Skip to content
All posts
4 min read

Reach Home Assistant and Nextcloud from Anywhere

Reach Home Assistant, Nextcloud, Grafana or SSH on a home server from anywhere. No port forwarding, no dynamic DNS, and it works behind CGNAT.

homelabremote-access

Home Assistant, Nextcloud, Grafana and Pi-hole work on your home network and stop being reachable when you leave it. A Localport tunnel gives each one a public address. The agent on your server connects outbound, so there is no port to forward and nothing changes on your router.

This works on a connection behind carrier-grade NAT (CGNAT), where port forwarding is not available.

Give a web service a public URL#

Create a tunnel in the dashboard, install the agent on the machine that runs the service, and run the command the dashboard gives you. The port is the one your service listens on.

# Home Assistant
localport http 8123 --token YOUR_TOKEN

# Nextcloud
localport http 8080 --token YOUR_TOKEN

# Grafana
localport http 3000 --token YOUR_TOKEN

The tunnel has an HTTPS URL that stays the same across restarts. Open it on your phone from any network.

Reach SSH on a home server#

A TCP tunnel carries SSH.

localport tcp 22 --token YOUR_TOKEN

The dashboard shows the tunnel's address and port. Connect to it from anywhere:

ssh user@my-homeserver.eu.localport.dev -p 47266

Your address and port are the ones shown for your tunnel. TCP Tunnels covers reserving a port so it does not change.

Keep it running#

The agent can run as a system service that starts at boot and restarts if it stops. Homelab Remote Access has the systemd unit, which keeps the token out of the command line.

Each service gets its own tunnel, with its own token and its own URL.

Decide who can open it#

A public URL is reachable by anyone who has it. Put a check in front of each tunnel:

  • IP allowlist: only the addresses you list can connect.
  • Basic auth: a username and password in front of an HTTP tunnel.
  • Rotate the tunnel's token in the dashboard if it leaks. The old token stops working at once and the URL stays the same.

Your home IP address does not appear in DNS. Visitors connect to Localport, and the agent carries the traffic to your service.

When a VPN fits better#

A tunnel gives one service an address. If you need your whole home network, with file shares and printers, a VPN covers that.

Back to all posts