Home Assistant: Difference between revisions

Latest revision as of 22:47, 19 August 2026

Home Assistant is an open source home automation server. It has integrations for a wide variety of devices, and allows you to create custom dashboards for viewing sensor information and controlling your devices. If you want to access your Home Assistant instance from anywhere, but cannot port forward due to CGNAT, making your instance publicly accessible via 44Net is one solution. Even if your home internet isn't behind CGNAT, it likely has a dynamic IP, which would require you to set up dynamic DNS for your instance to maintain consistent external access. A 44Net IP lets your instance be publicly accessible at a fixed IPv4 address for free.

Prerequisites:

A Home Assistant instance (set this up before exposing it to the internet so that setup cannot be hijacked)
A 44Net Connect account

Step 1: Set up your tunnel

Home Assistant OS is designed to operate less like a general purpose computing device and more like an appliance. There is no package manager with which to install higher level firewall tools, and the Home Assistant WireGuard application is unmaintained as of 2026. If you're setting up a fresh Home Assistant installation for the express purpose of exposing it to 44Net, the easiest option is running it as a docker container on a device with a single device tunnel. If you have a dedicated Home Assistant appliance, such as a Home Assistant Green or a Raspberry Pi running Home Assistant OS on bare metal, the recommended configuration is to put it on a routed subnet.

Step 2: Open port

Now that your Home Assistant instance and 44Net Connect tunnel are set up, it's time to open the required port in your firewall to make Home Assistant publicly accessible. The default Home Assistant port is 8123, so unless you've changed it, you'll need to open 8123/tcp in your firewall. If you're running a single device tunnel with a Home Assistant VM or docker container, it's as simple as opening the device's firewall on 8123/tcp. If you have a Home Assistant appliance inside a routed subnet, you'll need to open the port in the router's firewall, and ensure the firewall's rule set allows WAN devices to initiate connections on that port. The syntax for doing so varies based on your firewall tool.

firewalld: sudo firewall-ctl --zone=<wireguard interface zone> --add-port 8123/tcp --permanent
ufw: sudo ufw allow 8123 proto tcp

Step 3: Verify connection

After opening the port, verify that Home Assistant is accessible via its 44Net IP address on the port you opened. Visit that IP and port in your browser by going to http://<IP>:<port>. It's important to use http rather than https if you haven't set up TLS.

Optional: Set up TLS without a domain

By default, your connection to Home Assistant is unencrypted. Since it contains control traffic that affects the physical devices in your home, encrypting that connection with TLS is recommended. TLS certificates can be obtained for free through Let's Encrypt, and renewal can be automated via the Certbot project from the Electronic Frontier Foundation.

Let's Encrypt will issue short-lived certificates for bare IP addresses, which are valid for 6 days. Unfortunately, the Let's Encrypt app for Home Assistant OS doesn't support this, so HAOS users should either use a domain or run Certbot on another machine and find a way to automate updating the certificate in HAOS. Users running Home Assistant in a container can run Certbot in the container or on the host system.

Set up Certbot

First, install Certbot according to its instructions. Stop before the "Choose how you'd like to run Certbot" step. We'll be using a slightly different command because we're request a short-lived certificate for a bare IP.

Next, ensure your firewall has port 80 open on the machine where you installed Certbot. When you request a certificate for an IP, Certbot will start a temporary web server on port 80, and tell the Let's Encrypt server to contact the requested IP on that port. The connection will be through your 44Net IP, so ensure port 80 is open in the correct network zone of your firewall. See Firewalling Basics for more information.

Users running Certbot inside the same Docker container as Home Assistant, but running their single device tunnel on the host OS, may need to create a docker port mapping in addition to opening the port on their host OS's firewall.

To run Certbot and acquire the certificate, run the following command:

sudo certbot certonly --standalone --preferred-profile shortlived --ip-address <your 44Net IP>

If it succeeds, you should see output including the following:

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/<your 44Net IP>/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/<your 44Net IP>/privkey.pem
This certificate expires on 2026-08-24.
These files will be updated when the certificate renews.

Set up automatic renewal of your certificate by running the following command:

echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" | sudo tee -a /etc/crontab > /dev/null

This will add a cron job that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.

Configure Docker bind mount

If you set up Certbot on your host machine rather than in your container, you'll need to set up a bind mount for the certificate and private key to be accessible to Home Assistant. Keep track of the directory inside the container that the mount is mapped to, and use that path in the next step.

Configure SSL in Home Assistant

Next, go to Settings > System > Network, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key.

Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.

Optional: Set up TLS with a domain

By default, your connection to Home Assistant is unencrypted. Since it contains control traffic that affects the physical devices in your home, encrypting that connection with TLS is recommended. TLS certificates can be obtained for free through Let's Encrypt, and renewal can be automated via the Certbot project from the Electronic Frontier Foundation.

If you have a domain name, it can be used with Let's Encrypt and Certbot to easily set up an automatically renewing TLS certificate. If you're running Home Assistant OS, you can use the instructions for the Let's Encrypt app. If you're running Home Assistant in a docker container, apps are not supported, so you'll need to set up Certbot yourself.

Set up Certbot

First, install Certbot according to its instructions. Before running the certbot command, ensure your firewall has port 80 open on the machine where you installed Certbot. When you request a certificate for an IP, Certbot will start a temporary web server on port 80, and tell the Let's Encrypt server to contact the requested IP on that port. The connection will be through your 44Net IP, so ensure port 80 is open in the correct network zone of your firewall. See Firewalling Basics for more information.

Users running Certbot inside the same Docker container as Home Assistant, but running their single device tunnel on the host OS, may need to create a docker port mapping in addition to opening the port on their host OS's firewall.

Set up automatic renewal of your certificate by running the following command:

echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" | sudo tee -a /etc/crontab > /dev/null

This will add a cron job that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.

Configure SSL in Home Assistant

Next, go to Settings > System > Network, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key.

Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.

Troubleshooting

Home Assistant is not accessible from the 44Net IP

Ensure you are accessing the correct port for Home Assistant. If you don't specify a port in your web browser, it will attempt to use port 80 (HTTP) or port 443 (HTTPS) by default, but the default Home Assistant port is 8123.
Verify that your firewall configuration has port 8123 (or whatever alternate port you're using) open.
Verify that your 44Net Connect tunnel is up using the the 44Net Connect tunnels page.

Certificate authority fails to download challenge from the Certbot temporary web server

This typically happens if your 44Net tunnel is not up, or if your firewall is not configured to allow inbound connections on port 80. Try the following troubleshooting steps

Use ifconfig to verify that your 44Net Connect tunnel is up. You should see a WireGuard interface with your 44Net IP address.
Visit the 44Net Connect tunnels page and ensure your tunnel shows up as being connected.
Check your firewall configuration and make sure port 80 is open. If you have recently changed your firewall configuration, reload the firewall.
If running Certbot inside your Home Assistant docker container, make sure the docker container has its port 80 mapped to the host's port 80.

@@ Line 18: / Line 18: @@
 After opening the port, verify that Home Assistant is accessible via its 44Net IP address on the port you opened. Visit that IP and port in your browser by going to <code>http://<IP>:<port></code>. It's important to use <code>http</code> rather than <code>https</code> if you haven't set up TLS.
-== Optional: Set up TLS ==
+== Optional: Set up TLS without a domain ==
-By default, your connection to Home Assistant is unencrypted. Since it contains control traffic that affects the physical devices in your home, encrypting that connection with TLS is recommended. TLS certificates can be obtained for free through Let's Encrypt, and renewal can be automated via the CertBot project from the Electronic Frontier Foundation.
+By default, your connection to Home Assistant is unencrypted. Since it contains control traffic that affects the physical devices in your home, encrypting that connection with TLS is recommended. TLS certificates can be obtained for free through Let's Encrypt, and renewal can be automated via the Certbot project from the Electronic Frontier Foundation.
-=== Without a domain ===
+Let's Encrypt will issue short-lived certificates for bare IP addresses, which are valid for 6 days. Unfortunately, the Let's Encrypt app for Home Assistant OS doesn't support this, so HAOS users should either use a domain or run Certbot on another machine and find a way to automate updating the certificate in HAOS. Users running Home Assistant in a container can run Certbot in the container or on the host system.
-Let's Encrypt will issue short-lived certificates for bare IP addresses, which are valid for 6 days. Unfortunately, the Let's Encrypt app for Home Assistant OS doesn't support this, so HAOS users should either use a domain or run CertBot on another machine and find a way to automate updating the certificate in HAOS. Users running Home Assistant in a container can run CertBot in the container or on the host system.
-First, [https://certbot.eff.org/instructions?ws=other&os=pip install CertBot according to its instructions]. Stop before the "Choose how you'd like to run Certbot" step. We'll be using a slightly different command because we're request a short-lived certificate for a bare IP.
+=== Set up Certbot ===
+First, [https://certbot.eff.org/instructions?ws=other&os=pip install Certbot according to its instructions]. Stop before the "Choose how you'd like to run Certbot" step. We'll be using a slightly different command because we're request a short-lived certificate for a bare IP.
-Next, ensure your firewall has port 80 open on the machine where you installed CertBot. When you request a certificate for an IP, CertBot will start a temporary web server on port 80, and tell the Let's Encrypt server to contact the requested IP on that port. The connection will be through your 44Net IP, so ensure port 80 is open in the correct network zone of your firewall. See [[Firewalling Basics]] for more information.
+Next, ensure your firewall has port 80 open on the machine where you installed Certbot. When you request a certificate for an IP, Certbot will start a temporary web server on port 80, and tell the Let's Encrypt server to contact the requested IP on that port. The connection will be through your 44Net IP, so ensure port 80 is open in the correct network zone of your firewall. See [[Firewalling Basics]] for more information.
-Users running CertBot inside the same Docker container as Home Assistant, but running their single device tunnel on the host OS, may need to [https://docs.docker.com/engine/network/port-publishing/ create a docker port mapping] in addition to opening the port on their host OS's firewall.
-To run CertBot and acquire the certificate, run the following command:
+Users running Certbot inside the same Docker container as Home Assistant, but running their single device tunnel on the host OS, may need to [https://docs.docker.com/engine/network/port-publishing/ create a docker port mapping] in addition to opening the port on their host OS's firewall.
+To run Certbot and acquire the certificate, run the following command:
 <code>sudo certbot certonly --standalone --preferred-profile shortlived --ip-address <your 44Net IP></code>
@@ Line 41: / Line 42: @@
 These files will be updated when the certificate renews.</nowiki>
-Then, edit the <code>config.yaml</code> file and configure the location of your certificate.
+Set up automatic renewal of your certificate by running the following command:
+<code>echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" | sudo tee -a /etc/crontab > /dev/null</code>
+This will add a {{Term|cron job}} that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.
+=== Configure Docker bind mount ===
+If you set up Certbot on your host machine rather than in your container, you'll need to set up a [https://docs.docker.com/get-started/docker-concepts/running-containers/sharing-local-files/#file-permissions-for-docker-access-to-host-files bind mount] for the certificate and private key to be accessible to Home Assistant. Keep track of the directory inside the container that the mount is mapped to, and use that path in the next step.
+=== Configure SSL in Home Assistant ===
+Next, go to <code>Settings > System > Network</code>, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key.
- <nowiki># Example configuration.yaml entry for the HTTP component
+[[File:Home_Assistant_TLS_Settings.png|500px]]
-http:
-  ssl_certificate: /etc/letsencrypt/live/<your 44Net IP>/fullchain.pem
+Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.
-  ssl_key: /etc/letsencrypt/live/<your 44Net IP>/privkey.pem</nowiki>
+== Optional: Set up TLS with a domain ==
+By default, your connection to Home Assistant is unencrypted. Since it contains control traffic that affects the physical devices in your home, encrypting that connection with TLS is recommended. TLS certificates can be obtained for free through Let's Encrypt, and renewal can be automated via the Certbot project from the Electronic Frontier Foundation.
+If you have a domain name, it can be used with Let's Encrypt and Certbot to easily set up an automatically renewing TLS certificate. If you're running Home Assistant OS, you can use the [https://github.com/home-assistant/addons/blob/master/letsencrypt/DOCS.md instructions for the Let's Encrypt app]. If you're running Home Assistant in a docker container, apps are not supported, so you'll need to set up Certbot yourself.
+=== Set up Certbot ===
+First, [https://certbot.eff.org/instructions?ws=other&os=pip install Certbot according to its instructions]. Before running the <code>certbot</code> command, ensure your firewall has port 80 open on the machine where you installed Certbot. When you request a certificate for an IP, Certbot will start a temporary web server on port 80, and tell the Let's Encrypt server to contact the requested IP on that port. The connection will be through your 44Net IP, so ensure port 80 is open in the correct network zone of your firewall. See [[Firewalling Basics]] for more information.
+Users running Certbot inside the same Docker container as Home Assistant, but running their single device tunnel on the host OS, may need to [https://docs.docker.com/engine/network/port-publishing/ create a docker port mapping] in addition to opening the port on their host OS's firewall.
 Set up automatic renewal of your certificate by running the following command:
@@ Line 52: / Line 72: @@
 <code>echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" | sudo tee -a /etc/crontab > /dev/null</code>
-This will add a cron job that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring. Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.
+This will add a {{Term|cron job}} that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.
-=== With a doman ===
+=== Configure SSL in Home Assistant ===
-If you have a domain name, it can be used with Let's Encrypt and CertBot to easily set up an automatically renewing TLS certificate. If you're running Home Assistant OS, you can use the [https://github.com/home-assistant/addons/blob/master/letsencrypt/DOCS.md Let's Encrypt app]. If you're running Home Assistant in a docker container, apps are not supported, so you'll need to [https://certbot.eff.org/ set up CertBot yourself].
+Next, go to <code>Settings > System > Network</code>, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key.
+[[File:Home_Assistant_TLS_Settings.png|500px]]
+Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.
 == Troubleshooting ==
+=== Home Assistant is not accessible from the 44Net IP ===
+* Ensure you are accessing the correct port for Home Assistant. If you don't specify a port in your web browser, it will attempt to use port 80 (HTTP) or port 443 (HTTPS) by default, but the default Home Assistant port is 8123.
+* Verify that your firewall configuration has port 8123 (or whatever alternate port you're using) open.
+* Verify that your 44Net Connect tunnel is up using the [https://connect.44net.cloud/tunnels the 44Net Connect tunnels page].
+=== Certificate authority fails to download challenge from the Certbot temporary web server ===
+This typically happens if your 44Net tunnel is not up, or if your firewall is not configured to allow inbound connections on port 80. Try the following troubleshooting steps
+* Use <code>ifconfig</code> to verify that your 44Net Connect tunnel is up. You should see a WireGuard interface with your 44Net IP address.
+* Visit [https://connect.44net.cloud/tunnels the 44Net Connect tunnels page] and ensure your tunnel shows up as being connected.
+* Check your firewall configuration and make sure port 80 is open. If you have recently changed your firewall configuration, reload the firewall.
+* If running Certbot inside your Home Assistant docker container, make sure the docker container has its port 80 mapped to the host's port 80.