ThisCalculator

Everyday

OpenVPN Server Setup for Remote Home Assistant Access

Updated · Standard formula, shown below

OpenVPN Server Setup for Remote Home Assistant Access

An OpenVPN server lets you connect your phone or computer securely to your home network while away, so you can reach Home Assistant without exposing its web interface to the public internet. You’ll install or configure a VPN server at home, forward its VPN port through your router, and connect a client device to the resulting VPN profile.

What You’ll Need

  • A Home Assistant installation on a home network, plus administrator access to the system or device that will run OpenVPN.
  • A router with administrator access and the ability to create a UDP port-forwarding rule.
  • A public IPv4 address, or a working public IPv6 setup. If your ISP uses carrier-grade NAT, ordinary router port forwarding may not work; ask the ISP about a public address or use a VPN solution designed for that situation.
  • A way to reach your home network by name, such as a dynamic DNS hostname, if your public IP address changes.
  • An OpenVPN client app on each remote device. Keep server and client software updated.

Step-by-Step

  1. Choose where OpenVPN will run. It can run on a Linux computer or small server that stays on, or on a router or firewall with built-in OpenVPN server support. Home Assistant OS users can install a suitable, maintained VPN add-on from a trusted source if one is available for their installation. Add-on names, settings, and support vary, so follow the documentation for the specific software and Home Assistant installation type. Avoid installing unrelated VPN server packages directly into the Home Assistant operating system.
  2. Check your home network details. Find the LAN address range in your router settings—for example, 192.168.1.0/24—and the local IP address of Home Assistant. Give Home Assistant a DHCP reservation so its address remains stable. Make sure the VPN client address pool you plan to use is different from your home LAN and from networks you commonly use elsewhere; overlapping ranges can prevent access.
  3. Install and configure the server. Use the server’s official instructions to install OpenVPN and create its certificate authority, server certificate, and client certificate or profile. Protect private keys and profile files: they grant network access. Choose a strong authentication method, use current cryptographic defaults supplied by maintained software, and do not disable certificate checks to make setup easier. Configure the VPN to route traffic to your home LAN, not all internet traffic, unless you specifically want a full-tunnel VPN. Set DNS for clients if you want them to resolve home devices by name.
  4. Allow access only as needed. Configure the server’s firewall to accept the selected OpenVPN transport and port, commonly UDP 1194, and to allow VPN clients to reach the Home Assistant host and any other required LAN devices. The server must also forward or route traffic between the VPN subnet and LAN. Some setups need a route on the router back to the VPN subnet; others use narrowly scoped NAT. Follow the server’s documented networking method. Do not open Home Assistant’s web port, such as 8123, directly to the internet as a substitute.
  5. Set up a stable public address. If your public IP changes, configure a dynamic DNS name using a reputable provider and set the OpenVPN client profile to use that hostname. Confirm the name resolves to your current public IP. A dynamic DNS name does not bypass carrier-grade NAT, and it does not itself create a secure connection.
  6. Forward the VPN port on your router. Create a port-forward rule for the exact UDP or TCP port and protocol configured on the server, directing it to the server’s reserved LAN IP. UDP is commonly used. Do not forward every port, and do not create a rule for Home Assistant’s web interface. If the server runs on the router itself, its documentation may not require a separate forwarding rule.
  7. Import a client profile securely. Export or create a unique profile for each phone or computer, then import it into an OpenVPN-compatible client app. Transfer it through a secure method and avoid public links, shared folders, or unencrypted email. If a device is lost or a profile may have been copied, revoke that client certificate and issue a replacement.
  8. Test from outside your home Wi-Fi. Turn off Wi-Fi on your phone or use another external network, connect the VPN, and open Home Assistant using its LAN address or local hostname and the normal web port. For example, if its reserved address is 192.168.1.50, try the address with port 8123. Keep Home Assistant’s normal login and multi-factor protections enabled; a VPN is an additional access layer, not a replacement for account security.

Common Mistakes

  • Testing only while connected to home Wi-Fi. Local testing may not exercise router forwarding or public DNS. Test using cellular data or another outside connection.
  • Forwarding TCP when the server listens on UDP, or forwarding to the wrong internal IP. The protocol, port, and destination must match the server configuration.
  • Using the Home Assistant address as the VPN server address. The client connects to the home public IP or dynamic DNS name; after connection, it reaches Home Assistant through the LAN.
  • Choosing a VPN subnet that overlaps the home network, hotel Wi-Fi, or another commonly used network. Select a non-overlapping private range.
  • Assuming a successful VPN connection proves LAN routing works. The tunnel can connect while firewall rules, routes, or DNS still block Home Assistant.
  • Sharing one client profile among everyone or leaving an old profile active. Use separate credentials and revoke any that are no longer trusted.

Tips

  • Keep the OpenVPN server, client apps, router firmware, and Home Assistant updated. Back up server configuration and certificate authority material securely.
  • Limit VPN clients to the network access they actually need, where your server and firewall support it. Review connected clients and remove old credentials.
  • Use Home Assistant’s reserved LAN address for initial testing. Once routing works, a local DNS name can make access easier, provided client DNS is configured correctly.
  • Document the VPN port, protocol, LAN subnet, server address, and recovery steps somewhere private and safe.

Troubleshooting

  • The client cannot connect: Check that the server is running, the profile points to the right public hostname or IP and port, and the router forwards the matching protocol to the correct server. Check the server and client logs for certificate, DNS, or timeout errors. Confirm your ISP connection has a reachable public address; carrier-grade NAT can prevent inbound connections.
  • The VPN connects, but Home Assistant does not load: Try its reserved LAN IP and port 8123. Check that the server routes the VPN subnet to the LAN and that host or router firewalls permit the traffic. If the IP works but the hostname does not, troubleshoot client DNS settings.
  • It works on some networks but not others: A remote network may block the configured protocol or use the same IP range as your home LAN. Try another external connection and consider a different non-overlapping VPN subnet or a supported alternative transport.
  • It works only while at home: Test on cellular data, recheck dynamic DNS, and verify the router’s WAN address is publicly reachable. Do not expose Home Assistant’s web port to diagnose a VPN problem.
  • Home Assistant loads but links or integrations fail: Some integrations use separate ports, broadcasts, or local discovery that do not automatically cross a routed VPN. Allow only necessary traffic and configure integrations to use direct addresses where supported.

Frequently Asked Questions

Do I need a static public IP address?
No. A dynamic DNS hostname can track a changing public IP. It will not solve carrier-grade NAT or an ISP firewall that blocks inbound connections.

Should I forward port 8123?
No, not for this setup. Forward only the OpenVPN server’s configured port. Access Home Assistant through the VPN using its private LAN address.

Can OpenVPN run on the Home Assistant device?
Sometimes, depending on the installation type and supported add-ons. Use maintained software and its official instructions; do not alter a managed operating system with unsupported packages.

Does the VPN make Home Assistant anonymous?
No. It encrypts the connection between your remote device and VPN server, but it does not hide your activity from every network provider or replace secure Home Assistant credentials.

Can more than one device connect?
Yes, if the server permits it and has enough available VPN addresses. Create a separate client profile for each device so access can be revoked individually.

Can I use OpenVPN behind carrier-grade NAT?
Usually, not with a simple inbound port forward. Ask your ISP about a public IP, or choose a supported VPN approach that works through outbound connections or a relay.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.