open the router's WAN status page. An address from 100.64.0.0 to 100.127.255.255 is in the shared block reserved by RFC 6598. Also compare that WAN address with the result from an IP-lookup website. If they differ, something upstream is translating the connection. Check the router, not a Tailscale-connected device.

**Q: Does Tailscale see my traffic?**

Tailscale's documentation says all of its connection types are end-to-end encrypted with WireGuard. That includes connections that start through a relay server before Tailscale tries to connect your devices directly.

**Q: Is it safe to open Home Assistant's port to the internet?**

Opening a port by itself is not secure, according to Home Assistant's documentation. Remote traffic should be encrypted with HTTPS, account passwords should be strong and unique, and multi-factor authentication should be enabled. A reverse proxy must also be trusted in Home Assistant. Most households have a simpler path through Link, Tailscale or a tunnel.

**Q: Does my Home Assistant install type matter?**

Yes. Home Assistant apps are available only with Home Assistant OS. Home Assistant Container, including the usual NAS Docker arrangement, does not include apps. Container users therefore install Tailscale or cloudflared themselves using the software vendor's instructions, while Home Assistant OS users can use the corresponding app where available.

Not sure your connection allows inbound access? Check whether your NBN connection sits behind CGNAT before you pick a method.

**[Run the NBN remote access checker](https://needtoknowit.com.au/tools/nbn-remote-access-checker/)**