NAT Checker
Guide
15 min readAug 06, 2026

Tailscale Home Assistant: Remote Access Without Port Forwarding

Install the right Tailscale App, choose a private URL, connect the Companion App, and diagnose direct, peer-relay, or DERP paths.

Quick answer

Install the Tailscale App on Home Assistant OS or Green, authenticate it into the same tailnet as your remote phone or computer, then open http://<Tailscale-IP>:8123. Use MagicDNS for a readable name or Tailscale Serve for private HTTPS. You do not need router port forwarding, even behind CGNAT; use Funnel only when a remote device cannot run Tailscale and public access is intentional.

Build my setup pathSee install options

No router rule

Works through CGNAT without forwarding port 8123

Private by default

Use a Tailscale IP, MagicDNS, or Serve

Path-aware fixes

Separate direct, peer-relay, and DERP behavior

How to set up Tailscale remote access for Home Assistant

Install Tailscale on the correct Home Assistant host, authenticate both endpoints, choose a private URL, configure the Companion App, and verify the connection path without router port forwarding.

  1. 1

    Choose the Home Assistant install path

    Use the Tailscale App on Home Assistant OS or Green. For Container or Core, run Tailscale on the Linux host or a deliberately designed network sidecar.

  2. 2

    Install and authenticate Tailscale

    Start the Tailscale App or tailscaled, complete authentication, and confirm the Home Assistant node appears online in the Tailscale admin console.

  3. 3

    Choose a private Home Assistant URL

    Test the 100.x Tailscale IP with port 8123 first, then use MagicDNS for a readable name or Tailscale Serve for a private HTTPS ts.net URL.

  4. 4

    Configure the Companion App

    Keep Tailscale connected on the phone, set the verified private address as the Companion App external URL, and test it over mobile data with Wi-Fi off.

  5. 5

    Verify the service and connection path

    Run tailscale ping or tailscale status, identify direct, peer-relay, or DERP behavior, and troubleshoot DNS, port 8123, or proxy settings at the layer that failed.

Interactive setup checker

Build the right Tailscale Home Assistant path

Pick your Home Assistant install and access goal. The result separates installation, URL, proxy, and public-exposure decisions.

1. Home Assistant installation
2. Access goal

Install path

Install the Tailscale App in Home Assistant

  1. 1Open Settings → Apps, select Install app, and search for Tailscale.
  2. 2Install and start the app, then select Open Web UI and sign in.
  3. 3Confirm the homeassistant machine is online in your tailnet.

Recommended access

Tailnet only

Use Tailscale Serve for private HTTPS

A stable HTTPS URL remains restricted to identities allowed by your tailnet policy.

https://homeassistant.<tailnet>.ts.net
  • Use Share Home Assistant with Serve in the Home Assistant Tailscale App, or tailscale serve --bg 8123 on a suitable host.
  • Copy the current trusted proxy block from the Tailscale App Documentation tab.
  • Restart Home Assistant and test the generated ts.net URL from mobile data.
Step 1

Choose where to install Tailscale

Home Assistant OS and Home Assistant Green use the Tailscale App. Container and Core installs normally place Tailscale on the Linux host. The monitoring Integration is optional and does not create the remote-access path.

Home Assistant editionInstallation pathBest forImportant detail
Home Assistant OS / GreenSettings → Apps → Install app → TailscaleThe supported, lowest-friction pathApps were previously called add-ons
Home Assistant ContainerInstall Tailscale on the Docker host or use a deliberate sidecar designExisting Docker deploymentsPublish Home Assistant port 8123 to the Tailscale host
Home Assistant CoreInstall Tailscale on the Linux hostPython environment managed on LinuxKeep tailscaled enabled across reboots
Home Assistant SupervisedUse the Home Assistant Tailscale App when availableManaged app workflow on a supported hostFollow the current app documentation for proxy settings
Step 2

Install, authenticate, and prove the private path

  1. 1

    Install and start Tailscale

    On HA OS/Green, use Settings → Apps → Install app. Search for Tailscale, install it, then enable Start on boot and Watchdog if those controls are available.

  2. 2

    Authenticate the Home Assistant node

    Select Open Web UI, allow the login pop-up, and approve the node. Confirm a machine named homeassistant (or your chosen name) is online in the Tailscale admin console.

  3. 3

    Sign in on the remote device

    Install Tailscale on the phone, tablet, or computer and join the same tailnet. Tailnet policy still decides which identity can reach Home Assistant.

  4. 4

    Test IP before DNS or HTTPS

    Open http://<Home-Assistant-Tailscale-IP>:8123 from mobile data or a different network. A working IP test proves installation, authentication, routing, and port 8123 before extra layers are added.

What success looks like

Verify one layer at a time instead of changing the router, DNS, and proxy together.

Home Assistant is online in the Tailscale Machines list.

The remote device can tailscale ping the Home Assistant node.

http://100.x.y.z:8123 opens away from home Wi-Fi.

Only then do you add MagicDNS, Serve, or the Companion App URL.

Step 3

Choose the Home Assistant URL

Start with the private 100.x address. MagicDNS makes it memorable; Serve adds private HTTPS. Funnel changes the audience to the public internet and is only appropriate when the remote device cannot run Tailscale.

MethodExampleWho can reach itUse it for
Tailscale IPhttp://100.x.y.z:8123Tailnet onlyFirst connectivity test
MagicDNS namehttp://homeassistant:8123Tailnet onlyMemorable private URL
Tailscale Servehttps://homeassistant.<tailnet>.ts.netTailnet onlyPrivate HTTPS and Companion App
Tailscale Funnelhttps://homeassistant.<tailnet>.ts.netPublic internetOnly when a client cannot run Tailscale

Serve is the private HTTPS default

Serve keeps the ts.net URL inside your tailnet and applies tailnet access rules.

In the Tailscale App, use Share Home Assistant with Serve. For Core or a suitable host, tailscale serve --bg 8123 proxies the local service. Use the current proxy block from the App Documentation tab; this example reflects the official Home Assistant walkthrough.

configuration.yaml example
http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 127.0.0.1

Funnel is a clientless exception

Funnel makes the selected service publicly reachable; it is not a private remote-access upgrade.

Use Funnel only when the remote browser cannot install Tailscale and public reachability is intentional. Keep Home Assistant authentication strong, expose only the required service, and turn Funnel off when the need ends. Tailscale currently documents Funnel as beta and restricts its listening ports and HTTPS behavior.

Connect the Home Assistant Companion App

Use the same URL that already worked in the phone browser.

  1. 1Connect Tailscale on the phone.
  2. 2Test the private IP or Serve URL in a browser.
  3. 3Set that value as the Companion App external URL.
  4. 4Turn off Wi-Fi and verify again over mobile data.

Private access should stay boring

If every remote device can run Tailscale, there is no reason to open TCP 8123 on the home router. The old approach fails under CGNAT, depends on changing public IPs, and exposes an application login to internet scans. Tailscale gives each approved device a private identity and address, so the user gets remote Home Assistant access with fewer public-network dependencies.

Use the site's CGNAT check workflow if you want to prove why a conventional router forward cannot work. It is diagnostic context, not a prerequisite for Tailscale.

Local path analyzer

Read Tailscale status or ping output

Paste the Home Assistant peer result. The checker detects a final direct, peer-relay, DERP, DNS, refusal, or offline signal without sending the text anywhere.

Analysis

Waiting

Paste output to identify the path

Use output for the Home Assistant peer from tailscale ping or tailscale status.

Next three checks

  1. 1Run tailscale ping homeassistant.
  2. 2Or copy the homeassistant row from tailscale status.
  3. 3Paste it here; analysis stays in this browser.

This page cannot probe a private 100.x address from the public web. The analyzer interprets only the text you paste; verification still happens from your signed-in remote device.

Step 5

Check NAT, ports, and connection path in that order

Tailscale usually needs no manually opened firewall port. It tries a direct UDP path first, can use a configured peer relay, and falls back to DERP when necessary. All three Tailscale path types remain end-to-end encrypted; the practical difference is usually latency and throughput.

If the UI fails on a direct path, verify Home Assistant port 8123 and the selected URL. If it works but feels slow on DERP, inspect UDP and NAT behavior with the direct, peer-relay, and DERP guide. The broader Tailscale port and publishing guide explains when Serve or Funnel changes the application boundary.

Do not confuse transport with Home Assistant

A Tailscale route and a listening web service are separate checks.

Ping fails: start with Tailscale node state, authentication, policy, DNS, and path.

Ping works, :8123 fails: check Home Assistant service, container publishing, and host firewall.

IP works, name fails: fix MagicDNS or the hostname.

Serve fails: validate the proxy block and restart Home Assistant.

Tailscale Home Assistant troubleshooting

Match the visible symptom before changing the network. These fixes cover the high-intent login, NXDOMAIN, refused connection, trusted proxy, Companion App, and relay queries.

Continue the right diagnostic branch

Run a NAT type check

See the public-side conditions that influence peer-to-peer path selection.

Check whether your home is behind CGNAT

Confirm why conventional inbound port forwarding is unavailable.

Understand Tailscale ports, Serve, and Funnel

Separate private tailnet access from deliberate public publishing.

Diagnose direct, peer-relay, and DERP paths

Improve a slow fallback only after identifying the actual path.

Tailscale Home Assistant FAQ

Official sources checked

Product names, installation wording, connection types, firewall behavior, Serve, and Funnel requirements were checked against current first-party documentation.

Share this article