myhomeassistant.top

Full Proxy

Set up Proxy for your Home Assistant

Proxy opens your existing dashboards and settings at your own web address. Follow these steps to let our server connect to Home Assistant through your router.

You’ll need a public IPv4 address from your internet provider and access to your router settings. Proxy does not work behind CGNAT. Prefer a simple dashboard without router changes? Use Relay instead.

Will my router work with Proxy?

Check these three things before changing any settings. A brand name alone doesn’t tell you what your particular model supports.

  1. Does your home have a public IPv4 address?

    If your provider uses CGNAT or DS-Lite, Proxy won’t work. Here’s what to ask your provider. Relay works without this requirement.

  2. Can you allow only our server to connect?

    Check your exact model’s manual for a source-IP restriction or use a home firewall that provides one. A normal port-forwarding rule alone is not enough. If you cannot confirm the restriction, leave forwarding off.

  3. Can you manage the settings safely?

    You need access to your router and Home Assistant settings, plus a way to reach Home Assistant locally. Keep router remote administration off. Don’t use DMZ or an unrestricted rule as a shortcut.

All three checked? Follow your router’s guide below, apply the source restriction first, then run our connection check. A successful check confirms reachability; it does not prove that other internet addresses are blocked.

One answer is no or you’re unsure? Try Relay without router changes. Need the full interface? Compare Cloud and VPN options.

Before you start

  1. Open Home Assistant on your home network and check which port it uses. Use your installation’s setting, rather than assuming a default.
  2. Reserve your Home Assistant device’s local IP address in the router so the rule always points to the right device.
  3. Open the free connection check or your Proxy settings from Connections. Copy the server IP addresses shown for your connection.
  4. Check that your internet provider gives you a public IPv4 address and allows incoming connections. If unsure, read CGNAT and your ISP.
  5. Before opening a port, make sure your router or home firewall can allow connections only from our server. Set up that restriction first.
  6. Keep Home Assistant authentication enabled, keep local access available and leave router remote administration off.

Your browser connects securely to our service. By default, the connection from our service to your Home Assistant is not encrypted. Someone who intercepts it could read the traffic, including sign-in details. HTTPS with a valid, trusted home certificate can protect this connection. Our service can still read and process the traffic even when both connections use HTTPS.

What does port forwarding do?

It sends an incoming connection from your router to the device running Home Assistant. Proxy needs this route because our server connects to your home. Relay starts its connection from inside your home instead.

Fill in one TCP forwarding rule

Our assigned serverAllowed source addressYour routerExternal TCP port
Restricted to our serverHome AssistantReserved local address
Actual listening port
One forwarding rule connects the external port to Home Assistant’s local address and port. Allow only our server’s IP address before enabling the rule.
Rule name
Use a recognizable name, such as Home Assistant Proxy.
External port
The port on the internet side of your router. Enter this same port in your account. Our service supports TCP ports 1–65535, but your router or ISP may reserve or block some.
Internal address and port
The reserved local address and actual listening port of your Home Assistant device. The internal and external ports can differ.
Source address: only our server
Use the assigned server addresses shown in your private setup. This lets our server use the forwarding rule while denying other internet sources. If the router cannot restrict sources, apply that restriction with a supported home firewall before opening the port.

During connection setup, choose the type of connection your Home Assistant actually uses: HTTP if it is not encrypted, or HTTPS if it has a valid, trusted certificate. Choosing HTTPS here does not install a certificate for you. A port number alone does not add encryption, even if it is 443.

Forward only the required service. Do not put Home Assistant in a router DMZ or forward the router’s administration page.

Choose your router

Before opening a port, allow only our server’s IP addresses to connect. If your router or home firewall cannot do this, leave forwarding off and use Relay or another remote-access method.

Menu names vary with model and firmware. Start with the instructions below and use the linked manufacturer guide if yours differs.

ASUS — ASUSWRT, RT and ZenWiFi
  1. Sign in locally. Use Source IP to allow only our server, or apply that restriction with a home firewall. If neither is available, leave forwarding off.
  2. Open WAN → Virtual Server / Port Forwarding and prepare a profile. If your interface requires enabling forwarding before editing, establish the home-firewall restriction first.
  3. Enter the rule name, external port, reserved internal address and actual internal listening port. Choose TCP.
  4. Enter the server IP address from your setup in Source IP before saving. Follow your model’s guide if you need to allow more than one server address.
  5. Check the restriction, then save and activate. Run the connection check.

For AiMesh, use the main router. ASUS’s official guide documents Source IP and model exceptions; its general unrestricted examples do not meet this service’s source-restriction requirement.

NETGEAR — Nighthawk and many Orbi models
  1. First allow only our server using supported router controls or a home firewall. The documented forwarding form has no source-address field. If you cannot restrict access, leave forwarding off.
  2. Sign in locally. Open ADVANCED → Advanced Setup → Port Forwarding / Port Triggering, select Port Forwarding and choose Add Custom Service.
  3. Enter a service name and choose TCP. For one port, enter the same external number in the Starting and Ending fields.
  4. Set the internal port to Home Assistant’s actual listening port and choose its reserved address.
  5. With the restriction active, Apply the rule. Run the connection check.

NETGEAR’s official custom-service guide explains the port and device fields. Forwarding alone does not restrict who can connect.

FRITZ!Box — FRITZ!OS port sharing
  1. First allow only our server using a supported home firewall. The documented sharing form has no source-address restriction. If you cannot restrict access, leave forwarding off.
  2. Sign in locally and open Internet → Permit Access → Port Sharing.
  3. Select the device or choose Add Device for Sharing. Add New Sharing, select Port Sharing and choose Other application.
  4. Name the rule, choose TCP, enter the device’s listening port and set the external IPv4 port to the value used in your connection settings.
  5. With the firewall restriction active, enable and Apply the entry. Leave unrestricted automatic sharing off. Run the connection check.

FRITZ!Box’s official static-sharing guide explains these fields and ISP restrictions.

Allow only our server before opening the port

  1. Copy our server’s IP address from your connection check or Proxy settings.
  2. Use the router’s Source IP setting, or a supported firewall rule, to allow that server IP to connect to Home Assistant’s TCP port. Block other internet addresses from using the rule. A list of allowed devices on your home network is a different setting and does not do this.
  3. Save and check this restriction before enabling port forwarding. Keep access from your home network working. Home Assistant’s password and trusted-proxy settings do not replace this rule.
  4. Once the restriction is active, enable port forwarding and run the private connection check. If your assigned server changes, update this rule to match your connection settings.

If you cannot limit access to our server, leave port forwarding off. Ask for help with a firewall supported by your installation, use Relay for selected controls, or compare other ways to open Home Assistant. Do not open access to everyone, even for a quick test.

Router menus and features vary by model. If you’re unsure how to restrict access on your router, open a support ticket before activation.

Add our server as a trusted proxy

This tells Home Assistant to accept connections forwarded by our server. Copy the exact trusted-proxy addresses from your account. On Home Assistant 2026.8 and later, open Settings → System → Network → HTTP server, enable Trust X-Forwarded-For and add the assigned addresses to Trusted proxies. Older releases use the account’s YAML instructions.

Home Assistant restarts after you save these settings. Open it from your home network and confirm within five minutes. If you do not confirm, Home Assistant automatically restores the previous settings. If you already run another proxy at home, check the documentation below for that setup. Add only the proxy addresses your connection uses.

Home Assistant’s official proxy documentation explains the settings for your release.

After activation: use your personal address

Wait until Connections shows the address as ready. Test it in a browser on mobile data and sign in with your Home Assistant credentials. Use the active HTTPS address for a compatible Companion app connection; keep your local connection too.

If the connection check fails

  1. Check that Home Assistant still opens locally.
  2. Match the rule’s device address, internal port and external port to your installation and account.
  3. Match the source restriction to the server addresses currently shown in your connection settings.
  4. Confirm the ISP allows incoming IPv4 connections. Review CGNAT or a second upstream router below.
  5. If you selected home HTTPS, check its certificate and hostname.
  6. Run the check again and use its port/web-response details to narrow the cause.
CGNAT: when your provider shares your internet address

CGNAT means your internet provider shares one public IP address between several customers. A setting on your own router cannot let our server through the provider’s equipment, so Proxy cannot reach your home this way.

Ask your provider: “Can you give me a public IPv4 address that accepts incoming connections, without CGNAT or DS-Lite?” DS-Lite is another network arrangement that can prevent incoming IPv4 connections. The requirement is the same: your home needs its own reachable public IPv4 address. The address can change over time; you do not need a fixed address. An IPv6 address alone will not work with this Proxy service.

Relay starts its connection from inside your home, so it works behind CGNAT when Home Assistant can reach our service over HTTPS. It gives you a dashboard for selected entities, not the full interface. If you need full access without opening a port, compare other remote-access options. Read the Relay setup guide.

Two routers: double NAT

If a modem/router sits ahead of your own router, incoming traffic needs a route through both. Ask the ISP about bridge mode or use the documented forwarding chain for both routers. Bridge mode can affect ISP phone and TV services; confirm the arrangement before changing it. Keep the source restriction and avoid a DMZ workaround.

Return to the connection check

Still stuck? Open a support ticket.