I’m running my own HA locally, in my house, but I would like to be able to access it also when I’m not home. So I’ve put it on my Zerotier One VPN, which works fine. Except for two things:
-
HA no longer knows when I’m home - it thinks I’m always home;
-
Other people in my household would also like to have remote access, but it’s unrealistic to have them install and use the VPN.
So - can I just open it up, and rely on long, complex passeords? Or is that a complete no-go?
I’ve got it accessible from the internet through a reverse proxy… My default https drops all connections, so you need to access the right subdomain, which are not advertised on dns or certificates (I use a wildcard). Probably not perfect though but it helps a bit. I also have geo-blocking enabled on my pfSense router, so basically everything outside my country gets blocked by the firewall anyway.
It will always be a risk vs benefit consideration.
the wildcard certificates make a huge difference. I had my services all on servicename.mydomain.com each with an individual certificate, and those certificate registration scrapers make them public and they got hit a lot (but blocked by crowdsec). since moving all my services to servicename.app.mydomain.com with a wildcard dns record and cert for *.app.mydomain.com, they’re completely not-public and my crowdsec logs have gone silent.
would running everything thru my tailscale be better? yup, but there’s a lot of situations that I want to access home that I can’t use with a vpn, where I can’t install my own software.
Why not a presence sensor of and kind? Check your router’s WiFi client list for your phone MAC or something
I’m using cloudflared to give it a bit more protection over a plain reverse proxy
If you are hosting other things with it, then a reverse proxy like Caddy or Traefik + crowdsec is pretty much as good as you are going to get and you can add region blocking on your router (if that feature is available) or if you use cloudflare as a proxy.
If you want to go really crazy, you can put authelia/Authentik in front of it, depending on what else you host.
So - can I just open it up, and rely on long, complex passeords? Or is that a complete no-go?
Install Fail2Ban on a free cloud VM and watch it for a couple of days. Seeing the never-ending intrusion attempts from around the world was a real eye-opener. There is no way I’d expose HA (or anything else except Wireguard) to the Internet. (Open WG ports appear closed unless they receive the correct key.)
In your situation I’d just pay for Home Assistant Cloud. It’s not expensive and will do exactly what you want to do.
For a zero cost solution I use Tasker to automatically enable a Wireguard tunnel whenever we’re not on home wifi. It allows direct access to everything on our local lan, and as a bonus prevents our wireless carrier from monitoring our Internet activities. A combination of the OpenWRT Ubus integration and a BLE integration (using inexpensive Shelly switch modules) detect when we’re home with 100% accuracy.
I solved Problem 1 by adding ICMP to HA. It’s constantly checking if my phone is present on the WiFi*.
I’m using Tailscale instead of ZeroTier, but that should not matter.
*I could also use my routers integrstion, but this logic worked with my shitty old router that had no integration
I just use a Cloudflare tunnel using the Cloudflared plugin and a custom domain name. So no need to open ports. I use long passwords for the users. Not sure how unsafe it is but in HA you get a notification when a failed login happened.
Mine is on the internet behind nginx. I block connections not originating in countries that are reasonable for my family. I don’t like geoip blocking but it straight up eliminated almost all the IDS alerts. I needed to migrate to DNS based validation for certbot.
If I or my family leave the geo region, I’m “away” anyways until I return to the area and my device gets a new IP. Or I can allow the country temporarily.
With the price of oil and therefore plane tickets what it is, I won’t be leaving my geo region.
Tailscale is possibly a solution for you.
I work in IT at a major university, and watch the logs. My Home Assistant instance is open to the Internet behind an nginx reverse proxy with SSL. (The official add-on makes it easy.) Brute-forcing passwords on HTTPS is not really a thing anymore. I get a connection attempt or two per month at home. At work, they go for known vulnerabilities in web apps; WordPress, mostly.
Brute-forcing passwords on HTTPS is not really a thing anymore.
Why is that?
I would expect that the cost-benefit calculation doesn’t work out. If you have a password hash in local memory, then the computer can try each possibility in nanoseconds, and it can still take several minutes to crack trivial passwords.
To brute-force a password over HTTPS, each attempt is on the order of microseconds, about 1/1000th the speed, or slower. Plus, all the overhead of SSL, which imposes a compute burden on the attacking machine.
And that’s just trivial passwords, plus assuming that the target host doesn’t have connection rate-limiting, or even a sysadmin who’d notice the logs getting flooded with bad requests continuously for a couple of days.
I have it available via a reverse proxy with vouch proxy enabled for 2FA.
Mine is on the internet. The real risk is a zero day auth bypass, password cracking won’t really work when the HA interface sends notifications on authentication failures.
What I personally do is have it accessible over WireGuard. Open TCP ports to the Internet is a bad idea. This does mean you have to launch WireGuard every time, but it’s way more secure
Wireguard runs in a different subnet at home, so the ping sensor for my phone fails on the regular WLAN address and this my ha always knows when home and when not.
If I understood correctly, you may find https://wgtunnel.com/ useful. No need to launch wireguard manually anymore.
Wish they had it for iOS
If you don’t want to use a VPN like Tailscale (or ZeroTier) then this is exactly what the Home Assistant Cloud is for. And it even has an 1-month trial.
Mine is open to the internet, via a nginx reverse proxy. I made it ban people who try to brute-force my password. It’s been fine like that for years now:
http: trusted_proxies: - w.x.y.z use_x_forwarded_for: true ip_ban_enabled: true login_attempts_threshold: 10Thanks, TIL about the built in ip ban
