Home Assistant runs beautifully on a Raspberry Pi tucked behind a router, right up until you want to check a camera feed from the airport or let someone in the family arm the alarm from a train. That's when remote access stops being optional, and most people reach for one of two defaults: opening a port on the router, or handing traffic to a third-party relay. Both come with tradeoffs that don't show up until something breaks. This post is about a third path — a home assistant remote access vps running as your own WireGuard relay, so you can reach your instance from anywhere without exposing your router or routing every packet through somebody else's edge network.
Why Port Forwarding Home Assistant Is the Wrong Default
Forwarding port 8123 (or anything else) straight to your Home Assistant box puts a general-purpose home automation server directly on the public internet. There's no NAT, no firewall abstraction, nothing between a scanner in another country and your login page. Home Assistant is a big, actively developed project with a large integration surface — new CVEs happen, and a home instance running behind a residential connection rarely gets patched the day a fix lands. Add in the fact that most home routers weren't designed to be edge firewalls, and "just forward the port" turns into an open invitation you forget about until logs show login attempts from IP ranges you've never heard of.
Nabu Casa and Cloudflare Tunnel: Convenient, But You're Renting the Path
The two most common alternatives solve the exposure problem by putting a third party's infrastructure between you and your instance. Nabu Casa's cloud subscription relays your Home Assistant traffic through their servers and also handles Alexa/Google Assistant integration — easy to set up, but your remote sessions transit infrastructure you don't operate. Cloudflare Tunnel removes the need for any inbound port by having your instance dial out to Cloudflare's edge, which is genuinely clever, but it means your account, your DNS, and your session termination now live inside somebody else's platform, with their terms of service and their outage windows.
Neither is wrong for casual use. But if you'd rather not depend on a vendor relationship for something as basic as reaching your own lights and locks, the alternative is to run the relay yourself.
A VPS Relay Puts You Back in the Loop
The idea is simple: a small VPS with a public IPv4 and IPv6 address acts as a fixed WireGuard endpoint. Your Home Assistant box, wherever it lives on your home network, dials out to that VPS over an encrypted WireGuard tunnel — same "no inbound port on the router" property Cloudflare Tunnel gives you, except the box in the middle is yours. You hold the keys, you set the firewall rules, and there's no third-party account sitting between your phone and your thermostat.
Once the tunnel is up, you reach Home Assistant through the VPS's stable IP instead of your home connection's changeable one. The VPS never sees your Home Assistant credentials in plaintext or stores any state about your automations — it's just forwarding an encrypted WireGuard tunnel, which is exactly the kind of workload a small instance handles without breaking a sweat.
Sizing a Home Assistant Remote Access VPS: the Entry Tier Is Enough
WireGuard is lightweight by design — it's not proxying HTTP, transcoding video, or doing anything CPU-heavy, just encrypting and forwarding packets. For a single-home relay, the entry VPS I tier is plenty: 2GB RAM, 1 vCPU, and 40GB NVMe storage for EUR4/mo, billed hourly at EUR0.0056/hr so you're not committing to a monthly contract to test the setup. It ships with both IPv4 and IPv6, root SSH access to configure WireGuard exactly how you want it, and 1 Gbps unmetered symmetric bandwidth — far more than a home upload connection will ever push through the tunnel. If you ever need to rebuild the relay from scratch, the median deploy across the 41 available OS templates is 47 seconds, so a clean box is never far away.
Keeping the Endpoint Stable
A relay only works as a fixed point if its address doesn't move. That's part of why the VPS approach beats trying to expose your home connection directly — the VPS keeps its IPv4 and IPv6 addresses regardless of what your ISP does to your home IP. If you're running relays for more than one property, or want IP addressing that follows you if you ever change providers, that's what BYOIP is for — announcing your own address block on our AS rather than depending on whichever provider assigned it.
Nabu Casa vs. Cloudflare Tunnel vs. a VPS You Control
| Approach | How traffic reaches Home Assistant | Who holds the keys | Cost model |
|---|---|---|---|
| Nabu Casa | Relayed through Nabu Casa's cloud | Nabu Casa | Subscription |
| Cloudflare Tunnel | Outbound tunnel to Cloudflare's edge | Cloudflare | Free tier, tied to a Cloudflare account |
| Self-hosted VPS relay | WireGuard tunnel to a VPS you control | You | Hourly billing, from EUR4/mo |
None of these is objectively "best" — it depends on how much you want to manage versus how much you want to own. The VPS relay is the option for people who'd rather run one more small Linux box than route their smart home through a subscription or a platform account.
What Sits Behind the Relay
The VPS runs on our own network — AS60982, not a reseller's routes — and every instance ships with free DDoS protection (up to 1 Tbps, covering L3, L4, and L7) at no extra cost. That matters more than it sounds for something you'll be checking from a hotel Wi-Fi at 2am: the relay itself isn't a softer target just because it now has a public IP attached to it. The whole point of running your own relay is not trading one dependency for a flakier one.
How Noded Can Help
We built our hourly VPS line for exactly this kind of small, always-on job — a box with a stable public IP, low latency, and enough headroom to run WireGuard without us caring how many hours a month it's actually busy. If you're setting up relays for more than one property — a couple of rental units, a family compound, a small office — BYOIP lets the addressing follow you instead of the other way around. And if what starts as a single WireGuard relay ever grows into something that needs dedicated hardware rather than a shared VPS, our dedicated line is there when you outgrow it. For now, spin up the entry tier, point WireGuard at it, and you're done paying for a service that's really just standing between you and your own devices.
FAQ
Do I need a static IP at home to set up a VPS relay for Home Assistant?
No. The WireGuard connection is initiated from your home network out to the VPS, so your home IP can change as often as your ISP likes — the VPS is the fixed point, not your router.
How much VPS do I actually need for this?
The entry tier is enough. WireGuard forwarding is a light CPU and bandwidth job, so a 2GB RAM / 1 vCPU instance with 1 Gbps unmetered bandwidth has plenty of headroom for a single home's remote access traffic.
Is a VPS relay the same thing as port forwarding?
No — with port forwarding, your Home Assistant box itself is exposed on the public internet. With a VPS relay, the public-facing address belongs to the VPS, and your Home Assistant instance only ever talks to it over an encrypted WireGuard tunnel it initiated.
Does this replace Nabu Casa or Cloudflare Tunnel entirely?
For remote UI access, yes — it gives you the same "no open port" property without a subscription or a third-party account in the path. If you rely on Nabu Casa specifically for Alexa or Google Assistant integration, that's a separate service layered on top of remote access, not something a WireGuard relay replaces on its own.
What happens if my home internet goes down?
The tunnel simply has nothing to reach — the VPS stays up and reachable, but there's no live Home Assistant instance on the other end until your home connection comes back and re-establishes the WireGuard session.