By Jeremy Koski · September 16, 2026
Remote access to your home network used to mean exposing services directly to the internet through port forwarding. That approach is dangerous. Every port you open is a door an attacker can try. A VPN (Virtual Private Network) is the secure alternative: it creates an encrypted tunnel between your remote device and your home network, so you can access Home Assistant, your cameras, your NAS, and everything else as if you were sitting in your living room. This guide covers the main VPN options, how to set them up, and the security practices that keep them safe.
These are the two most established VPN protocols for self-hosted setups. Both work well, but they have different trade-offs.
WireGuard is the modern choice. It uses a tiny codebase (about 4,000 lines compared to OpenVPN's 100,000+), which means a smaller attack surface and easier auditing. It is faster than OpenVPN on every platform, uses less battery on mobile devices, and handles network roaming (switching from WiFi to cellular) without dropping the connection.
WireGuard uses UDP only and does not support TCP fallback. If your network blocks UDP, WireGuard will not work without additional configuration. It also assigns static IP addresses to each peer, which is simple but means you need to manage peer keys manually for larger setups.
OpenVPN is the established veteran. It supports both UDP and TCP, which means it can tunnel through restrictive networks that block UDP. It has been audited extensively and is trusted in enterprise environments. The downside is that it is slower, uses more battery, and the configuration is more complex.
Use OpenVPN if you need TCP support or if you are integrating with an existing corporate VPN infrastructure. For everything else, WireGuard is the better choice in 2026.
If setting up WireGuard manually sounds intimidating, Tailscale is the solution. Tailscale is a mesh VPN built on top of WireGuard. It handles key exchange, NAT traversal, and peer discovery automatically. You install the Tailscale client on each device, log in, and your devices can talk to each other over an encrypted tunnel. No port forwarding required.
The free plan supports up to 100 devices, which is more than enough for a home network. Tailscale also offers an open-source alternative called Headscale if you want to self-host the coordination server instead of relying on Tailscale's cloud.
If you choose to run WireGuard manually, you need to forward a single UDP port from your router to your VPN server. Here is the process:
If your ISP assigns you a dynamic IP address, use a dynamic DNS service (DuckDNS, No-IP, or a custom domain) so you can always reach your home network by hostname instead of memorizing an IP that changes.
Once your VPN is running, accessing Home Assistant remotely is straightforward:
With Tailscale, you can also use the Tailscale IP directly (e.g., http://100.x.y.z:8123). Tailscale also supports MagicDNS, which lets you use hostnames like http://homeassistant:8123 without remembering IP addresses.
For Home Assistant specifically, you can also enable the Tailscale add-on directly in HAOS, which gives your Home Assistant instance a Tailscale IP and lets it act as a subnet router for your entire network. This means connecting to Tailscale from your phone gives you access to all devices on your home network, not just Home Assistant.
A VPN is a security tool, but it needs to be configured securely to do its job:
Setting up a VPN is one of the highest-value security steps you can take for your smart home. If you want help choosing the right VPN solution and configuring it for your network, see our tech basics and VPN guide or book an on-site visit and we will handle the entire setup for you.
For more on practical technology decisions, read our post on why we keep using AI that breaks things.