Home Assistant is an open-source home automation platform that allows you to control all your devices from a central point. Whether it’s managing your smart lights, thermostats, or security cameras, Home Assistant offers a powerful, customizable solution. However, accessing your Home Assistant instance securely from remote locations is a common challenge for many users.
A Virtual Private Network (VPN) provides an encrypted tunnel between your device and the Home Assistant server, ensuring that your connection is private and secure. In this article, we’ll walk through how to use a VPN to set up secure remote access to Home Assistant.
The first step to using a VPN with Home Assistant is setting up a VPN server. There are many VPN solutions available, but we’ll focus on two popular ones: OpenVPN and WireGuard. Both are widely used and offer strong security features.
Installing OpenVPN
1. Install OpenVPN on your server (where Home Assistant is running) or on a dedicated device in your network.
2. Once OpenVPN is installed, configure it by generating server and client keys, and create the server configuration file. Here’s a basic example of the OpenVPN server configuration:
proto udp
port 1194
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/lib/openvpn/ipp.txt
push “route 192.168.1.0 255.255.255.0”
push “redirect-gateway def1”
keepalive 10 120
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
After configuration, start the OpenVPN server and ensure it’s running properly.
Installing WireGuard
WireGuard is another excellent VPN option, known for its simplicity and high performance. To install WireGuard, use the following steps:
Install WireGuard on your server or device.
Generate the server’s private and public keys:
wg genkey | tee server_private.key | wg pubkey > server_public.key
Configure the WireGuard server with the following configuration file:
[Interface]
PrivateKey =
Address = 10.0.0.1/24
ListenPort = 51820
[Peer]
PublicKey =
AllowedIPs = 10.0.0.2/32
Start the WireGuard interface:
sudo wg-quick up wg0
Configuring Home Assistant for Remote Access
Once your VPN server is set up and running, the next step is to ensure that Home Assistant can be accessed through the VPN connection. This is accomplished by configuring your Home Assistant instance to accept remote connections.
Accessing Home Assistant Locally
By default, Home Assistant can be accessed via the local network at http://homeassistant.local:8123. When you’re connected to the VPN, your device should behave as if it is part of your home network, allowing you to access Home Assistant as though you were physically at home.
http://homeassistant.local:8123
Securing Home Assistant with HTTPS
For an additional layer of security, it’s recommended to enable HTTPS when accessing Home Assistant remotely. This can be done by using Let’s Encrypt certificates or any other SSL certificate provider. For Let’s Encrypt, follow these steps:
Install the Certbot tool on your server.
Request a certificate:
sudo certbot certonly –standalone -d homeassistant.yourdomain.com
Configure Home Assistant to use the SSL certificates by adding the following lines to the configuration.yaml file:
yaml
http:
server_port: 8123
ssl_certificate: /etc/letsencrypt/live/homeassistant.yourdomain.com/fullchain.pem
ssl_key: /etc/letsencrypt/live/homeassistant.yourdomain.com/privkey.pem
Restart Home Assistant to apply the changes.
Connecting to VPN
Now that your Home Assistant is configured, the next step is to connect your client device to the VPN server.
Configuring OpenVPN Client
To connect to the VPN using OpenVPN, you will need to install the OpenVPN client on your device. Here is a basic configuration file for the OpenVPN client:
client
dev tun
proto udp
remote 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA256
cipher AES-256-CBC
verb 3
Once connected, you should be able to securely access Home Assistant from your device.
Configuring WireGuard Client
To configure the WireGuard client, use the following settings:
On the client device, install WireGuard.
Create a WireGuard configuration file:
[Interface]
PrivateKey =
Address = 10.0.0.2/24
[Peer]
PublicKey =
Endpoint = :51820
AllowedIPs = 0.0.0.0/0
Start the WireGuard interface on the client device:
sudo wg-quick up wg0
Now you can access Home Assistant securely over the VPN connection.
Firewall Configuration
Finally, ensure that your firewall is configured to allow the VPN traffic. If you’re using UFW on your server, use the following commands to allow VPN traffic:
sudo ufw allow 1194/udp # For OpenVPN
sudo ufw allow 51820/udp # For WireGuard
sudo ufw enable
With the firewall properly configured, you can ensure that only VPN traffic is allowed, adding an extra layer of security for remote access to your Home Assistant instance.
