The safest way to reach Home Assistant while you are away is to leave it on your private home network and enter that network through an OpenVPN tunnel. Run the VPN server on a router, firewall, or Linux host; forward one UDP port to it; issue a separate certificate profile for each device; route the VPN subnet to Home Assistant; then open Home Assistant’s internal address after the tunnel connects. This avoids exposing the Home Assistant web service directly to the public internet.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
How the remote-access design works
Home Assistant remains on its ordinary LAN address. OpenVPN creates a second, private network (the VPN subnet) for authenticated remote clients. The VPN server routes permitted traffic between that subnet and the Home Assistant LAN. From a phone or laptop, you first connect an OpenVPN client profile, then browse to the same internal Home Assistant address you would use at home.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Only the OpenVPN listener is reachable from the internet. Home Assistant itself does not need a public port. This follows Home Assistant’s guidance to use a secure remote-access method such as a VPN instead of exposing the instance directly.
A typical path looks like this:
Phone or laptop
│ encrypted OpenVPN tunnel (UDP, example port 1194)
Internet-facing router
│ port forward to the VPN server
OpenVPN server (router, firewall, or Linux host)
│ route/firewall policy
Home LAN ─── Home AssistantThe exact addresses below are examples. Substitute your real LAN, VPN pool, public hostname, and Home Assistant address.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Collect the network details before installing anything
Write down these values first. A wrong address or overlapping subnet is the most common reason a tunnel appears connected but Home Assistant will not load.
| Item | Example | Why it matters |
|---|---|---|
| Home Assistant LAN address | 192.168.1.50 | The client will open this internal address after connecting. |
| Home LAN subnet | 192.168.1.0/24 | The VPN server needs a route and firewall permission to this network. |
| VPN client subnet | 10.8.0.0/24 | OpenVPN assigns tunnel addresses from this pool. |
| VPN server LAN address | 192.168.1.2 | The WAN router forwards the OpenVPN port to this address when the server is a separate host. |
| Public address or DNS name | your-home.example.net | Clients use this name or address in the profile’s remote line. |
| OpenVPN listener | UDP 1194 | This is the internet-facing port in the standard sample; you may choose another. |
Do not use a VPN subnet that overlaps the home LAN or networks commonly used by coffee shops, hotels, mobile hotspots, or a second site. For example, if your home LAN is 10.0.0.0/24, do not also assign 10.0.0.0/24 to OpenVPN. Choose a distinct pool such as 10.8.0.0/24 and change it if that pool conflicts with a client network.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Also determine whether your internet service gives the router a reachable public IPv4 address. Carrier-grade NAT (CG-NAT) places several customers behind one provider address and normally prevents unsolicited inbound port forwarding. If the router’s WAN address is private or differs from the address shown by an external address-checking service, ask the ISP for a reachable address or use a different supported remote-access design.
Choose where the OpenVPN server will run
| Endpoint | Best fit | Important considerations |
|---|---|---|
| Router or firewall appliance | Most home users who want one integrated configuration | Check that the exact firmware supports OpenVPN Server, routed access, client profiles, and the authentication options you need. A manufacturer manual such as TP-Link’s documents settings for service port, VPN subnet, and client access, but feature names and capabilities vary by model and firmware. |
| Linux host | Users comfortable maintaining a separate always-on machine | You control the OpenVPN package, certificates, routes, firewall, updates, and backups. The host must have a stable LAN address and remain powered on. |
| OpenVPN Access Server | Administrators who prefer a web-managed service | It provides web controls for routing, authentication, split or full tunnel behavior, and administration. You still must secure the management interface, forward the listener, and maintain the underlying host. |
Whichever endpoint you select, keep it on the home LAN, give it a predictable address (a DHCP reservation is usually sufficient), and ensure its clock is correct. Certificate validation depends on accurate time.
Install OpenVPN and create the certificate infrastructure
Use the official OpenVPN server and client sample files as your starting point rather than inventing a configuration from scratch. The standard sample creates a routed TUN interface, listens on UDP 1194, and uses 10.8.0.0/24; those are examples to adapt, not performance measurements or mandatory values.
You need a certificate authority (CA), one server certificate and private key, and a separate client certificate and private key for every phone, tablet, or computer. A client profile can include the CA certificate, client certificate, and key, so treat the resulting file as a credential.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Generate one identity per device
- Initialize the CA on the VPN server or another secured administration machine.
- Create and sign the server certificate. Keep the CA private key offline or otherwise protected after signing.
- Create a unique client certificate for each device, using names that let you identify them later, such as
phone-annaorlaptop-work. - Build a client profile for each identity. Do not email the same profile to every user or install one profile on multiple personal devices.
- Store a protected backup of the CA material and server configuration. Anyone who obtains the CA private key can potentially issue trusted credentials.
The precise Easy-RSA or package commands differ by operating system and OpenVPN release, so follow the sample shipped with your installation and its current documentation. On a router, the firmware normally performs these steps through an export or certificate-generation screen.
Configure the server for a routed Home Assistant network
A routed design preserves the client’s VPN address and explicitly permits traffic to the Home Assistant LAN. The essential settings are the tunnel device, transport, VPN pool, and a route to the LAN. A conceptual server configuration might contain:
port 1194
proto udp
dev tun
server 10.8.0.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
Use your actual LAN and VPN values. The route tells clients where the Home LAN is; it does not by itself create permission. You must also permit forwarding in the VPN server’s firewall and make sure replies can return to 10.8.0.0/24.
Return traffic: route or NAT
With a true routed setup, the home router needs a route for the VPN subnet via the OpenVPN server’s LAN address. If you cannot add that route, the VPN server can perform source NAT (masquerading) for VPN-to-LAN traffic. NAT often makes a small installation work faster because Home Assistant sees traffic as coming from the VPN server, but it removes the original client address and makes fine-grained LAN policy less transparent. Use the narrowest approach your network supports.
Permit only the required destinations
Create a firewall rule allowing the VPN subnet to reach the Home Assistant host and the port on which its web interface listens. Home Assistant installations commonly use TCP 8123, but verify the port in your deployment rather than assuming it. If you also need cameras, file shares, or another home subnet, add each destination deliberately. Do not grant unrestricted access to every LAN device when one host rule is enough.
Forward the OpenVPN port at the internet edge
If the VPN server is not the device holding the public address, add a port-forward rule on the internet-facing router:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Choose the OpenVPN listener port and protocol, for example UDP 1194.
- Forward that UDP port from the router’s WAN interface to the VPN server’s fixed LAN address.
- Allow the same port in any host firewall on the VPN server.
- Put the public hostname or address and port in each client’s
remotesetting.
Forwarding is transport plumbing, not encryption. A forwarded Home Assistant web port would expose the application directly; forwarding only the OpenVPN listener keeps the application behind the authenticated tunnel.
If your public address changes, use a hostname that follows the address through a dynamic-DNS service supported by your router or firewall. Verify that the name resolves to the current public address before troubleshooting certificates or routes.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCG-NAT is a separate limitation: a port forward configured on your own router cannot pass through the provider’s upstream NAT. Obtain a public address if your ISP offers one, request a static option, or select a remote-access architecture that does not require inbound connections.
Build and protect the client profile
A client profile normally specifies the remote hostname, listener port, tunnel device, and certificate material. A minimal outline is:
client
dev tun
proto udp
remote your-home.example.net 1194
The exported profile may also contain CA, client certificate, and private-key blocks. Import the complete file into a current OpenVPN client on the phone or computer. Keep the private key protected by the device’s passcode and operating-system storage. Do not post the profile in a chat room, commit it to a public repository, or leave it in an unencrypted shared folder.
Revoking a lost device
If a phone or laptop is lost, assume its profile is compromised. Revoke that client’s certificate on the server, update the certificate-revocation list, and issue a new profile only after confirming the old identity can no longer connect. Changing the Home Assistant password alone does not invalidate a VPN certificate.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Connect from a phone or laptop
- Install an OpenVPN-compatible client from the device’s normal app store or software source.
- Import the profile assigned to that device. Confirm that the displayed server name and certificate identity are correct.
- Switch off the home Wi-Fi or use a genuinely different network, such as mobile data, to avoid testing a local shortcut.
- Start the VPN connection and approve the operating system’s VPN permission prompt.
- Check the connection details for an address from the VPN pool, such as 10.8.0.x in the example design.
- Open Home Assistant at its internal address, for example
http://192.168.1.50:8123if that is the address and port you verified. Prefer HTTPS if your internal deployment provides it.
The Home Assistant Companion app also needs the VPN to be connected before it can reach internal endpoints. Establish the tunnel before opening the app or forcing a sensor sync; otherwise the app may report stale values even though the VPN profile is installed.
Choose split tunneling or full tunneling
| Mode | What traverses the VPN | Advantages | Trade-offs |
|---|---|---|---|
| Split tunnel | Home Assistant and selected home subnets only | Lower bandwidth use, less latency for ordinary internet browsing, and usually lower battery impact. It limits the security boundary to the destinations you specify. | Traffic to other internet services continues through the current network, so those services do not use the home’s connection or its filtering. |
| Full tunnel | General internet traffic plus home-LAN traffic | Remote browsing exits through the home connection and can use home DNS or filtering policies. | Consumes home upload bandwidth, may increase latency and battery use, and gives the VPN server responsibility for much more traffic. |
| Domain-based routing | Selected domains resolved or routed through home infrastructure | Useful when only named services need home DNS behavior. | Requires reliable DNS rules and is harder to diagnose than a simple subnet route. |
For a Home Assistant-only requirement, start with split tunneling and a narrow route to the Home Assistant host or required home subnet. Choose full tunneling only when you have a clear reason, such as needing all traffic to leave through the home connection.
Configure Home Assistant’s network URL carefully
In Home Assistant, open Settings > System > Network. Set an Internet URL only when your deployment genuinely needs one. In a VPN-only design, continue using the internal address or an internal DNS name that resolves across the tunnel. Do not enter a public URL merely because the VPN listener has a public hostname; that hostname identifies the VPN gateway, not necessarily the Home Assistant service.
If you use an internal hostname instead of an IP address, provide DNS to VPN clients through the VPN server or another reachable home DNS resolver. Ensure the name resolves to the LAN address while the tunnel is active. A name that works at home but not over VPN usually indicates missing VPN-side DNS rather than a Home Assistant failure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test in a controlled order
Testing one layer at a time prevents a port-forwarding problem from being mistaken for a Home Assistant problem.
- Local service: From the home LAN, open the verified Home Assistant address and confirm the service is running.
- Server listener: On the VPN endpoint, confirm OpenVPN is running and listening on the selected UDP port.
- WAN reachability: From a different network, connect with the client profile. If it cannot connect, inspect the public hostname, port forward, server listener, UDP filtering, and CG-NAT status.
- Tunnel address: After connection, confirm the client received an address from the VPN pool.
- Route: Check that the client has a route to the Home Assistant LAN or host.
- Firewall and return path: Verify forwarding policy, the Home LAN’s route back to the VPN pool, or the configured NAT rule.
- Application: Open the internal Home Assistant URL. Test by IP first, then test the internal hostname if you use one.
- Companion app: With the VPN still connected, reopen or synchronize the app and confirm sensors update.
A successful VPN handshake proves only that the client reached the OpenVPN server. It does not prove that Home Assistant routing, firewall policy, DNS, or the service port is correct.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Troubleshoot by symptom
The client never connects
- Check that the profile’s hostname resolves to your current public address.
- Confirm the forwarded protocol and port exactly match the server listener.
- Verify the forward points to the VPN server’s current LAN address, not an old DHCP address.
- Check for CG-NAT or an upstream modem/router that also needs a forward.
- Review the server log for certificate rejection, expired credentials, or a blocked UDP request.
The tunnel connects, but Home Assistant does not load
- Use the internal Home Assistant IP address rather than the public VPN hostname.
- Confirm the client received a route to the Home Assistant LAN.
- Check the VPN server’s forwarding firewall and the Home LAN firewall.
- Ensure return traffic has a route to the VPN subnet, or confirm that the intended NAT rule is active.
- Verify the actual Home Assistant listening port and that the service is healthy locally.
The IP works but the hostname fails
That isolates the problem to name resolution. Configure DNS for VPN clients, add the internal record to the DNS resolver reachable through the tunnel, or continue using a stable internal IP address. Do not point the internal name at the public VPN gateway unless your network is intentionally configured for that behavior.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe phone app shows stale sensors
Connect the VPN before opening or synchronizing the Companion app. If the tunnel is already connected, check that the app’s Home Assistant URL is the internal address and that the operating system has not suspended the VPN or background activity.
Nothing works after joining another Wi-Fi network
Compare the remote network’s subnet with your home LAN and VPN pool. Overlapping ranges can make the device send Home Assistant traffic to the local café, hotel, or hotspot network instead of the tunnel. Change the VPN pool or redesign the home LAN so the networks are distinct.
Security hardening and ongoing maintenance
- Use a strong, unique Home Assistant password and enable multi-factor authentication.
- Keep Home Assistant, the VPN endpoint, router firmware, and client software current. Home Assistant recommends staying current with its monthly releases.
- Protect the CA private key, server keys, and every client private key. Back up encrypted copies and limit administrative access.
- Issue one certificate profile per device, revoke lost or retired profiles, and replace credentials when compromise is suspected.
- Restrict VPN routes and firewall rules to Home Assistant or the specific home subnets required. Least privilege reduces the damage from a stolen device.
- For a web-managed Access Server installation, replace self-signed web certificates where appropriate, create named administrator accounts, enable MFA, and back up its configuration before upgrades.
- Monitor connection logs for unexpected identities and remove old client certificates.
- Document the public hostname, forwarded port, LAN route, VPN pool, certificate names, and recovery procedure so you can rebuild the service after a router or disk failure.
Remember that encryption applies to the OpenVPN tunnel. A port forward by itself is not a security control, and it does not make a directly exposed Home Assistant port safe.
When this design is the right choice
OpenVPN is a good fit when you control the home router or an always-on server, need access from several conventional client devices, and want Home Assistant to remain private. It requires more network administration than a hosted relay: you must handle certificates, forwarding, routes, updates, and recovery. It also depends on a reachable home connection, so CG-NAT or an unreliable upstream link may determine whether it is practical.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →For a small installation, the least complicated secure design is usually a router-based OpenVPN server, a distinct VPN subnet, split tunneling to the Home Assistant host, one profile per device, and a narrowly scoped firewall rule. Expand the routes only when a specific home service requires them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
