My Home Assistant install used to live behind a port forward on my router. So did my NAS, my printer, and a long-forgotten Raspberry Pi running Pi-hole. Every one of those was a quiet invitation to anyone who bothered to scan the internet. I have since moved everything behind a Tailscale tailnet (a private mesh network of devices that can only talk to each other through authenticated WireGuard tunnels) and I have not looked back. Here is the version of the playbook I wish I had read before spending two weekends on reverse proxies (intermediaries that receive inbound traffic and forward it to an internal service, so you do not have to expose the service directly) and certificate renewals.
The reason this matters is not paranoia, it is math. Your home IP address is being scanned constantly. Security research firms and bot herders (operators of networks of compromised computers used for scanning and attacking) scan the entire IPv4 (the older 32-bit internet address space, covering about 4.3 billion addresses) space in days, not months. The instant you open port 8123 (Home Assistant’s default) on your router, your install becomes a node on someone’s hit list. The fix is not a stronger password. The fix is to not be reachable in the first place.
What a tailnet actually gives you
Tailscale sits on top of WireGuard, which is a modern VPN protocol that uses current-generation cryptography (ChaCha20 for symmetric encryption, Curve25519 for key exchange) and runs in the Linux kernel. You install the Tailscale client on each device you want to be part of your network. Each device gets a stable 100.x.y.z address (Tailscale’s private range, not routable on the public internet) and can talk to the others directly when possible, or relayed through Tailscale’s DERP servers when symmetric NAT (a router setup where both sides pick different ports, breaking peer-to-peer) blocks the direct path.
To anyone outside the tailnet, your devices do not exist. There is no open port to scan. There is no certificate to steal from a public endpoint. There is no admin interface to brute force. If a request does not come from another tailnet member, Tailscale ignores it at the kernel level. That is the security model in one sentence.
The Personal plan is free for up to six users and a hundred devices, which is plenty for a household with phones, laptops, a few Raspberry Pis, and a Home Assistant box. You only start paying when you want team-grade features like ACLs (access control lists, rules that decide which devices can talk to which), device approval workflows, or SSO (single sign-on) tied to Okta or Google Workspace.
Setting up Tailscale inside Home Assistant
The cleanest install path is the official Tailscale add-on, maintained by Frenck, one of the core Home Assistant developers. There are two add-ons you want:
- Tailscale, the VPN client itself
- Studio Code Server (or the built-in File Editor), which lets you edit YAML files in the browser
Open Settings, then Apps, then click the Install app button in the lower-right corner. Search for Tailscale and install it. Do the same for Studio Code Server. Once installed, go to the Tailscale app and click Start. While you are in there, turn on Watchdog (so it restarts if the process dies), Auto update (so you do not run a year-old client), and Show in sidebar (purely cosmetic, but the entry point becomes one click away). The first time you click Open Web UI, a browser tab opens and asks you to log into your Tailscale account. After you confirm, your Home Assistant box joins your tailnet and shows up in your admin console with a name like homeassistant and a green dot. That is the moment the magic starts.
Naming your tailnet and turning on HTTPS
The auto-generated tailnet name is something like tail6e5bf.ts.net. Nobody can type that, and it gives away nothing useful, so the first thing you should do is rename it. In the Tailscale admin console, click DNS, then Rename tailnet, then keep clicking until you land on something memorable. Tailscale picks from a dictionary of animals and adjectives, so you will get combinations like velociraptor-noodlefish.ts.net. Pick the one you can say out loud on the phone to your partner without laughing.
In the same DNS settings panel, turn on two features:
- MagicDNS, which lets you reach devices by name (homeassistant.tailname.ts.net) instead of by 100.x.y.z address
- HTTPS Certificates, which auto-renews a Let’s Encrypt cert for every device in your tailnet
Without HTTPS, your browser will throw a certificate warning every time you visit Home Assistant, and the mobile app will refuse to connect at all. MagicDNS plus HTTPS is what turns a working tailnet into something your family can actually use.
Telling Home Assistant to trust Tailscale
Home Assistant’s HTTP integration (the component that serves its web UI) does not know about Tailscale’s IP range by default, and it treats any request from an unknown proxy as untrusted. The fix is a four-line block in configuration.yaml:
http:
use_x_forwarded_for: true
trusted_proxies:
- 127.0.0.1
Open Studio Code Server (or File Editor on weaker hardware), navigate to configuration.yaml, paste the block at the bottom, and save. The two-space indentation matters. YAML does not care about tabs and will refuse to parse if you mix them.
Then go to Settings, click the three dots in the upper-right, and choose Restart Home Assistant. The whole container restarts. Your automations will pause for ten seconds. That is fine; the alternative is a config error that takes an hour to untangle.
Turning on Tailscale Serve
Once Home Assistant is back, open the Tailscale app inside it and look for the toggle called Share Home Assistant with Serve or Funnel. There are two options here and they are not equivalent:
- Serve proxies your Home Assistant over the tailnet only. Anyone with Tailscale logged in as you, or anyone you have shared a device with, can reach it. Nobody else.
- Funnel proxies it over the public internet through Tailscale’s edge. This puts your install on the open web. You almost certainly do not want this for a home automation dashboard.
Pick Serve. After a few seconds of background handshaking, Tailscale provisions a TLS (Transport Layer Security, the protocol that puts the S in HTTPS) cert for homeassistant.your-tailnet.ts.net and you can hit it from any browser or device on the tailnet. That is the moment you close port 8123 on your router and never open it again.
What you can do with Home Assistant on a tailnet
Once Home Assistant is a tailnet citizen, three extra features become useful:
- Accept DNS, which lets the box resolve other tailnet device names. Leave it on.
- Advertise as exit node (a device on your tailnet that other devices can route all their internet traffic through, useful for security on public Wi-Fi or for appearing to be at home while travelling), which is worth turning on if Home Assistant runs on one of the few always-on machines in your house. When you travel, point your laptop at your home exit node and your traffic rides home over the tailnet before it hits the public internet.
- Advertise subnet routes, which lets the rest of your tailnet reach your LAN (local area network, the devices physically connected to your home router) without installing Tailscale on every light switch and printer. If Home Assistant sits at 192.168.1.50 and you advertise 192.168.1.0/24, every device on your tailnet can reach everything on your home network.
These are switches in the same Tailscale app panel. Turn them on, then approve the routes in the admin console. That approval step is the ACL system doing its job: you do not want a tailnet where any device can advertise a route without an admin blessing it.
Trade-offs
This setup is not free of trade-offs, and I want them on the record before you rip out your port forward:
- Tailscale is a dependency. If Tailscale has an outage, you cannot reach Home Assistant from outside your LAN. The company has a strong uptime record, but it is one more vendor in the loop. Mitigate by keeping a local admin path (a monitor and keyboard, or a separate non-Tailscale VPN like WireGuard directly) as a fallback.
- Sharing with non-technical family is friction. Grandma does not want to install Tailscale on her phone to turn off the kitchen lights. Use device sharing, where you share specific tailnet devices with specific users rather than giving them full tailnet access, or accept that the dashboard is for you and your partner only.
- Subnets and exit nodes trade privacy for reachability. When you route through a Home Assistant exit node, that box sees your DNS and your traffic in the clear. For your own devices, that is fine. For a corporate laptop, it may violate your company’s acceptable-use policy.
- MagicDNS collisions. If you have a tailnet with overlapping device names (two Home Assistant installs, say), the resolver will pick one and the other becomes unreachable by name. Rename or namespace carefully.
- Restart windows. Every Home Assistant config change still requires a full container restart. That is a Home Assistant limitation, not a Tailscale one, but it stings every time.
For me, the trade-offs are worth it. My home network is no longer a research project for whoever decides to scan my public IP. The reverse proxy I used to maintain is gone. The certificate renewals are gone. The port forwards are gone. What is left is a small set of Tailscale clients I trust and a Home Assistant box I can reach from anywhere I happen to be.
What I would tell past me
If you are about to do this, here is the order that wastes the least time:
- Set up the Tailscale account and rename the tailnet before you install any clients. The default name is unmemorable and you will regret not changing it.
- Install the Tailscale add-on, restart Home Assistant after editing
configuration.yaml, then turn on Serve. Do not enable Funnel unless you have a specific reason. - Move family phones onto the tailnet with the official mobile app, then share the Home Assistant device with each person using device sharing. Avoid sharing the whole tailnet if you can.
- Turn on exit node and subnet routes only after the basic setup is working. Each one is a separate ACL decision in the admin console.
- Keep a fallback path. A small WireGuard server you control directly, with its own port forward, gives you a back door if Tailscale is down. I have used mine once in two years. Once is enough to justify it.
- Audit your tailnet every few months. Tailscale’s admin console shows every device and when it last connected. Prune the ones you do not recognise.
You do not have to do all of this on day one. Start with the basic Serve setup and grow from there. The day you close the last port forward on your router is the day your home network stops being a target of opportunity.