UniFi Remote Access to Home Assistant: Cloud, VPN or Tunnel

You might assume that reaching Home Assistant from outside the house means opening a port on your UniFi gateway. Usually it doesn't.

Home Assistant listens only on your local network by default, which is what keeps it private, and most of the paths in from outside open nothing on the gateway at all.

First, your UniFi gateway already ships the two VPNs Ubiquiti recommends. Teleport and a self-hosted WireGuard server both live in UniFi Network's VPN settings, and the UniFi remote access guide covers how they route traffic, resolve names and differ from Site Magic.

Home Assistant adds its own options on top: Home Assistant Cloud from Nabu Casa, plus community apps for Tailscale and Cloudflare Tunnel.

The paths are not interchangeable. For instance, some publish Home Assistant alone, some put your phone on the whole network, and they differ on whether the Companion app can report your location while you are away.

What follows covers the facts that decide the choice, then each path in turn, ending with the one that opens the most. Every claim about a service comes from that service's own documentation.

Check these three things before you pick anything:

• A public address. Ubiquiti's port-forwarding troubleshooting says a WAN address inside 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 or 100.64.0.0/10 usually means the gateway sits behind another NAT. Its public access guide offers a quicker test: compare the WAN IP shown in Site Manager with the address a "what's my IP" search reports.
• The Companion app. Home Assistant's remote access documentation notes that on a VPN path, the app's sensors stop updating whenever the VPN connection is down. Location updates travel the same way, so a tunnel you start by hand is a poor fit for presence automations.
• Scope. Home Assistant Cloud, Tailscale Serve and Cloudflare Tunnel publish Home Assistant itself. Teleport and WireGuard put the phone on your network, subject to firewall policy, which is more access than a household member needs to switch off the lights.

Keep in mind that the app also has to decide what to do at home. According to its networking documentation, the Companion app chooses between an internal and an external URL by the Wi-Fi network it is on.

Note that the app can read that network name only with location access set to Always on iOS, or Allow all the time on Android.

Home Assistant Cloud is Nabu Casa's subscription service, and Home Assistant's documentation calls it the easiest and safest option for most people. Turning on remote access generates a certificate and a unique URL, and Home Assistant then connects out to one of Nabu Casa's proxy servers.

The subscription also helps fund Home Assistant's development, and it starts with a one-month trial that needs no payment details.

Nabu Casa's deep dive explains the mechanics. The proxies operate at the TCP level and route by the Server Name Indication in the TLS handshake, so traffic stays encrypted end to end.

In addition, Nabu Casa's security notes point out that certificate transparency logs let anyone audit that no one else has been issued a certificate for your URL.

For UniFi, the consequence is how little there is to configure. No port forward, DNS record or VPN profile is involved, and double NAT behind an ISP router stops mattering.

The one dependency is outbound internet for Home Assistant, so if you restrict the IoT zone's internet access, as the IoT VLAN guide discusses, keep Home Assistant's allowed.

That said, the login page is now reachable from the internet. Nabu Casa's security article says so directly and recommends two-factor authentication on every account.

Before the 2026.9 release, every visitor arriving through the Cloud appeared to come from 127.0.0.1, which is why Nabu Casa advised against IP banning. Since then, Home Assistant sees each visitor's real address.

Automatic bans are off by default, because Login attempts before ban starts at -1. If you enable them, Nabu Casa's limitations article advises a generous threshold.

The count has no time window and bans never expire on their own. Moreover, a mobile carrier's address is shared with many other customers.

Trusted-network sign-in never applies over the Cloud connection either, and Nabu Casa says that is deliberate.

Teleport is UniFi's one-click VPN, available on Next-Gen gateways and Cloud Gateways running UniFi OS. The gateway buying guide covers the current models.

You generate an invitation in UniFi Network, the recipient opens it in the WiFiman app on iOS, Android or desktop, and the VPN is added. Ubiquiti's Teleport article notes that an invitation expires after 24 hours, serves one device at a time, and can be revoked from Client Devices once accepted.

What's more, Teleport sets the client's DNS servers to the gateway's own, so a local DNS record for Home Assistant resolves from a hotel room just as it does at home. Ubiquiti adds that Teleport needs an IPv6 connection on the gateway's WAN in some circumstances, so check the WAN's IPv6 status when invitations fail.

The WireGuard server is the manual alternative, and it trades convenience for control. In Ubiquiti's WireGuard server article, the server uses UDP 51820 by default and hands each client a configuration file or QR code, and Ubiquiti recommends a gateway with a public IP address.

Behind an ISP router, the port must be forwarded upstream as well. Behind CGNAT it cannot accept connections, since Ubiquiti lists a public IP as necessary for port forwarding and most VPNs, Teleport excepted.

A dual-WAN gateway adds one more wrinkle. When traffic fails over, the public address changes and live sessions reset, as the WAN failover guide explains.

As a result, a WireGuard client aimed at a literal IP cannot find the gateway, so give it a Dynamic DNS hostname and confirm the record follows the new address.

Both paths land the phone in the VPN zone of UniFi's firewall. In Ubiquiti's zone matrix, VPN to Internal is Allow All by default, but that matrix shows only the built-in zones, not a custom IoT zone like the one in the IoT VLAN guide.

So if Home Assistant lives in one, add an allow from the VPN zone to Home Assistant's address and web port.

Keep in mind what a network-level tunnel costs the Companion app. Home Assistant's documentation is explicit that its sensors do not update while the VPN is down.

For a phone that must always report, pair Teleport with a path that needs no tunnel, or accept that presence updates only when the tunnel is connected.

Both of these run as apps, formerly called add-ons, on a Home Assistant OS host, and both connect outward, so neither needs a port on the UniFi gateway. They differ in who can reach Home Assistant once they are running.

Tailscale builds a private network of your own devices on WireGuard. Its connection documentation says every connection starts through a relay and upgrades to a direct peer-to-peer link where the NAT allows it, staying relayed when both ends sit behind a hard NAT.

As a result, it works behind CGNAT, sometimes more slowly.

The Tailscale app's documentation covers two options that matter on a UniFi network:

• Subnet routes. The advertise_routes option exposes whole subnets to your tailnet once you approve them in Tailscale's admin console. By default the app makes that traffic appear to come from Home Assistant itself, so UniFi's zone policies treat it as traffic from Home Assistant's zone. A tailnet device using those routes can then reach whatever Home Assistant can. Advertise only the subnets you mean to share.
• Serve and Funnel. Serve gives Home Assistant a valid certificate inside your tailnet, while Funnel publishes it to the wider internet. Both need Trust X-Forwarded-For switched on and 127.0.0.1 added as a trusted proxy under Settings › System › Network.

Cloudflare Tunnel takes the opposite approach and publishes Home Assistant on a hostname you own. Cloudflare's tunnel documentation describes outbound-only connections that need no publicly routable IP address, so CGNAT is no obstacle.

The community Cloudflared app needs a domain that uses Cloudflare DNS, and Home Assistant must trust the app's network: Trust X-Forwarded-For on, with 172.30.33.0/24 as a trusted proxy.

Remember that a published hostname puts the login page on the internet, just as the Cloud does. Two-factor authentication matters equally here.

What's more, the app's documentation asks users to comply with Cloudflare's Self-Serve Subscription Agreement, so read it before you rely on the tunnel.

Forwarding Home Assistant's port straight to the internet is the approach both vendors hedge hardest. Home Assistant's documentation says that just putting a port up is not secure.

Ubiquiti's remote access overview adds that security responsibility falls on the exposed device and that the traffic is not encrypted by default.

In addition, UniFi adds constraints of its own, plus one useful option. A given WAN port forwards to exactly one device, UPnP may already hold the port you want, and a rule can be limited to traffic from specified source addresses.

Behind an upstream NAT, you must forward on the ISP router too, and Ubiquiti notes that hairpin NAT through that upstream address will not work from inside your network.

The Companion app then needs one name that works everywhere. Its networking guide suggests hairpin NAT or split-brain DNS for that, and on UniFi a Host (A) record in the gateway's DNS can point your public hostname at Home Assistant's internal address.

Be aware that, like any record the gateway serves, the record only helps clients that use the gateway as their DNS server.

Encryption is not optional on this path. Home Assistant's documentation points to Let's Encrypt certificates.

Note that a reverse proxy in front of Home Assistant must be on the trusted proxies list, or Home Assistant blocks its requests by design.

Each row below comes from the vendor documentation cited above:

Path	Port opened on the gateway	Behind CGNAT	What it exposes	Companion app away from home
Home Assistant Cloud	None	Works	Home Assistant	Works without a VPN
UniFi Teleport	None	Works	Your network, per zone policies	Only while connected
UniFi WireGuard server	UDP 51820 by default	Fails	Your network, per zone policies	Only while connected
Tailscale app	None	Works, sometimes relayed	Home Assistant, plus routes you advertise	Only while connected, unless Funnel
Cloudflare Tunnel	None	Works	The hostnames you publish	Works without a VPN
Port forward	The port you forward	Fails	The forwarded port	Works without a VPN

That said, two paths often beat one. A pairing that covers both needs is Home Assistant Cloud for the household's phones, which keeps location reporting independent of any tunnel.

Teleport then serves whoever administers the network and needs the NAS, the cameras and the UniFi console too. That mirrors the conclusion of the general remote access guide: each path does the job it was built for.

Finally, whatever you choose, test it from outside on mobile data rather than from your own Wi-Fi, because a request from inside the network proves nothing about the path in. Then walk out with the phone and confirm its sensors still update, because the presence detection guide relies on them for the GPS half of presence.