zorven
EN
TürkçeEnglish
Sign in Start free
Guide · Smart home

Home Assistant remote access without port forwarding

Run zorven 8123 on the machine that runs Home Assistant and the dashboard is published at an HTTPS address. You don't open router ports or need a static IP, and it works behind CGNAT. In Home Assistant, turn on X-Forwarded-For trust and add the Zorven client's address as a trusted proxy; then enter the tunnel address as the External URL in the mobile app.

What are the options for Home Assistant remote access?

Home Assistant's official remote access page lists four: Home Assistant Cloud (Nabu Casa), a VPN (such as Tailscale or ZeroTier), a reverse proxy, and port forwarding. It treats port forwarding as the least secure option and warns that just putting a port up is not secure. The same page points out that port forwarding fails if your ISP gives you an address shared through carrier-grade NAT instead of a dedicated IP, which is increasingly common. See What is CGNAT? for how to check.

Zorven combines a tunnel with a reverse proxy: the client connects outward, the Zorven server terminates HTTPS and passes each request through the tunnel to Home Assistant. From Home Assistant's point of view it is a reverse proxy setup.

FeatureZorven tunnelHome Assistant Cloud (Nabu Casa)Port forwarding
Router ports to openNoneNoneYes
Behind CGNATWorksWorksDoes not work
SetupClient plus proxy settings in Home AssistantOne toggle in the UIRouter, DDNS, certificates
PriceStarts on the Free plan (2 tunnels, 5 GB/month)$6.50/month or $65/year (excl. tax)Free; a static IP may cost extra
Extra login layerVisitor login, WAF, bot protection; IP allowlist on Pro+Home Assistant loginNone

Step 1: Find the port Home Assistant listens on

Home Assistant Container and older installs use port 8123. Since 2026.8, new Home Assistant OS installs default to port 80; older OS installs usually keep 8123. The exact value is under Settings > System > Network. The examples below use 8123; change the port in the command if yours differs.

Step 2: Install the Zorven client and open the tunnel

Install the client from the Download page and save the client token from the panel. Then:

  • Home Assistant on the same machine (Container or Core on a Linux server or Raspberry Pi): 
    zorven authtoken zrv_live_...
zorven 8123
  • Home Assistant OS: install the client on another always-on machine on the same network (a NAS, mini PC or Raspberry Pi) and point it at Home Assistant's local address: 
    zorven http 192.168.1.50:8123
    You can also define the same target in the panel with "New tunnel" (http://192.168.1.50:8123).

The https://<name>--slug.zorven.app address in the output is Home Assistant's new external address. To keep the tunnel up across reboots, install it as a service: sudo zorven service install --token zrv_live_... and sudo zorven service start. Service and configuration details are in the docs.

Step 3: Configure trusted proxies in Home Assistant

Zorven adds an X-Forwarded-For header to each request. Home Assistant's documentation says requests from a reverse proxy are blocked unless you configure Home Assistant to trust it. If the address shows an error the first time you open it, this is why.

  1. Open Settings > System > Network and find the HTTP server section (2026.8 and later; before that these options lived in the http: block of configuration.yaml, which is imported into the UI on first start).
  2. Turn on Trust X-Forwarded-For.
  3. Under Trusted proxies, add the address the Zorven client connects to Home Assistant from: 127.0.0.1 and ::1 if the client runs on the same machine, or that machine's local IP (for example 192.168.1.20) if it runs elsewhere. If you use a network mask, enter the network address (192.168.1.0/24, not 192.168.1.50/24).
  4. Save and restart Home Assistant if asked.

If Home Assistant runs in Docker without host networking, connections may arrive from the Docker bridge address; the rejected address shows up in Home Assistant's log.

Step 4: Tell Home Assistant and the mobile app about the external address

Under Settings > System > Network, enter the tunnel address in the Internet field of Home Assistant URL. In the Companion app, put the same address in the External URL field of the connection settings. The app decides whether you are home from the Wi-Fi network name, which needs location permission; at home it uses the local address, away from home the tunnel address.

Step 5: Narrow down who can reach it

Home Assistant's own login is always in place; use a strong password and multi-factor authentication. On the Zorven side you can add:

  • Visitor login (all plans): a password, or Google/GitHub sign-in with an allowed e-mail list, in front of the tunnel. A good second gate for browser access.
  • IP allowlist (Pro and above): only listed addresses can connect. Mobile network IPs change often, so it suits fixed locations better than a phone.
  • WAF log mode and bot protection (all plans): surface scanners and known attack patterns; block mode and Geo rules start at Pro. If you enable bot protection you can exclude API paths.

Important: the Companion app's background requests (sensor updates, notifications) do not carry the browser cookie. With visitor login on, the app may fail to connect. If you use the app, keep visitor login off and rely on Home Assistant's own login plus WAF and bot protection.

Limits to know about

  • Latency: traffic is relayed through the Zorven server. For the dashboard and automations you rarely notice, but it is slightly slower than a direct connection.
  • Traffic: the Free plan has 5 GB per month at 10 Mbps; when the quota runs out the connection stays up and speed drops to 1 Mbps. If you watch camera streams often, you may need a higher plan.
  • Notice page: on the Free plan, the first browser visit to a zorven.app subdomain shows a one-time notice page (acknowledged for 1 day). Paid plans and custom domains (Hobby and above) don't show it.
  • No Zorven mobile client: the client runs on Windows, macOS and Linux; your phone simply connects to the tunnel address over HTTPS.

When should you choose Nabu Casa instead?

If you don't want to configure anything, Home Assistant Cloud is the simplest path: one toggle in the UI, no proxy settings, and Home Assistant's own docs call it the easiest and safest option for most people. Choose Zorven when you also want to publish other services from the same account (a NAS, a game server, a web project), use your own domain, or host the server side yourself (AGPLv3 open core).

Frequently asked questions

No. The Zorven client opens one outbound encrypted connection to the Zorven server, and visitors reach Home Assistant through it at an HTTPS address. That is why it also works behind CGNAT and with a dynamic IP.
Zorven adds an X-Forwarded-For header. Home Assistant blocks requests carrying it from an address it does not trust as a reverse proxy, by design. Turn on Trust X-Forwarded-For under Settings > System > Network, in the HTTP server section, and add the address the Zorven client connects from as a trusted proxy.
According to Nabu Casa's pricing page, Home Assistant Cloud costs $6.50 per month or $65 per year (tax not included), with a 31-day free trial. The service is being renamed Home Assistant Link on December 2nd. Checked on November 8, 2026.
The Free plan gives 2 tunnels, 5 GB of traffic per month and 10 Mbps, which is usually enough for the dashboard. A custom domain needs Hobby and the IP allowlist needs Pro. Camera streams can use up the traffic quota quickly.
It works in a browser, but the Companion app's background requests (sensor updates, notifications) do not carry the browser cookie, so the app may fail to connect while visitor login is on. If you use the app, rely on Home Assistant's own login and multi-factor authentication, plus WAF and bot protection.

Read next

Start free Download the client

Sources