Home Assistant

Home Assistant is an open source home automation server. It has integrations for a wide variety of devices, and allows you to create custom dashboards for viewing sensor information and controlling your devices. If you want to access your Home Assistant instance from anywhere, but cannot port forward due to CGNAT, making your instance publicly accessible via 44Net is one solution. Even if your home internet isn't behind CGNAT, it likely has a dynamic IP, which would require you to set up dynamic DNS for your instance to maintain consistent external access. A 44Net IP lets your instance be publicly accessible at a fixed IPv4 address for free.

Prerequisites:

A Home Assistant instance (set this up before exposing it to the internet so that setup cannot be hijacked)
A 44Net Connect account

Step 1: Set up your tunnel

Home Assistant OS is designed to operate less like a general purpose computing device and more like an appliance. There is no package manager with which to install higher level firewall tools, and the Home Assistant WireGuard application is unmaintained as of 2026. If you're setting up a fresh Home Assistant installation for the express purpose of exposing it to 44Net, the easiest option is running it as a docker container on a device with a single device tunnel. If you have a dedicated Home Assistant appliance, such as a Home Assistant Green or a Raspberry Pi running Home Assistant OS on bare metal, the recommended configuration is to put it on a routed subnet.

Step 2: Open port

Now that your Home Assistant instance and 44Net Connect tunnel are set up, it's time to open the required port in your firewall to make Home Assistant publicly accessible. The default Home Assistant port is 8123, so unless you've changed it, you'll need to open 8123/tcp in your firewall. If you're running a single device tunnel with a Home Assistant VM or docker container, it's as simple as opening the device's firewall on 8123/tcp. If you have a Home Assistant appliance inside a routed subnet, you'll need to open the port in the router's firewall, and ensure the firewall's rule set allows WAN devices to initiate connections on that port. The syntax for doing so varies based on your firewall tool.

firewalld: sudo firewall-ctl --zone=<wireguard interface zone> --add-port 8123/tcp --permanent
ufw: sudo ufw allow 8123 proto tcp

Step 3: Verify connection

After opening the port, verify that Home Assistant is accessible via its 44Net IP address on the port you opened. Visit that IP and port in your browser by going to http://<IP>:<port>. It's important to use http rather than https if you haven't set up TLS.

Optional: Set up TLS without a domain

By default, your connection to Home Assistant is unencrypted. Since it contains control traffic that affects the physical devices in your home, encrypting that connection with TLS is recommended. TLS certificates can be obtained for free through Let's Encrypt, and renewal can be automated via the CertBot project from the Electronic Frontier Foundation.

Let's Encrypt will issue short-lived certificates for bare IP addresses, which are valid for 6 days. Unfortunately, the Let's Encrypt app for Home Assistant OS doesn't support this, so HAOS users should either use a domain or run CertBot on another machine and find a way to automate updating the certificate in HAOS. Users running Home Assistant in a container can run CertBot in the container or on the host system.

Set up CertBot

First, install CertBot according to its instructions. Stop before the "Choose how you'd like to run Certbot" step. We'll be using a slightly different command because we're request a short-lived certificate for a bare IP.

Next, ensure your firewall has port 80 open on the machine where you installed CertBot. When you request a certificate for an IP, CertBot will start a temporary web server on port 80, and tell the Let's Encrypt server to contact the requested IP on that port. The connection will be through your 44Net IP, so ensure port 80 is open in the correct network zone of your firewall. See Firewalling Basics for more information.

Users running CertBot inside the same Docker container as Home Assistant, but running their single device tunnel on the host OS, may need to create a docker port mapping in addition to opening the port on their host OS's firewall.

To run CertBot and acquire the certificate, run the following command:

sudo certbot certonly --standalone --preferred-profile shortlived --ip-address <your 44Net IP>

If it succeeds, you should see output including the following:

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/<your 44Net IP>/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/<your 44Net IP>/privkey.pem
This certificate expires on 2026-08-24.
These files will be updated when the certificate renews.

Set up automatic renewal of your certificate by running the following command:

echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" | sudo tee -a /etc/crontab > /dev/null

This will add a cron job that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring. Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.

Configure SSL in Home Assistant

Next, go to Settings > System > Network, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key. Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.

Optional: Set up TLS with a domain