Use cases
Home Assistant remote access with Cloudflare Tunnel
Reach Home Assistant from anywhere through Cloudflare Tunnel, without port forwarding or a static IP, with the trusted-proxy settings it needs and an optional login.
Cloudflare Tunnel is a popular way to reach Home Assistant away from home: no port
forwarding, no dynamic DNS, your home IP stays private, and it works behind CGNAT. In this
tutorial you publish Home Assistant at https://home.yourhost.com from a machine on your
home network, set up the companion app, and optionally put a login in front. It takes about
fifteen minutes.
What you need
- Home Assistant running on your network, for example at
http://192.168.1.50:8123. - A computer or server on the same network that stays on: a Mac mini, a Linux box, a Raspberry Pi 4 or 5 (Arm64 builds are available), or the machine running Home Assistant.
- A Cloudflare account with a domain (before you start).
1. Trust the tunnel in Home Assistant
Home Assistant refuses proxied requests (with 400: Bad Request) unless it trusts the
proxy. Add this to configuration.yaml and restart Home Assistant:
http:
use_x_forwarded_for: true
trusted_proxies:
- 127.0.0.1
- ::1
- 192.168.1.20 # the machine running Teitunnel, if it's not Home Assistant's ownUse the IP address of the machine where Teitunnel (and so cloudflared) runs. If it's the same machine as Home Assistant, the two loopback addresses are enough.
2. Check the machine can reach Home Assistant
On the machine that will run Teitunnel:
curl -I http://192.168.1.50:8123You should get an HTTP answer. If not, fix that first (firewall, address, Home Assistant not running): the tunnel can only reach what this machine can.
3. Add the route
- In Routes, choose New route.
- Public hostname:
homeonyourhost.com. Service:http://192.168.1.50:8123. - Choose Review, read the plan (a DNS record and the tunnel's configuration), then Add Route.
- In Tunnels, turn on Keep running when Teitunnel quits, so the route stays up after you quit the app and starts again when you log in.
After applying, Teitunnel tests the route through Cloudflare like a visitor. Open
https://home.yourhost.com and sign in as usual.
4. Use it in the companion app
In the Home Assistant app on your phone: Settings ▸ Companion app ▸ Server and set the
External URL to https://home.yourhost.com. Keep the internal URL for when you're home.
5. Add a login in front (optional)
For a second lock before Home Assistant's own sign-in, require a login: edit the route, open Advanced, turn on Require a login and list your email address under Who can sign in. Visitors then prove their email to Cloudflare first, and nothing reaches Home Assistant until they have.
teitunnel route add home-admin.yourhost.com http://192.168.1.50:8123 --allow team@yourhost.comThe Home Assistant companion apps can't complete a Cloudflare Access sign-in by themselves.
If you use them away from home, leave the login off the hostname they use, and use a
separate hostname with the login (like home-admin.yourhost.com above) for browsers.
To slow down scripts probing your login page, edge protection can challenge automated clients on the hostname (Automated clients ▸ Challenge). It matches scripts, command-line tools and headless browsers by their user agent; check afterwards that the companion app still connects.
Troubleshooting
Where to go next
Last updated on
Put an MCP server online
Make an MCP server running on your computer reachable by claude.ai, ChatGPT, Claude Code on another machine and other remote AI clients, behind a bearer token or an OAuth sign-in you approve.
Self-host from home without port forwarding
Publish a website, NAS, dashboard or self-hosted app from a home server with Cloudflare Tunnel, even behind CGNAT, with your home IP hidden and no open ports.