Disclosure: Some links in this article are affiliate links. We may earn a commission on qualifying purchases at no extra cost to you.
Port-forwarding port 8123 to the open internet is one of the fastest ways to turn a Home Assistant install into a public target — live scans routinely turn up tens of thousands of exposed instances, many without so much as a valid SSL certificate. The good news is that reaching a dashboard from outside the house no longer requires that risk. Three practical paths exist: pay a small monthly fee and let Nabu Casa handle it, install Tailscale and build a private mesh network for free, or self-host a VPN server and own every piece of the chain.
None of these is objectively "best." Nabu Casa trades a few dollars a month for zero configuration and native voice-assistant support. Tailscale trades a bit of setup for a free, fast, CGNAT-proof private network — at the cost of installing an app on every device that needs access. A self-hosted VPN trades the most setup time for total independence from any third party, but it stops working outright on many mobile and fiber connections that sit behind carrier-grade NAT (CGNAT).
This guide breaks down the three approaches on the criteria that actually change the decision: cost, setup complexity, who holds the keys to your connection, whether it survives CGNAT, and how painless it is to give a family member or guest access. It closes with a decision guide by use case rather than a single "winner," because the right answer depends on whether the priority is convenience, price, or control.
Quick Verdict
| Method | Best for | Cost | Survives CGNAT |
|---|---|---|---|
| Nabu Casa Cloud | Set-and-forget access, Alexa/Google voice, easy family sharing | $6.50/mo or $65/yr | Yes |
| Tailscale | Technical users who want free, fast, private access | Free (Personal plan) | Yes |
| Self-hosted VPN | Full independence from any third party, no recurring cost | Free software + one-time hardware | No (needs public IP + open port) |
Which Versions Are We Comparing?
"Remote access" gets used loosely, so it's worth being precise about what each option actually is before comparing them.
Nabu Casa Cloud (branded "Home Assistant Cloud" inside the UI) is the official paid subscription from Nabu Casa, the company founded in 2018 by Home Assistant core developers Paulus Schoutsen, Ben Bangert, and Pascal Vizeli. It's a managed relay: the local instance opens an outbound connection to Nabu Casa's proxy servers, and remote requests are routed to it using TLS Server Name Indication. It also bundles Google Assistant and Amazon Alexa integration, cloud text-to-speech/speech-to-text for the Assist voice pipeline, and automated backups — this comparison focuses specifically on the remote-access piece.
Tailscale is a mesh VPN overlay built on WireGuard. Installing it on the Home Assistant machine and on a phone or laptop puts both devices on the same private "tailnet," each with a stable 100.x.y.z address reachable from anywhere. Connections are peer-to-peer when possible, falling back to Tailscale's relay ("DERP") servers only when direct connection fails. This comparison covers the free Personal plan, since that's what covers a household.
Self-hosted VPN means running a VPN server under your own control — either the community WireGuard add-on inside Home Assistant, a router with a built-in WireGuard/OpenVPN server (several GL.iNet models), or a dedicated Raspberry Pi. Devices connect back into the home network through an encrypted tunnel and reach Home Assistant at its normal local IP address. This is distinct from Cloudflare Tunnel or a reverse proxy with DuckDNS, which some competing guides lump into the same bucket — those introduce a different third party and a different threat model, and aren't covered here.
Cost — Nabu Casa vs Tailscale vs Self-Hosted VPN
Nabu Casa runs $6.50/month or $65/year in the US (€7.50/€75 in the EU, £6.50/£65 in the UK, VAT included on the EU price), with a 30-day free trial. The price has moved only once since February 2022. That subscription also covers cloud backups, Alexa/Google integration, and Assist voice processing — remote access alone accounts for only part of the value, which matters when judging whether the fee is "worth it."
Tailscale's Personal plan is free indefinitely: up to 6 users, unlimited devices per user, subnet routing, and exit nodes all included, with no credit card required. As of an April 2026 pricing update, the free tier actually got more generous — the previous cap of 3 users and 100 devices was lifted to 6 users and no device limit. Paid Tailscale tiers (Standard at $8/seat/month, Premium at $18/seat/month) target teams and businesses, not a household running Home Assistant.
A self-hosted VPN costs nothing in software — WireGuard and OpenVPN are both free and open source — but it isn't truly free if hardware needs to be bought or repurposed. A router capable of running a WireGuard server, like the GL.iNet GL-MT6000 (Flint 2), covers this without dedicating the Home Assistant box itself to VPN duty:
Over a multi-year horizon, self-hosted VPN is the cheapest option if the hardware is already owned or serves double duty as the home router. Nabu Casa is the most expensive on paper, but it's also the only option funding the open-source project itself — a reason cited repeatedly in the Home Assistant community as a deciding factor even among people who could technically run something free.
Setup Complexity — Nabu Casa vs Tailscale vs Self-Hosted VPN
Nabu Casa is the fastest by a wide margin: enable it in Settings, log in, done — typically under five minutes with no networking knowledge required. There's no router configuration, no port to open, no dynamic DNS to maintain.
Tailscale requires installing the community add-on on Home Assistant and the Tailscale app on every device that needs remote access — a phone, a laptop, a tablet. Each device authenticates once and then just works, including through MagicDNS for a stable hostname instead of a raw IP. The setup is low-effort per device, but it does mean an app to install and keep updated on each one, which is a materially different model than Nabu Casa's single toggle.
Self-hosted VPN is the heaviest lift. A working setup needs: a VPN server (add-on, router, or Pi), a public IP reachable from your ISP, an open UDP port (51820 by default for WireGuard), likely dynamic DNS if the public IP isn't static, and a client configured on every device — usually via QR code with the HA WireGuard add-on, which at least automates per-peer key generation. Router-based setups like GL.iNet's Flint 2 reduce some of this friction by exposing WireGuard server configuration in a GUI, but the public-IP and open-port requirements don't go away.
Third-Party Dependency & Trust Model
This is the criterion that most separates the three options philosophically.
Nabu Casa sits fully in the middle of the connection. Traffic between browser and Home Assistant instance is end-to-end encrypted using a Let's Encrypt certificate the local instance generates and owns — but Nabu Casa openly documents that because they control the domain used for routing, they could theoretically issue their own certificate and intercept traffic. They state plainly they won't do this except if compelled by a government order. That's an unusually honest disclosure for a commercial service, and it should be read as transparency rather than a red flag — but it is a real dependency on a company staying trustworthy and staying in business.
Tailscale is peer-to-peer WireGuard, which is architecturally stronger against interception — Tailscale's own servers coordinate key exchange but don't sit in the data path when a direct connection succeeds. The dependency here is on Tailscale's coordination servers and, in fallback scenarios, its DERP relay network. If Tailscale the company disappeared, the open-source client and Headscale (a self-hosted, compatible control server) offer an escape hatch — a stronger fallback position than Nabu Casa, which has no equivalent self-hosted mode.
Self-hosted VPN has zero third-party dependency in the strict sense — no relay, no coordination server, no company holding any keys. This is the purist's choice for anyone whose priority is architectural independence, at the cost of taking on 100% of the reliability and security burden personally.
CGNAT & Network Compatibility
This is the criterion competing articles most often skip, and it can silently rule out an entire option before setup even begins. Carrier-grade NAT (CGNAT) is standard on most mobile/5G home internet plans and increasingly common on fiber and cable ISPs. Behind CGNAT, a router does not have a unique public IP address to forward a port to — no amount of correct WireGuard configuration fixes this, because the problem is upstream of the router entirely.
Nabu Casa and Tailscale both use outbound-initiated connections — the Home Assistant instance reaches out to Nabu Casa's proxy or Tailscale's coordination servers, so no inbound port needs to be open and CGNAT is a non-issue. Self-hosted VPN, by contrast, needs an inbound-reachable endpoint. Real-world accounts from users troubleshooting broken WireGuard setups consistently trace the failure back to CGNAT or a dynamic IP, not misconfiguration — a distinction worth confirming with an ISP before investing time in a self-hosted setup.
Anyone unsure whether their connection sits behind CGNAT should check before choosing self-hosted VPN as the plan; it's the single most common reason a correctly-configured WireGuard server refuses to accept remote connections.
Voice Assistant & Family/Guest Access
Alexa and Google Assistant integration for Home Assistant essentially requires Nabu Casa — see the Alexa & Google Home integration guide for the setup path. Tailscale and self-hosted VPN have no equivalent bundled feature; voice control through third-party assistants isn't something either is designed to solve.
Sharing access with family or guests plays out differently across the three. Nabu Casa provides a single URL that opens in any browser — no app, no account, no setup on the guest's end. Tailscale requires every person who needs access to install the Tailscale app and join the tailnet, which is manageable for a partner but becomes friction for occasional guests or less technical family members. Self-hosted VPN has the same per-device client requirement as Tailscale, but without the zero-config NAT traversal — each client also needs correct server details and, depending on the network, a working DNS setup.
Security & Encryption Model
All three approaches meet the baseline goal of keeping Home Assistant off the open internet, which is the real security win over raw port forwarding regardless of which one is chosen. Beyond that baseline, the differences are architectural rather than about raw cryptographic strength — all three ultimately rely on strong, modern encryption.
Nabu Casa's connection is end-to-end encrypted with a certificate the local instance controls, relayed through Nabu Casa's infrastructure, with the documented (and disclosed) theoretical MITM caveat described above. Tailscale is WireGuard-based peer-to-peer encryption, widely regarded as one of the leaner, more auditable VPN protocols in current use, with connections ideally never touching a third-party server's data path. Self-hosted VPN — typically also WireGuard — offers the same cryptographic foundation as Tailscale, with the difference being that the operator, not a company, is responsible for correct configuration: keeping AllowedIPs scoped to what's actually needed, keeping the add-on or firmware patched, and never forwarding port 8123 directly regardless of which remote-access method is layered on top.
Head-to-Head Specs Comparison
| Nabu Casa Cloud | Tailscale | Self-Hosted VPN | |
|---|---|---|---|
| Underlying tech | TLS proxy relay, SNI routing | WireGuard mesh, P2P + DERP fallback | WireGuard or OpenVPN |
| Cost | $6.50/mo or $65/yr | Free (Personal plan) | Free software; hardware cost |
| Setup time | ~5 minutes | Low; app per device | High; server + client + DNS + firewall |
| Works behind CGNAT | Yes | Yes | No — needs public IP + open port |
| Third-party dependency | Nabu Casa proxy (disclosed theoretical MITM) | Tailscale coordination servers + DERP relays | None |
| Voice assistant support | Native Alexa/Google integration | Not included | Not included |
| Guest/family access | Single URL, no app needed | Requires app install per device | Requires client config per device |
| Funds the open-source project | Yes | No | No |
Which Should You Buy?
Non-technical households, or anyone who wants Alexa/Google voice control: Nabu Casa Cloud. The setup time alone justifies the subscription for most people, and it's the only option here that also unlocks native voice-assistant integration and painless guest access.
Technical users comfortable with an app-based workflow who want free, fast, CGNAT-proof access: Tailscale. The Personal plan's household-sized limits are generous enough that most users will never hit them, and the peer-to-peer architecture keeps a third party out of the actual data path in most cases. The one operational gotcha to plan for: the separate HA "Tailscale integration" (the monitoring integration, not the VPN add-on itself) uses an API access token capped at 90 days that can't be set to never expire — expect to renew it periodically, and don't confuse it with the add-on's node key, which can be configured not to expire.
Users who want zero third-party dependency and already have — or want — a capable router: self-hosted VPN, provided the home connection isn't behind CGNAT. A router like the GL.iNet Flint 2 with a built-in WireGuard server keeps VPN duties off the Home Assistant box entirely. For anyone building or upgrading the Home Assistant host itself around this decision, the Home Assistant Green or a Raspberry Pi 5 both run the WireGuard add-on comfortably alongside Home Assistant Core — see the hardware comparison guide for a fuller breakdown of what each handles well.
Belt-and-suspenders approach: many experienced users run both Nabu Casa (for voice assistants, guest sharing, and to fund the project) and Tailscale (as the fast, no-cost daily driver) simultaneously — there's no conflict between the two, since one is a proxy relay and the other a private mesh network operating independently.
Frequently Asked Questions
Q: Is Nabu Casa worth the subscription if Tailscale is free?
For most households, yes — the subscription buys zero-configuration setup, native Alexa/Google Assistant integration that Tailscale doesn't provide, and single-URL sharing that doesn't require guests to install anything. Technical users who don't need voice assistants and are comfortable maintaining an app on every device often use Tailscale instead and skip the fee, though many keep both.
Q: Can I run Tailscale and Nabu Casa at the same time?
Yes. They solve different problems — Nabu Casa is a managed proxy with voice-assistant integration, Tailscale is a private mesh network — and running both adds redundancy rather than conflict.
Q: Does Tailscale work if my home internet is behind CGNAT?
Yes. Tailscale connects using outbound sessions to its coordination servers and falls back to relay servers (DERP) when a direct peer-to-peer connection isn't possible, so CGNAT doesn't block it the way it blocks classic port-forwarded VPN setups.
Q: Is it safe to just forward port 8123 to the internet?
No. Home Assistant's own documentation actively discourages this, and live internet scans consistently turn up tens of thousands of publicly exposed instances, a meaningful share without valid SSL certificates. Nabu Casa, Tailscale, and a properly configured VPN all avoid this by using outbound connections or encrypted tunnels instead of an open inbound port.
Q: Do I need Nabu Casa to use Alexa or Google Assistant with Home Assistant?
Effectively yes for the officially supported path — Nabu Casa's subscription includes the cloud integration that connects Home Assistant to both Alexa and Google Assistant. There's no equivalent built into Tailscale or a self-hosted VPN.
Q: What happens to my Home Assistant instance if I stop paying for Nabu Casa?
Home Assistant keeps running normally on the local network — nothing stops working at home. Only remote access, voice assistant integration, and the other cloud features tied to the subscription become unavailable until it's renewed.
Conclusion
The three options here aren't competing for the same job — they're trading convenience, cost, and control against each other in different proportions. Nabu Casa Cloud is the fastest path to a working, shareable, voice-assistant-ready setup and is worth the subscription for most non-technical households. Tailscale delivers nearly the same reliability for free, provided the household is comfortable installing an app per device and occasionally renewing an API token. Self-hosted VPN is the only fully independent option, but it's gated by one hard requirement — a real public IP without CGNAT in the way — that rules it out for a meaningful share of home connections before setup even starts.
Whichever path gets chosen, the underlying principle stays the same: keep port 8123 off the public internet. From there, the choice comes down to whether five minutes of setup, a free app-based network, or full architectural ownership matters most. Pairing the remote-access decision with the right host matters too — see the Home Assistant Green vs Yellow comparison for the hardware side of that equation, and the Matter integration setup guide for what to tackle next once remote access is sorted.
