Home Assistant runs locally on your own hardware. A VPS running WireGuard provides secure remote access to it from anywhere, without subscribing to Nabu Casa or exposing ports on your router. The VPS costs £4-8/month. Home Assistant Cloud (Nabu Casa) costs £6.50/month and adds external dependency. Both approaches work; this guide covers the self-hosted option.
The two options for Home Assistant remote access
Home Assistant’s own documentation covers two paths for accessing your installation remotely:
- Nabu Casa Home Assistant Cloud – a subscription service (currently $7/month in the US, around £6.50/month in the UK) that handles remote access through Nabu Casa’s servers. Simple to enable, but adds a recurring cost and a dependency on Nabu Casa’s infrastructure.
- Self-hosted VPN – running WireGuard on your own VPS as a tunnel endpoint. One-time setup, ongoing VPS cost only, and your data never passes through a third party’s servers.
This guide covers option 2.
How the VPS architecture works
Home Assistant runs on your local hardware (a Raspberry Pi, an Intel NUC, a dedicated server, or as a VM). The VPS does not run Home Assistant – it runs WireGuard and acts as the always-on relay point.
When you are away from home and want to access Home Assistant, your phone connects to the VPS via WireGuard. The WireGuard tunnel on the VPS connects to your home. Your Home Assistant is accessible as if you were on your home network, because you effectively are – through an encrypted tunnel.
This works because:
- WireGuard is established from your home out to the VPS (outbound connection, works through home broadband and CGNAT)
- The VPS has a stable public IP your phone can always reach
- All traffic is encrypted at the WireGuard layer
What you need
- A working Home Assistant installation (any hardware)
- A VPS with root access and KVM virtualisation (not OpenVZ)
- A domain name (recommended for TLS certificates)
- WireGuard app on your phone (iOS or Android)
VPS spec for Home Assistant remote access
WireGuard itself is extremely lightweight. For remote access to Home Assistant only, the smallest available VPS is sufficient: 1 vCPU, 512MB RAM, 10GB storage. If you also want to run MQTT, Node-RED or dashboards on the same VPS, step up to 2 vCPU and 2-4GB RAM.
Setting up the WireGuard tunnel
# On the VPS: install WireGuard
sudo apt install wireguard
# Generate VPS key pair
wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key
# Create the VPS config
cat > /etc/wireguard/wg0.conf << 'EOF'
[Interface]
PrivateKey = VPS_PRIVATE_KEY_HERE
Address = 10.10.0.1/24
ListenPort = 51820
[Peer]
# Home Raspberry Pi / HA device
PublicKey = HOME_DEVICE_PUBLIC_KEY
AllowedIPs = 10.10.0.2/32, 192.168.1.0/24
EOF
sudo systemctl enable wg-quick@wg0 --now# On the Home Assistant device: install WireGuard
sudo apt install wireguard # or use HA OS WireGuard addon
# Create the home device config
[Interface]
PrivateKey = HOME_PRIVATE_KEY
Address = 10.10.0.2/24
[Peer]
PublicKey = VPS_PUBLIC_KEY
Endpoint = your-vps.example.com:51820
AllowedIPs = 10.10.0.1/32
PersistentKeepalive = 25The PersistentKeepalive = 25 line is important: it sends a keepalive packet every 25 seconds to keep the connection alive through home broadband NAT.
The Home Assistant OS WireGuard add-on (by Mends) handles the HA side of this configuration with a simple UI. Install it from the Home Assistant add-on store rather than configuring WireGuard manually on the HA OS.
Accessing Home Assistant from your phone
Install the WireGuard app on your iPhone or Android. Import the peer configuration (the VPS acting as server, your phone as a second peer). When connected, your phone's traffic to 192.168.1.X (your home network) routes through the VPS tunnel. Open the Home Assistant companion app and it connects as if you are home.
VPS vs Nabu Casa: the honest comparison
| VPS + WireGuard | Nabu Casa | |
|---|---|---|
| Monthly cost | £4-8 (VPS only) | ~£6.50/month |
| Setup complexity | Moderate (one-time) | Very easy (3 clicks) |
| Data routing | Your own VPS only | Through Nabu Casa servers |
| Alexa / Google integration | Requires extra setup | Included |
| Remote UI from HA app | Via tunnel | Native in app |
| Depends on third party uptime | No | Yes (Nabu Casa) |
Nabu Casa is the right choice if you want a five-minute setup and Alexa/Google Home integration without extra work. The VPS approach is right if you want full control, lower ongoing cost, and no dependency on Nabu Casa's servers.
Adding MQTT, Node-RED and dashboards to the same VPS
One common pattern: run MQTT on the VPS for sensors throughout the home (smart plugs, temperature sensors, presence detection), pipe the data into Node-RED for automations, and access Home Assistant's dashboard via the WireGuard tunnel. The VPS becomes the central hub for both remote access and smart home data.
The detailed Home Assistant + WireGuard setup guide covers this pattern in full, including the Home Assistant OS WireGuard add-on configuration and phone client setup.
Using the Home Assistant OS WireGuard add-on
If you run Home Assistant OS (HAOS) rather than Home Assistant in Docker, the WireGuard setup is even simpler. Install the WireGuard add-on from the add-on store (Settings > Add-ons > Add-on Store > search "WireGuard"). The add-on handles key generation and the WireGuard configuration file. Paste in your VPS's public key and endpoint, and the add-on manages the tunnel automatically, including reconnecting after reboots.
Remote access to Home Assistant companion app
The Home Assistant companion app on iOS and Android detects whether the phone is on the local home network or remote. When on the local network, it connects directly to Home Assistant's local IP. When remote, it needs a reachable external address. With the WireGuard VPS setup, the app connects to Home Assistant's internal IP through the VPN tunnel - no need to expose Home Assistant publicly. Set the external URL in the app to the Home Assistant local IP address (e.g. http://192.168.1.X:8123), and it will work when connected to WireGuard.
Long-term cost comparison
At £6.50/month, Nabu Casa costs £78/year. A LumaDock VPS for WireGuard costs £4.53/month or £54/year. Over three years: Nabu Casa costs £234; the VPS approach costs £162. The VPS break-even (accounting for the one-time setup time) comes after roughly 6-9 months of use. If you use the VPS for anything else (MQTT, Node-RED, other services), the cost comparison is even more favourable.
Frequently asked questions
Does this work if my home broadband has a dynamic IP?
Yes. The WireGuard connection is initiated from your home device outbound to the VPS. Your home IP does not need to be fixed or reachable. Only the VPS needs a stable public IP (which it always has).
Does this work if my ISP uses carrier-grade NAT?
Yes. WireGuard works through CGNAT because the connection is initiated outbound from home to the VPS. The PersistentKeepalive setting (25 seconds) keeps the tunnel alive through the NAT.
Can I still use the Nabu Casa subscription alongside the VPS tunnel?
Yes. You can have both active simultaneously. Many people run the VPS tunnel as their primary access method and keep Nabu Casa for Alexa/Google Home integration only.
What happens if the VPS goes down?
Remote access to Home Assistant is unavailable while the VPS is down. Home Assistant continues to work normally at home - automations, local devices and the local dashboard are unaffected. This is why monitoring the VPS (covered in the VPS uptime guide) is worthwhile.
Is it possible to expose the Home Assistant dashboard publicly through the VPS?
Yes, by running Nginx on the VPS as a reverse proxy to forward traffic to your home HA instance through the WireGuard tunnel. This exposes HA publicly without opening ports at home. However, this means the HA login page is internet-facing, so strong passwords and two-factor authentication are essential.
Does the VPS approach support Home Assistant automations and webhooks?
Yes. All Home Assistant functionality works normally because the VPS is just providing a network path, not interpreting any HA data. Webhooks from external services (IFTTT, Zapier, etc.) can be forwarded through the VPS to HA.